Re: using PAM for authentication

From: Reinhard Eilmsteiner (news-stuff_at_eilm.at)
Date: 04/22/04 

Date: Thu, 22 Apr 2004 20:35:14 +0200

Hi Bill!

I agree that OS services are usually tested thoroughly enough to rely on
their security.

But:
Security: If you create an OS user account for each user in your
web-application (and there can be many of them), these user may gain
rights to the system they don't really need. So the chance that if your
application has some security-related bug the user may be logged in to
your application server. This is something I really don't like when I'm
talking about >100 users. If the user can crash the application that's
one thing. If he can try "su" that's another.

Maintenance: Big applications usually define their own life-cycle for
users which has some influence on the authentication procedure. Example:
Some user signs in to your application: A user is created, but remains
inactive until a mail sent by the application is replied, some link is
requested, whatever. Then the user gets activated through the
application. In order to be able to do this kind of operation on the
*nix you have to be root. So some process of the application must be
able to su or have some sudo kind of access to the user administration
of the system. => No good.

Portability: If my users are in some kind of database of its own, I
don't have to care about operating system stuff when I take the
application and deploy it on some new system. You also don't have to
deal with the network security staff, who are always reluctant to change
anything in a living (productive) environment. The application also
gains some more independence from the os flavour, as it is a little more
decoupled.

I don't know who of us is right. Most probably this decision has to be
made for each and every case and the result will differ with different
requirements.

Regards,
Reinhard

Relevant Pages

  • Re: password protect a folder
    ... But if all users are using the same user account then encrypting files using ... the operating system isn't any good. ... With using the 'pst' idea like the Outlook MVP person suggested isn't a good ... > security is excellent, unless someone is determined to get into that file. ...
    (microsoft.public.office.misc)
  • [Full-Disclosure] w32.frethem.k@mm and good reading
    ... Script kiddies deface websites. ... only obfuscating your own perception of security. ... >> vulnerabilities in a particular operating system or server software ... >> Imagine a custom operating system used by only a few servers, ...
    (Full-Disclosure)
  • [Full-Disclosure] w32.frethem.k@mm and good reading
    ... Script kiddies deface websites. ... only obfuscating your own perception of security. ... >> vulnerabilities in a particular operating system or server software ... >> Imagine a custom operating system used by only a few servers, ...
    (Full-Disclosure)
  • Re: Need advice about hacking and security
    ... and look at the Received-From: ... A trojan (from Trojan horse) is a seemingly innocuous ... > systems via various security holes. ... Windows Me is the operating system. ...
    (comp.security.misc)
  • Re: on the topic of stability
    ... >> software firewalls for evaluation without problems. ... >Yeah, true, no operating system is 100% secure by itself. ... >> internet apps designed with security in mind. ... >Win98se has almost no security built into the file system. ...
    (comp.security.firewalls)