| |||||||||||||
Kernel key managementKernel key managementPosted Nov 22, 2006 16:15 UTC (Wed) by kleptog (subscriber, #1183)Parent article: Kernel key management
Seems to me that this could pave the way for pervasive authentication. When a user logs in (say with a some token) that could be stored in the session keyring. This would then be available for any subprocess (it's preserved over fork, clone, execve, etc) to authenticate itself to something else. Sort of like ssh-agent on steriods.
Or am I missing something important?
(Log in to post comments)
ssh-agent Posted Nov 23, 2006 17:19 UTC (Thu) by ncm (subscriber, #165) [Link] Seems like ssh-agent itself would be a good choice for this role.
ssh-agent Posted Nov 23, 2006 18:07 UTC (Thu) by kleptog (subscriber, #1183) [Link] Hmm, the reason why I think ssh-agent isn't up to the job are two-fold:
- The link to the agent is via an environment variable, which isn't preserved in a variety of situations.
The stuff in this article can fix both since preservation is guarenteed and the keys can be protected even from root (barring direct memory reads ofcourse).
ssh-agent Posted Nov 24, 2006 18:44 UTC (Fri) by dlang (✭ supporter ✭, #313) [Link] and the fact that root can su to any other user
|
|||||||||||||