Why can't we protect the password file so that only the system can read it?

Question

Can't we design an OS in such a way that it doesn't allow anyone (not even root) to read the passwords file? Then there will be no need for encrypting the passwords. Why can't we hard-code a computer to hide it's password file?

I was reading "Cuckoo's egg" by Clifford Stoll. On page 32, I didn't understand why encrypting passwords is necessary - why can't we program the computer so that it hides the password file from all users?

Here is the excerpt:

When your computer has fifty or a hundred users, you might just store each person's password in a file. When the user tries to log on, ask for her password and compare that to what's in your file. In a friendly environment, no problem. But how do you keep someone from sneaking a peek at that password file? Well, protect the password file so that only the system can read it. Even if you protect the password file, every now and then all the files will be copied onto backup tapes. Even a novice programmer could read those tapes on another computer and list the contents of the password file. File protection alone isn't enough. In 1975, Bob Morris and Fred Grampp of Bell Laboratories developed a way to protect passwords, even when files weren't secure. They would rely on encryption, rather than file protection.

Answer 1

Preventing root from accessing the password file isn't really practical. By definition, the root user has access to and can modify everything on the system. Trying to limit this access just won't work.

As others have already said, there are several circumstances when the root user would need to access the password file for legitimate reasons. For example they might want to backup the entire system or modify the file for system administration purposes.

Apart from that, it would be next to impossible to implement these restrictions effectively. For example, if an attacker with root privileges really wants the password file, what's to prevent him from simply modifying/patching the system to remove your restrictions? Then again, the login/authentication program still needs to access the file so you have to provide it with permissions to read the password file. The root user can simply su to whatever user the login/authentication program runs under and then access the file. And even if you somehow find a way around this, how do you deter someone with unrestricted physical access to the system?

That said, current systems do try to ensure that only those who need access are given access. Password encryption, or rather hashing, ensures that even if a malicious or unauthorized entity does get their hands on the password file, they don't get the passwords. True, dictionary or brute-force attacks may be used to recover some passwords, but only the ones that are weak. Sufficiently complex passwords cannot be recovered in any reasonable amount of time

Answer 2

I'm stealing from @MechMK1 but: what if you want to backup the file? What if you want to remove a password from the file? What if you want to add a password to the file? What if your service uses a number of servers and they all need the data?

If the data is needed by your service then the data must be accessible. It's as simple as that. You certainly can and should restrict access to it, but as long as someone has access then there is risk. After all, a faulty system may be tricked into revealing the data contents (AKA an SQLi attack, among others)

So to the extent that you ask, "Why don't systems restrict data access only to those who need it" the answer is "This is how things should be built, and often are". However, for the specific question "why don't we stop even root from reading the data" the answer is that such an idea isn't practical, doesn't make sense in all situations, and still wouldn't stop many breaches.

Answer 3

There is no reason why you can't design an OS this way.

The reason why it is not done is, that it requires a new system approach. For example: if you use a Linux or Linux derivate, there is always the powerful root user that can read any file. So, you probably do not want a Unix/Linux derivate. Windows has a different approach; you can limit the Administrator, but always System is able to read the files.

But if you really want to, you can. The security design of such an OS would be quite a challenge though. Think also about hardware requirements; I'm not sure that a normal standard-class computer would be usable for this OS.

You could use a TPM chip-like solution for this that allows only set password and verify password (and perhaps delete password)

You can also externalize the passwords from the system, using for example an LDAP or Radius. Granted, your passwords on the LDAP system are readable by the root user on that system, but on all other systems that use the radius server, you can't read the password file.

Answer 4

why can't we program the computer so that it hides the password file from all users?

The system is also a "user", most of the time.

That is, most systems maintain a distinction between "kernel" space (the core of the operating system), and "user land" where most programs run. Design reasons encourage the kernel to be as small as possible, so quite a lot of what you might thing of as the operating system in fact runs in "user land". In order to do that it must have a user ID. On UNIX this is "root", Windows systems have LOCALSYSTEM and some other user IDs for this.

It is in fact not impossible to design systems where secure data is hidden from all users and userspace as a whole. It is even possible to design systems where data is hidden from the operating system, which is what the Apple Secure Enclave does. However, as a result, the amount of data that can be kept there is small and it's out of reach of backup tools.

Answer 5

It's entirely possible to design your OS such that "legitimate users" can't get to any particular file, but always consider your threat model: If you don't want someone accessing your data, you need to think about all the ways someone might try to access it, not just what "legitimate users" might do. And there's no shortage of nice side-channel attacks when your data is unencrypted, ranging from the clever and difficult to the trivially easy; are you really going to bet your system security on a Rowhammer or Meltdown attack not being discovered and used against you?

As the old saying goes, "He who has con has root" — meaning that if I have physical access to the device ("con" or "console access"), I have full access to the device ("root"). All the software in the world can't prevent me from just opening the machine, unplugging the hard drive, and reading the bits off it directly — and when those bits are unencrypted, you make my attack that much easier.

So encrypting the password file prevents many more attacks than just hiding it does, even if it's hidden at the OS level, even if it's hidden from everyone at the OS level. Hiding the file is a form of security through obscurity: You're hoping nobody will find another way to access it — no back doors, no bugs in your OS code, no secret ways in, no hardware workarounds. Whereas encryption is presumed security, or security by the open-design principle: Even when an attacker has full access to the data, that access still shouldn't help them get in.