> > One thought makes me really nervous about this approach: what if the
> > authenticating gateway is compromised? Then you can rlogin from there
> > to the inside, with no passwords on the inside.
>
> True, but it does solve one of the associated problems with the telnet
> to firewall, then telnet into the site, passing one's (presumably)
> cleartext password inside while you go. Unless you have encrypted
> telnet to the firewall, your password's still in the clear from
> your (Internet based) originating station to the firewall, so being able
> to 'hide' your password by using rlogin could be a benefit.
>
> In the best of all worlds, both the bastion and the internal
> hosts would have something like S/key, but assuming that only the firewall's
Hmmm. What about a drop-in replacement for telnetd on inside machines that
would use s/key (or whatever) if the source was the bastion host, but used
regular passwords for internal telnets...
______/ Jeff LaCoursiere FastLane Communications
/ Network security/services mail info @
fl .
uprc .
com
___/ lacoursj @
uprc .
com
/
__/ ASTLANE Communications! Connecting America to the Internet...
Follow-Ups:
|
|
