Re: [Ltsp-discuss] ltsp root of trust

2007-08-14 Thread Anselm Martin Hoffmeister
Am Montag, den 13.08.2007, 08:52 +0800 schrieb [EMAIL PROTECTED]: > On Monday 13 August 2007 03:05, [EMAIL PROTECTED] > wrote: > > > I am a big fan of SSH PKI. If a login manager could be made to require > > > and id_dsa key, would that make the session more secure? > > > > The point of a trusted

Re: [Ltsp-discuss] ltsp root of trust

2007-08-12 Thread jam
On Monday 13 August 2007 03:05, [EMAIL PROTECTED] wrote: > > I am a big fan of SSH PKI. If a login manager could be made to require > > and id_dsa key, would that make the session more secure? > > The point of a trusted system is that it can be verified to be trusted > right from the boot stage. T

Re: [Ltsp-discuss] ltsp root of trust

2007-08-12 Thread Anselm Martin Hoffmeister
Am Montag, den 30.07.2007, 10:02 -0600 schrieb Roy Souther: > Francis, your post got me thinking. > > I am a big fan of SSH PKI. If a login manager could be made to require > and id_dsa key, would that make the session more secure? The point of a trusted system is that it can be verified to be tr

Re: [Ltsp-discuss] ltsp root of trust

2007-07-30 Thread Gideon Romm
We have had this question arise in the past with our users. The *best* option, in our opinion, is to prevent boot server spoofing at the switch level. A good Level 3 switch should you give the ability to not only filter by MAC which is a weak form of security, but also to permit dhcp-server traff

Re: [Ltsp-discuss] ltsp root of trust

2007-07-30 Thread Roy Souther
Francis, your post got me thinking. I am a big fan of SSH PKI. If a login manager could be made to require and id_dsa key, would that make the session more secure? Maybe the open source etherboot project could be made to require server identity before booting. One way an attack like this could h

[Ltsp-discuss] ltsp root of trust

2007-07-30 Thread Francis Giraldeau
Hi, I wish to discuss about security issues about LTSP. For example, anybody that starts a DHCP server may make thin-clients booting on another "alien" server. So, even with encrypted SSH connexions, the login is not really protected. By now, the only way I know to secure it more is to install