Re: controlling/monitoring clients

Any file shared out by nfs that needs to be accessed by thin cliens is
vulnerable. Honestly any file shared out by nfs that's not auth'd
against Kerberos is vulnerable (maybe not even then), and judging by
the fact that you want to use a file to auth against, I'm guessing
you don't have kerberos. NFS is, by far, one of the least secure
protocols in existence, and has been for years. I don't think there's
any way around that. 

But why not use pam/ldap for authenticating the x11vnc session using
the -unixpw flag. x11vnc supports using pam to auth, and ldap is a
shared auth system designed to be secure even with untrusted clients...
plus ldap is really nice for centralized authentication of thick client
systems and storing other data. 

Alternatively you could use -unixpw_cmd and write some script that
would try to authenticate against the server. 

On Tue, 12 Aug 2008 16:12:14 -0700
"Robert Arkiletian" <[email protected]> wrote:

> On Tue, Aug 12, 2008 at 3:52 PM, Warren Togami <[email protected]>
> wrote:
> > "Protected" is really relative.  It is still trivially easy for a
> > user logged into the system to get at that password file.
> >
> 
> I mean only readable by root. Filesystem permission protected.
> 


-- 

Josh Dukes
MicroVu IT Department

-------------------------------------------------------------------------
This SF.Net email is sponsored by the Moblin Your Move Developer's challenge
Build the coolest Linux based applications with Moblin SDK & win great prizes
Grand prize is a trip for two to an Open Source event anywhere in the world
http://moblin-contest.org/redirect.php?banner_id=100&url=/
_____________________________________________________________________
Ltsp-developer mailing list.   To un-subscribe, or change prefs, goto:
      https://lists.sourceforge.net/lists/listinfo/ltsp-developer
For additional LTSP help,   try #ltsp channel on irc.freenode.net