Beefy Boxes and Bandwidth Generously Provided by pair Networks
Welcome to the Monastery
 
PerlMonks  

Re^3: Authentication with /etc/shadow

by fullermd (Priest)
on Feb 27, 2011 at 05:11 UTC ( [id://890369]=note: print w/replies, xml ) Need Help??


in reply to Re^2: Authentication with /etc/shadow
in thread Authentication with /etc/shadow

Please don't.

In my programming life, I've seen at least 2 orders of magnitude more problems caused by people manually mucking about with things that have nice defined API's for fanciful reasons, than problems caused by something being too slow for doing so.

If it's a problem, find out that it's a problem first, then fix it. And in this case, you'll eat the crypto overhead either way, so what do you think you'll save?

Replies are listed 'Best First'.
Re^4: Authentication with /etc/shadow
by fluffyvoidwarrior (Monk) on Feb 27, 2011 at 06:53 UTC
    Well, maybe the monks could think of a better route to take if I told more of the story. This could then be a long post and there will be discrepancies in what I tell you because I can't tell you everything.

    Normally I would agree entirely with the point you just made.

    My problem is:-

    I have a program that loops once a second and provides command and control for a real world system - like a perl emulation of a plc. The real world system I am controlling has massive security significance for my client. It isn't exposed to wan access but it will never have very good physical security.

    The main security risk I can see is the possibility of an attacker copying my program (stealing a hard drive or system unit wouldn't work) and running it on his computer to gain access via a hole in the wall. My program is a perlapp so trivial code inspection is unlikely. The situation is changing constantly and I only need to delay an attacker a few hours and his attack becomes pointless. Though he can steal the program and run on it on his computer I am hoping he is unlikely to clone my users. I want to authenticate my system users with every pass of my program loop and shred my perlapps if any of various conditions (user validation being one indicator that my program is running under an alien environment) are not met, thus causing the needed delay. Only one of my checks needs to fail and my program will commit suicide.
    (security of some user passwords is not a consideration - I don't mind hard coding some of them in my perlapp)

    The need for speed and low system overhead is due to the fact that my program may have to handle up to 50 requests with each pass and all the validity checks have to be done on every pass (if an attacker successfully runs a single pass then all could be lost). There will only ever be a handful of system users. All this is far from perfect and it isn't security but it's better than nothing.

    I can probably thwart the unskilled with this sort of stuff and maybe delay the skilled long enough if I'm lucky. Anyway, physical security isn't really my responsibility - I'm just trying to help them out a bit.
[reply]

In Section Seekers of Perl Wisdom

Log In?
Username:
Password:

What's my password?
Create A New User
Domain Nodelet?

www.com | www.net | www.org
Node Status?
node history
Node Type: note [id://890369]
help
Chatterbox?
and the web crawler heard nothing...

How do I use this? • Last hour • Other CB clients
Other Users?
Others making s'mores by the fire in the courtyard of the Monastery: (3)
As of 2024-04-24 02:37 GMT
Sections?
Information?
Find Nodes?
Leftovers?
    Voting Booth?

    No recent polls found