[OpenAFS] token theft under XP (High security option)
Rodney M Dyer
rmdyer@uncc.edu
Fri, 13 Dec 2002 14:38:19 -0500
At 09:49 AM 12/13/2002 -0800, you wrote:
>Token theft is an issue with windows, not necessary with just XP.
>
>Basically there was no solution to destroy tokens when the user logs out so
>the token is left around for the next user who logs on to grab (if they know
>the previous username).
This doesn't make any sense to me. We've been using Transarc's AFS since
it came out for Win32. The following article definitely says that the
token is destroyed. This is from the mouths of the Transarc developers.
http://www.transarc.ibm.com/TRACS/afs/54630
Is the token destroyed, or is it not? Which is it? My observations are
that it is.
Rodney
>I suggest you use the "High security" option. We designed this option to
>make it difficult to grab 'left over tokens' by creating an internal secret
>user name. Using the High Security option will make it next to impossible to
>steal your tokens.
>
>If you use Regedit, change the Logon Options parameter to 2 or 3 and reboot.
>
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TransarcAFSDaemond\Netw
>orkProvider
> LogonOptions = 1 - Integrated Logon
> LogonOptions = 2 - High Security options, Random User name generation
> LogonOptions = 3 - both
>
>James Peterson
>"Integrity is the Base of Excellence"
>
>P.S.
>If someone could direct me to a system 'call back' or process that is
>invoked when a user logs out then I would gladly fix that problem.
>
>_______________________________________________
>OpenAFS-info mailing list
>OpenAFS-info@openafs.org
>https://lists.openafs.org/mailman/listinfo/openafs-info