News for hackers. Stuff that matters.

A comment on Mosh: the mobile shell. Parent comment

Re:Mosh: the mobile shell by 4ad on Monday September 05, 2016 @08:33AM (#12429825)
In such an environment you should be using Kerberos. Then you won't need agent forwarding, and you can maintain security.

I would argue that in such an environment you really should be using LDAP+Kerberos, but if you think LDAP is too much effort (it really isn't), plain Kerberos is comparatively trivial to administer, and adding Kerberos (unlike LDAP) doesn't really require any significant changes to your environment.

[ Parent | on HN ]
Re:Mosh: the mobile shell by brians on Monday September 05, 2016 @10:05AM (#12430377)
Why is Kerberos ticket forwarding better than agent forwarding? Either way, root (or a bad .bashrc) can use your credentials while you're logged in.
[ Parent | on HN ]
Re:Mosh: the mobile shell by 4ad on Monday September 05, 2016 @11:59AM (#12430921)
Sorry. You are absolutely right. Long day...

I disable Kerberos ticket forwarding here, for this exact same reason. But then you don't have ticket forwarding! I don't know what I was thinking.

[ Parent | on HN ]
Re:Mosh: the mobile shell by jstanley on Monday September 05, 2016 @10:13AM (#12430414)
How does LDAP solve the problem?

We use LDAP to manage public keys for each user, but they still need to supply a private key at some point.

[ Parent | on HN ]
Re:Mosh: the mobile shell by 4ad on Monday September 05, 2016 @12:01PM (#12430929)
I was talking about Kerberos, not LDAP. However, that's still not right, see parallel comment.
[ Parent | on HN ]