1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
|
.\" $FreeBSD$
.\"
.Dd January 12, 2001
.Dt SKEY.ACCESS 5
.Os
.Sh NAME
.Nm skey.access
.Nd "S/Key password control table"
.Sh DESCRIPTION
The S/Key password control table
.Pq Pa /etc/skey.access
is used by
.Nm login Ns \-like
programs to determine when
.Ux
passwords may be used
to access the system.
.Bl -bullet
.It
When the table does not exist, there are no password restrictions.
The user may enter the
.Ux
password or the S/Key one.
.It
When the table does exist,
.Ux
passwords are permitted only when
explicitly specified.
.It
For the sake of sanity,
.Ux
passwords are always permitted on the
systems console.
.El
.Sh TABLE FORMAT
The format of the table is one rule per line.
Rules are matched in order.
The search terminates when the first matching rule is found, or
when the end of the table is reached.
.Pp
Rules have the form:
.Pp
.Bl -item -offset indent -compact
.It
.Ic permit
.Ar condition condition ...
.It
.Ic deny
.Ar condition condition ...
.El
.Pp
where
.Ic permit
and
.Ic deny
may be followed by zero or more
.Ar conditions .
Comments begin with a
.Ql #
character, and extend through the end of the line.
Empty lines or
lines with only comments are ignored.
.Pp
A rule is matched when all conditions are satisfied.
A rule without
conditions is always satisfied.
For example, the last entry could
be a line with just the word
.Ic deny
on it.
.Sh CONDITIONS
.Bl -tag -width indent
.It Ic hostname Ar wzv.win.tue.nl
True when the login comes from host
.Ar wzv.win.tue.nl .
See the
.Sx WARNINGS
section below.
.It Ic internet Ar 131.155.210.0 255.255.255.0
True when the remote host has an internet address in network
.Ar 131.155.210 .
The general form of a net/mask rule is:
.Pp
.D1 Ic internet Ar net mask
.Pp
The expression is true when the host has an internet address for which
the bitwise and of
.Ar address
and
.Ar mask
equals
.Ar net .
See the
.Sx WARNINGS
section below.
.It Ic port Ar ttya
True when the login terminal is equal to
.Pa /dev/ttya .
Remember that
.Ux
passwords are always permitted with logins on the
system console.
.It Ic user Ar uucp
True when the user attempts to log in as
.Ar uucp .
.It Ic group Ar wheel
True when the user attempts to log in as a member of the
.Ar wheel
group.
.El
.Sh COMPATIBILITY
For the sake of backwards compatibility, the
.Ic internet
keyword may be omitted from net/mask patterns.
.Sh WARNINGS
When the S/Key control table
.Pq Pa /etc/skey.access
exists, users without S/Key passwords will be able to login only
where its rules allow the use of
.Ux
passwords.
In particular, this
means that an invocation of
.Xr login 1
in a pseudo-tty (e.g. from
within
.Xr xterm 1
or
.Xr screen 1
will be treated as a login
that is neither from the console nor from the network, mandating the use
of an S/Key password.
Such an invocation of
.Xr login 1
will necessarily
fail for those users who do not have an S/Key password.
.Pp
Several rule types depend on host name or address information obtained
through the network.
What follows is a list of conceivable attacks to force the system to permit
.Ux
passwords.
.Ss "Host address spoofing (source routing)"
An intruder configures a local interface to an address in a trusted
network and connects to the victim using that source address.
Given
the wrong client address, the victim draws the wrong conclusion from
rules based on host addresses or from rules based on host names derived
from addresses.
.Pp
Remedies:
.Bl -enum
.It
do not permit
.Ux
passwords with network logins;
.It
use network software that discards source routing information (e.g.\&
a tcp wrapper).
.El
.Pp
Almost every network server must look up the client host name using the
client network address.
The next obvious attack therefore is:
.Ss "Host name spoofing (bad PTR record)"
An intruder manipulates the name server system so that the client
network address resolves to the name of a trusted host.
Given the
wrong host name, the victim draws the wrong conclusion from rules based
on host names, or from rules based on addresses derived from host
names.
.Pp
Remedies:
.Bl -enum
.It
do not permit
.Ux
passwords with network logins;
.It
use
network software that verifies that the hostname resolves to the client
network address (e.g. a tcp wrapper).
.El
.Pp
Some applications, such as the
.Ux
.Xr login 1
program, must look up the
client network address using the client host name.
In addition to the
previous two attacks, this opens up yet another possibility:
.Ss "Host address spoofing (extra A record)"
An intruder manipulates the name server system so that the client host
name (also) resolves to a trusted address.
.Pp
Remedies:
.Bl -enum
.It
do not permit
.Ux
passwords with network logins;
.It
the
.Fn skeyaccess
routines ignore network addresses that appear to
belong to someone else.
.El
.Sh DIAGNOSTICS
Syntax errors are reported to the
.Xr syslogd 8 .
When an error is found
the rule is skipped.
.Sh FILES
.Bl -tag -width /etc/skey.access
.It Pa /etc/skey.access
password control table
.El
.Sh SEE ALSO
.Xr login 1 ,
.Xr syslogd 8
.Sh AUTHORS
.An Wietse Venema ,
Eindhoven University of Technology,
The Netherlands.
|
