On Sat, Jan 08, 2011 at 12:31:16AM +0100, Mike Gabriel wrote:
Hi Andi, On Fr 07 Jan 2011 10:41:41 CET "Andreas B. Mundt" wrote:Take a look at <URL:http://svn.debian.org/wsvn/debian-edu/trunk/src/debian-edu-config/cf/cf.homes>, i.e. our exports file. If a machine want's to mount the home directories, it first has to be added to a netgroup that allows mounting the share. So if you walk into the school with your Laptop to fake an identity on the net, it will not work the first time, because your MAC address will be differerent from the machines in the netgroup you need the membership of. The next day you walk into school you will be better prepared, you modified the Laptop's MAC. Now, just plug off the machine you got the MAC from and use your Laptop instead with the nice user ID. I guess that's how current security is thought to be.This setup is not really secure. If you have access to one of the school computers (Skolelinux clients) you boot it, use ifconfig and look up its IP. Then you shut the Skolelinux client down, take over its IP (static IP, not DHCP) and then you can mount the NFS share(s) on tjener.
Inspired by your recent comment, Mike, on appreciating historical reasonings, I can shed some light on the above:
Historically (i.e. 2003-2004 timeframe at least[1][2]) Skolelinux thin clients was assumed to be served in a non-hostile environment.
You might find interest in (re)reading that old discussion, which also touches Kerberos (although only briefly - I had and still have too little experience in that area).
My interest in raising it here is not fingerpointing but potential for enlightenment.
If anyone non-scandinavian are curious about the first (heated) discussion then tell me what kind of details you are interested in and I shall try to summarize in english.
Kind regards, - Jonas Very very happy to follow this current effort on integrating Kerberos![1] https://init.linpro.no/pipermail/skolelinux.no/linuxiskolen/2003-April/009981.html
[2] http://lists.debian.org/msgid-search/404D0BEE.5010106@jones.dk -- * Jonas Smedegaard - idealist & Internet-arkitekt * Tlf.: +45 40843136 Website: http://dr.jones.dk/ [x] quote me freely [ ] ask before reusing [ ] keep private
Attachment:
signature.asc
Description: Digital signature