tailieunhanh - hack proofing linux a Guide to Open Source Security phần 6

Chính này công nhận dịch vụ FTP cho các dịch vụ . Bất kỳ người sử dụng đúng cách xác thực với KDC và những người được phép truy cập vào dịch vụ này sau đó sẽ có thể sử dụng dịch vụ FTP trên máy chủ . Nhiều lần, tuy nhiên, một hiệu trưởng không có một cá thể. Ví dụ, nó có thể tạo ra một chính người sử dụng, sẽ xuất hiện như sau: | Network Authentication and Encryption Chapter 6 323 Figure A Kerberos Principal Principal Primary Host Instance Realm @ The following is an example of a host daemon principal ftp This principal recognizes the FTP service for the service. Any user who properly authenticates with the KDC and who is allowed access to this service will then be able to use the FTP service on the host. Many times however a principal does not have an instance. For example it is possible to create a user principal which would appear as follows james@ principal would allow a user to log on to any host in a Kerberos can of course specify an instance for a user. For example the following principal would allow login to only the system named james @ The Kerberos Authentication Process The information in the next couple of paragraphs is greatly simplified but it is more than enough from a system administrator s point of a Kerberos client first obtains a TGT from the KDC this token does not actually provide access to any particular daemon or network service. It is simply a token that informs other hosts that the KDC has authenticated this host and that this host and user can request services from other hosts. Because the TGT is signed by the user s password and turned into a hash the user can use the kinit command and his own password to generate the same hash and make a comparison between the two. If the TGT and password match then a session key is established and a credential cache is created usually in a file in the tmp directory. 324 Chapter 6 Network Authentication and Encryption After the credential cache file is populated with the TGT the host and user can then use this TGT to actually log on to hosts and request it comes time for a user a principal to