client [LWN.net]

client

Posted Jan 10, 2007 19:21 UTC (Wed) by drag (subscriber, #31333)
In reply to: client by jhardin@impsec.org
Parent article: NuFW: Single sign-on meets firewall (Linux-Watch)

Instead of sending username and password over the network it would be better just to send the username.

Then service should send a challenge response back that is encrypted with the user's password or other shared secret. Or maybe encrypted with the user's public key in a GPG shared key sceme or something like that.

Something...

(Log in to post comments)

client

Posted Jan 10, 2007 22:41 UTC (Wed) by Regit (guest, #31516) [Link]

Authentication is done via SASL inside a TLS tunnel. NuFW is thus responsible of login/password check (check is done on an external database like an LDAP or any classical other method). This insures that the user has given correct credentials.

When this initial authentication phase is done, the user sends authentication packet (packet which try to authenticate IP packet) other the TLS tunnel. These auth packets are automatically associated to the user as packet is coming from an authenticated TLS tunnel.

Thus, at *NO* moment, NuFW trusts the user. It associates packets to user after the user has proven (with correct credentials) who he is.