Re: [hosers-talk] opie

[Joel Uckelman <uckelman@xxxxxxxxx>]

Thus spake "Jon Stewart":
> http://www.inner.net/opie
> 
> Opie is a one-time password package for linux. Herewith, my plan for 
> allowing secure logins into my linux box from an untrusted host:
> 
> 1. Create two user accounts, my "real" account and a dummy account. 
> Generate a public/private key pair for each; the dummy account private key 
> will be left unencrypted, hence no password is required.
> 
> 2. Put the real account's private key within the home directory of the 
> dummy user. Put the dummy account's private key on a usb drive for use on 
> the road.
> 
> 4. Install opie and memorize list of one-time passwords (annoying).
> 
> 5. ssh into my linux box from an untrusted host (e.g. work box, internet 
> cafe, client sites, etc.), using dummy account. Authenticate using 
> unencrypted private key on usb drive.
> 
> 6. As second step, opie prompts for the appropriate one-time password. 
> This is typed in from memory.
> 
> 7. Access is now granted to dummy account. ssh into real account using 
> encrypted private key, entering its password.
> 
> Normally, a login from an untrusted host can easily defeat ssh's public 
> key authentication as the private key must exist on the host for some 
> period of time and the password to the key must be entered; a careless ssh 
> implementation could forget to memlock the password buffer, so it could 
> get swapped out, and even memlock is no protection against keyloggers 
> (which are becoming increasingly prolific). By using the one-time 
> password, which is a secret, you can blithely ignore keyloggers and swap. 
> By using public key authentication for the private account, you combine 
> something you know (the OTP) with something you have (the private key) and 
> you also initiate an encrypted session. Once into the dummy account, you 
> can then safely enter your password for the real private key, because the 
> real private key never leaves the trusted machine.
> 
> A dummy account is used so that trusted hosts can log into the real 
> account directly, avoiding the OTP rigamarole.
> 
> Clumsy, but I think it should work.

Two problems:

1. Some of the machines from which I log in do not have user-accessible
USB ports, so carrying around a pen drive with my private key wouldn't
help me.

2. I'm not quite sure that I understand the utility of the dummy account.
What exactly do you gain with it over having one account using OTP and
logging in directly to that one? You're still safe from keyloggers. Is it
just that if your one-time pad generating scheme turns out to have a flaw,
then the best that a determined hacker can do is log in to your dummy
account?
 
_______________________________________________
hosers-talk mailing list
hosers-talk@xxxxxxxxxxx
http://lists.ellipsis.cx/mailman/listinfo/hosers-talk