Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Mac OS X Lion accepts any password when authenticating via LDAP

forums.macrumors.com

Post reply on HN
Print view View original

61–70 of 89 posts

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#61

Post by marshray »

napierzaza wrote: post #22

Why are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that aren't safe anyways?

I don't know about Macs specifically (Apple makes servers?) or why they aren't using Kerb, but LDAP is commonly used over SSL/TLS. "LDAPS" some call it.

LDAP wasn't originally designed to be an authentication protocol. If Mac clients are using it to make authentication decisions, they had better be requiring SSL/TLS on that connection (and validating the server cert perfectly, too).

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#62

Post by [deleted] »

dpcan wrote: post #51
parfe wrote: post #48

News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours. I don't see anyone threatening to switch away from Apple or demanding an immediate personal response from Steve Jobs or ranting how this lapse is unforgivable. And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug…

This is how bullying works. If the victim is small and accessible, with their reputation on the line, you can put them in their place. When DropBox broke, the community pounced. Apple can't be bullied. With DropBox I can just cancel my membership and sign-up somewhere else. I'm not going to throw out my $1000+ Mac with $1000+ in software on it out the Window, right along with my livelihood of creating software for iO…

[deleted]

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#63

Post by wtallis »

niels_olson wrote: post #50
a2tech wrote: post #23

This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.

which is possibly quite a few university macs in libraries and computer labs.

Really? Can you name even one university that uses LDAP but not Kerberos for their computer labs?

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#64

Post by a2tech »

niels_olson wrote: post #50
a2tech wrote: post #23

This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.

which is possibly quite a few university macs in libraries and computer labs.

In the Universities I've worked with, or visited, the computers in the labs (Macs anyway) have all been using Kerberos in one fashion or another-AD uses Kerberos, so does OpenDirectory (OS X directory offering).

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#65

Post by marshray »

marshray wrote: post #61
napierzaza wrote: post #22

Why are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that aren't safe anyways?

I don't know about Macs specifically (Apple makes servers?) or why they aren't using Kerb, but LDAP is commonly used over SSL/TLS. "LDAPS" some call it. LDAP wasn't originally designed to be an authentication protocol. If Mac clients are using it to make authentication decisions, they had better be requiring SSL/TLS on that connection (and validating the server cert perfectly, too).

Apparently, the forum poster says he's not using SSL/TLS with LDAP for the login authentication.

Sounds to me like impersonating an LDAP server would grant login to Macs configured thusly.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#66

Post by pluies »

Hovertruck wrote: post #54
epo wrote: post #39

Earlier quoted context omitted.

There is an option "Require password after sleep or screen saver begins" in the Security preferences, general tab. I'll bet yours is set to something other than "immediately".

This happens after I explicitly log out of my user account, though.

Is the mentioned option set to something else than "immediately"? If it allows you to log back in that certain period of time after explicitly logging out, which it shouldn't (it should only work that way after sleep or screen saver begins, from its description) it might be a bug in OS X itself. You should try testing it a bit more and submit a bug report on http://bugreport.apple.com/ if it indeed looks like a bug. :)

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#67

Post by napierzaza »

parfe wrote: post #48

News.YC community is being much kinder towards Apple than it acted towards Dropbox for identical security bugs. Dropbox even had the issue resolved in hours. I don't see anyone threatening to switch away from Apple or demanding an immediate personal response from Steve Jobs or ranting how this lapse is unforgivable. And you can't say it's because this bug only affects a small portion of Lion users as the Dropbox bug…

It's because it's only for enterprise setups that use LDAP in the particular way described here. It's not every Mac OS X user, it's not every enterprise Mac OS X setup. If they had been using AD it would have worked. So really it's not as wide spread as DropBox's issue that was for every single user.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#68

Post by Lewisham »

blinkingled wrote: post #40

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Being affected by 3 serious regressions in Lion (all filed as bugs and Apple closed them as duplicates, btw) - I get the feeling that Apple could do better at software engineering. (Alarms on iOS if you are still not convinced :) Just the fact that they release software that allows authentication without corre…

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose.

Yep, I agree. I've been very disappointed with Lion, even taking into account the common "Don't buy an x.0 Apple product", there were some terrible bugs (I was personally bitten by the inability to look up DNS servers after waking from sleep, which I can't believe was missed in testing).

Apple's software quality has been markedly going down. iTunes is a UI mess, and I used to really like it. Safari continues to lag behind the competition (no omnibar/awesome bar? Really?), iWork has stagnated. I suspect the reason is that Apple is growing, and the Eye of Jobs is focused entirely on iOS products, so the quality is being diluted in other areas.

I strongly feel like Apple's leadership is looking f, orward to the day when they can kill off the Mac completely. The line of "we'll always need something for developers to develop on" doesn't make a lot of sense. With Apple on x86, I can see a future where Xcode lives on Ubuntu/Windows.

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#69

Post by blinkingled »

Lewisham wrote: post #68
blinkingled wrote: post #40

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Being affected by 3 serious regressions in Lion (all filed as bugs and Apple closed them as duplicates, btw) - I get the feeling that Apple could do better at software engineering. (Alarms on iOS if you are still not convinced :) Just the fact that they release software that allows authentication without corre…

Tells you something about Apple's testing methodology. QA team at Apple must be playing real fast and loose. Yep, I agree. I've been very disappointed with Lion, even taking into account the common "Don't buy an x.0 Apple product", there were some terrible bugs (I was personally bitten by the inability to look up DNS servers after waking from sleep, which I can't believe was missed in testing). Apple's software quali…

>I strongly feel like Apple's leadership is looking f, orward to the day when they can kill off the Mac completely.

Yeah - it sounds unrealistic for any other company but Apple is not at all shy of ignoring and finally dumping products that don't do great for their bottom line.

Either Xcode on Windows/Linux OR Web IDE - iOS App Development may be offered as a service. You develop on the web and submit code to Apple's server farm where specialized devices compile/deploy/run it and send it to your device to test it - maximum control for Apple. But I think that's a little too sophisticated - so might be a while!

Re: Mac OS X Lion accepts any password when authenticating via LDAP

#70

Post by marshray »

matsur wrote: post #34
a2tech wrote: post #23

This is only an issue when binding to an OpenLDAP server. There may be additional issues with LDAP on Lion server, but this problem as reported is an issue with Lion clients bound to servers running OpenLDAP without Kerberos or SSL.

Your use of the word "only" here is misplaced. This is a very serious security issue that affects clients connecting to OpenLDAP.

It may also be possible for an attacker to impersonate an OpenLDAP server in order to induce (and exploit) the behavior.
Post reply on HN