6 Replies Latest reply on Oct 11, 2010 7:24 AM by David Lipsham

    NSH proxy - cached credentials a security risk ?

      Hi guys,

      I have been going through the configutation process for setting up a NSH proxy.


      I got it to work ok, but to me there seems to be a fundamental flaw in the security model of using an NSH proxy.

      You must have some saved "session credentials" for the NSH command to work, unless u want to provide then at run-time.

      Those same credentials could be be used by another console user even if the previous user has signed off the console.


      An example to explain myself a little better.


      John logs on to his workstation and fires up a BladeLogic 8 Server Automation console.

      He would like to run a custom comand like "View Disk Usage", and seeing as we are using an NSH Proxy he clicks on "Save Credential for this session".  He runs his commands as expected and then decides to log out of the console, and heads for lunch.

      He doesn't lock his screen but thinks things are secure as he has logged out of the BL console.


      Dave notices John's unlocked workstation, fires up a console ...... and uses the "cached credentials" to log on as John.

      He can do as he likes.


      Is there a better way to configure the NSH proxy?  Am I missing something?

      I like the idea of the NSH proxy as you can really tie gown what machines can access an agent through the exports file.

      ie Configure NSH proxy and just have the Application servers in the exports file.

      It seems though that the compromise to this is having to cache the credentials on the BL Console workstation.


      Any ideas or thoughts on this.