Full Disclosure mailing list archives
Re: AFS - The Ultimate Sulution? -- What is the point?
From: "Brandon S. Allbery KF8NH" <allbery () ece cmu edu>
Date: Sun, 17 Sep 2006 11:23:36 -0400
On Sep 17, 2006, at 10:03 , Valdis.Kletnieks () vt edu wrote:
Go back and re-read the last few batches of AFS updates, and ask youself for each bugfix "Could this *potentially* have been leveraged by a clued hacker?".
I haven't noticed many issues beyond potential denial of service attacks --- which are mitigated to some extent by replication (of course, someone could go after *all* the servers...). The biggest problems at this point are: - if you get the afs/cell@REALM key, you've got the entire cell - no data encryption to speak of (fcrypt? it is to laugh) Work is being done on both fronts, although I'm not the right person to speak to about either. In any case, you need to lock up your DB and file servers as tight as you can if you want the cell to be at all secure. (Unfortunately, I don't think anyone has, other than inadvertently, tested how AFS reacts to invalid packets. One of those things I'd love to do if I ever got a few round tuits....) -- brandon s. allbery [linux,solaris,freebsd,perl] allbery () kf8nh com system administrator [openafs,heimdal,too many hats] allbery () ece cmu edu electrical and computer engineering, carnegie mellon university KF8NH _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: AFS - The Ultimate Sulution? -- What is the point? マグロ原子 (Sep 15)
- Re: AFS - The Ultimate Sulution? -- What is the point? Dean Pierce (Sep 15)
- Re: AFS - The Ultimate Sulution? -- What is the point? Dude VanWinkle (Sep 16)
- Re: AFS - The Ultimate Sulution? -- What is the point? Paul Sebastian Ziegler (Sep 17)
- Re: AFS - The Ultimate Sulution? -- What is the point? Valdis . Kletnieks (Sep 17)
- Re: AFS - The Ultimate Sulution? -- What is the point? Brandon S. Allbery KF8NH (Sep 17)
- Re: AFS - The Ultimate Sulution? -- What is the point? Brian Eaton (Sep 17)
- Re: AFS - The Ultimate Sulution? -- What is the point? Brandon S. Allbery KF8NH (Sep 17)
- Re: AFS - The Ultimate Sulution? -- What is the point? Dude VanWinkle (Sep 16)
- Re: AFS - The Ultimate Sulution? -- What is the point? Dean Pierce (Sep 15)