Re: what exactly is the server secret *for*

Brian -
On Tue, 08 Oct 2002, Brian K. Jones wrote:

> Hello.
> 
> It would seem logical that the server secret be used for client access
> to the server resources.  However, in practice, this doesn't seem to be
> happening.  
> 
> The comments in current.conf say:
> # server_secret = text to get sha1'd for systemid tokens.
> #                 Must be kept secret, and site specific.
> 
> First of all, what the h*** does that word "sha1'd" mean?  Can you dumb
> that down for me?  Is that a star trek reference or something that I'm
> just not geeky enough to get or something? :-)
        The server secret is used as part of the input which is then put
thorugh a SHA1 hashing process to generate system ID's for clients.

> Second, if this is to be kept secret, why is it essentially in plain
> view of everything?  What is at risk by keeping this 'not secret'?  Even
> if someone knows the server secret, they still need the server's
> RHNS-CA-CERT, no?  Maybe I'm a little confused here.  Did I miss a doc? 
        If they know the server secret, they can simply copy the CERT
file from a client, set up a 'pirate' server, take over your IP, and do
nasty things.  The server secret tries to prevent that, so that your
clients don't get fooled into installing bad packages.

> Third, is this secret somehow used in creating the RHNS-CA-CERT?  I
> can't think of another reason you'd have to re-register clients after
> changing the secret.  
        It's used in concert with the RHNS-CA-CERT to check the validity
of a client's systemid when the client logs in.

> Also, while we're on registration, I don't remember ever seeing a place
> that kept track of who has registered with the server.  Is this logged
> somewhere along with the activity (what packages were grabbed, and the
> like)?  
        This isn't currently tracked - we need a better database for
that.  We're working on putting SQL in now, and client tracking will
come after anonymous SQL serving is stable.

-- 
Thank you,
John Berninger

Systems Administrator		[email protected]
Department of Mathematics	Box 8205, Harrelson Hall
NC State University		Raleigh, NC 27695
Phone:  (919)515-6315		Fax:	(919)515-3798

GPG Key ID: A8C1D45C
        Fingerprint: B1BB 90CB 5314 3113 CF22  66AE 822D 42A8 A8C1 D45C
--