Re: [Samba] compromising security
On Mon, 2005-07-04 at 16:57 -0500, Gerald (Jerry) Carter wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > Tomasz Chmielewski wrote: > > > All that should be done is to unplug the workstation > > from the network, then plug a laptop with a network sniffer > > into the workstation (connect the network cards), and > > watch the traffic... If the laptop acts with a name of a "real" > > server, and has "encrypt passwords = no" - would the workstation > > send the credentials in plaintext, and thus, all carefully > > crafted security would be compromised? > > > > Or is something fundamentally wrong in my thinking > > (hopefully)? > > Current Windows clients will not send the clear text of a > password unless you have configured a registry setting to tell > them it is OK. Around Windows NT 4.0 SP3, MS had the same > thought you did. However, the lanman password that is still sent by default is not difficult to crack, but it does take much longer than just reading the network sniff. It is best to use > 14 char passwords for such accounts, as windows will not store nor use the LM password in that case (the other option involves the registry, and disabling that). Andrew Bartlett -- Andrew Bartletthttp://samba.org/~abartlet/ Samba Developer, SuSE Labs, Novell Inc.http://suse.de Authentication Developer, Samba Team http://samba.org Student Network Administrator, Hawker College http://hawkerc.net signature.asc Description: This is a digitally signed message part -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
Re: [Samba] compromising security
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Tomasz Chmielewski wrote: > All that should be done is to unplug the workstation > from the network, then plug a laptop with a network sniffer > into the workstation (connect the network cards), and > watch the traffic... If the laptop acts with a name of a "real" > server, and has "encrypt passwords = no" - would the workstation > send the credentials in plaintext, and thus, all carefully > crafted security would be compromised? > > Or is something fundamentally wrong in my thinking > (hopefully)? Current Windows clients will not send the clear text of a password unless you have configured a registry setting to tell them it is OK. Around Windows NT 4.0 SP3, MS had the same thought you did. cheers, jerry -BEGIN PGP SIGNATURE- Version: GnuPG v1.4.0 (GNU/Linux) Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org iD8DBQFCybDYIR7qMdg1EfYRAqUiAKCEEPHvblUsrsPzhxGsD4JIWg18zACfXb/Y fjH0EUoQA0lEipFVYo5AZgM= =/Ftr -END PGP SIGNATURE- -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
[Samba] compromising security
Recently, I was thinking if my setup is secure. When the workstations start, they also start a script, which connects to a Samba share with username/password (and there is software in this share, with the registration keys etc. important data). On a workstation, this script can't be read by a normal user (I was considering some sort of simple pseudo-encrypting, which would turn plaintext usernames/passwords into a pseudo-encrypted file; in case the disk or one of workstations is stolen). But then I realised, that probably it's much easier to get all credentials, without stealing a disk or decrypting a file with passwords, so all efforts to protect the shares with usernames/passwords and encrypting the script are probably useless. All that should be done is to unplug the workstation from the network, then plug a laptop with a network sniffer into the workstation (connect the network cards), and watch the traffic... If the laptop acts with a name of a "real" server, and has "encrypt passwords = no" - would the workstation send the credentials in plaintext, and thus, all carefully crafted security would be compromised? Or is something fundamentally wrong in my thinking (hopefully)? -- Tomek -- To unsubscribe from this list go to the following URL and read the instructions: https://lists.samba.org/mailman/listinfo/samba
