Security Issue: How secure is sending confidential credentials via wpa_cli type interface?

[Bryan Kadzban]

Jouni Malinen wrote:
> Would you happen to have any useful examples of SDDL strings for this
> kind of use?

I don't have any, but I can come up with a few, see below.

> The format for setting SDDL string is as follows (with the silly deny
> everyone example):
> 
> ctrl_interface=SDDL=D:

OK, how about this (local admins group has permission, but nobody else):

ctrl_interface=SDDL=D:(A;;GA;;;BA)

("A" == "access allowed", "GA" == GENERIC_ALL == all permissions, and
"BA" == "builtin administrators" == the local admins.  The empty fields
are for flags and object GUIDs, none of which should be required in this
case.)

Or this (local admins and the local "power users" group have
permissions, but nobody else):

ctrl_interface=SDDL=D:(A;;GA;;;BA)(A;;GA;;;PU)

(One ACCESS_ALLOWED ACE for GENERIC_ALL for builtin administrators, and
one ACCESS_ALLOWED ACE for GENERIC_ALL for power users.)

Or lastly, this (close to wide open, but you have to be a valid user on
the machine):

ctrl_interface=SDDL=D:(A;;GA;;;AU)

(One ACCESS_ALLOWED ACE for GENERIC_ALL for the "authenticated users"
group.)

Finally, this one would allow absolutely everyone (including anonymous
users) -- this is *not* recommended, since named pipes can be attached
to from anywhere on the network (i.e. there's no "this machine only"
like there is with 127.0.0.1 sockets):

ctrl_interface=SDDL=D:(A;;GA;;;BU)(A;;GA;;;AN)

(BU == "builtin users", "AN" == "anonymous")

See also [1] for the format of ACEs, and [2] for the possible strings
that can be used for principal names.

[1]
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/ace_strings.asp
[2]
http://msdn.microsoft.com/library/default.asp?url=/library/en-us/secauthz/security/sid_strings.asp
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 258 bytes
Desc: OpenPGP digital signature
Url : http://lists.shmoo.com/pipermail/hostap/attachments/20060805/207004e3/attachment.pgp