Re: [webmin-l] Webmin security risk!

[Jamie C. <jca...@we...>]

Even a cert wouldn't help in this case, as again Webmin would need to
be able to read that cert, and thus so could an attacker.

If someone has root access on a Webmin system that is controlling other
slaves (via the Webmin Servers Index module and cluster featues), even if
some amazing form of security prevents him from getting the password, he
could still do nasty things by changing the code on the master system to
send malicious commands to slaves when a legitimate user uses the master.

 - Jamie

On 25/Aug/2006 07:48 =3D?ISO-8859-1?Q?J=3DE9r=3DF4me_Wax?=3D wrote ..
> In complex company, root for a specific computer do not alwars know all
> passwords and don't have all power.
> 
> Certificates can solve this problem by adding a limitation in time for
> example.
> 
> Behind this simple question, most of softwares use now certificates 
> mechanism.
> 
> Why do not just give webmin users the choice between certificates or 
> plain text ?
> 
> __________________________
> http://www.lo2k.net
> 
> Hamid Hashemi a =E9crit :
> > You are saying that there is no security for that but there is ! As 
> > Jamie said the files are readable by root only. and if you think that
> > someone who can access the root files will have problem decoding the
> > passwords are stored in these files, then you are wrong !
> > We have to work on the files security instead of encoding the password
> > with some mechanism which can be decoded easily.
> >
> > _Hamid
> >
> > J=E9r=F4me Wax wrote:
> >>>> It could at least be encrypted with a private key and then decrypted
> >>>> inside Webmin to pass to the other systems. This would add to the
> >>>> inconvenience of abusing the password, should it be viewed, but any
> >>>> impression of this being a secure solution is an illusion.
> >>>> Even using asymmetric keys, as in ssh, Webmin would still hold some
> >>>> credential which could be copied and abused.
> >>>> It's an intractable problem.
> >>>> --r
> >>>>     
> >>>>       
> >>> Private keys are a one way incription mechanism. You have to know the
> >>> original password, and then encrypt it with the public key to see if
> the 
> >>> result is the same. In our case, we want a method that will allow webmin
> >>> to know the password. There is no simple anwer here. If Webmin encrypts
> >>> the password, then any potential hacker can use the encrypription method
> >>> from Webmin to retrieve it. Just a waste of time.
> >>>   
> >>>     
> >> You close your door after leaving your home but any people can open
> it 
> >> with right tools.
> >> If you let it open, people are encouraged to enter...
> >>
> >> Poor protection is better than none.
> >>     
> 
> 
> -------------------------------------------------------------------------
> Using Tomcat but need to do more? Need to support web services, security?
> Get stuff done quickly with pre-integrated technology to make your job
> easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D121642
> -
> Forwarded by the Webmin mailing list at web...@li...
> To remove yourself from this list, go to
> http://lists.sourceforge.net/lists/listinfo/webadmin-list