AFP authentication a bit too forgiving?

Question

Having been reasonably satisfied with the performance of Leopard on my 24" iMac, I decided it was finally time to upgrade the rest of our office machines as well. It was only after I bought a recent Mini that I realized file sharing in Leopard features a new behavior that I find less than acceptable.
This is the problem I discovered: when I use AFP on one Leopard machine to access a shared folder on a remote Leopard machine, the login information persists even after I unmount the shared folder. Using the same local machine I can connect to the remote machine again and again without ever having to re-enter a password. This came as a bit of a surprise, since I was used to the Tiger way of doing things.
http://www.radiotope.com/content/more-about-os-x-105-leopard-kerberos
After a modicum of googling I came across the above blog entry, which explained this behavior to me. It appears that I've been kerberized, and this persistence of login information is in fact intended as a convenience. And there I was, thinking it was a *big ol' security hole*. Silly me!
I don't think I can be blamed for my misapprehension. I can think of a number of ways this setup can be exploited for all sorts of nastiness. Let's take the first one that comes to mind:
I admin several Macs for our small business, and I'd rather not clog our struggling DSL line by using Software Update to download updates individually for each machine. So I log into the admin account on my iMac, manually download all the updates we need, and file them in an appropriate folder. Then I walk over to my wife's Mini (assuming I can find a few minutes when she's not using it), log into my admin account on that machine, use AFP to connect to the admin account on my iMac, copy over the download files, and unmount the folder. So far so good; were this Tiger, it would be the end of the story.
But in Leopard, we're just getting started.
As I've already explained, if I try to connect to the iMac again, I'm allowed to do so without typing in a password. This is a bit surprising, but I can see where some might find it convenient.
I find I can also log out of the admin account on the Mini, log back in, and still connect to the iMac without typing in a password. Okay, we've gone from "surprising" to "unsettling."
But that's nothing. I can also log out of the admin account on the Mini, log into my wife's normal user account, and still connect to the iMac without typing a password! ... Which means that if I log out of the admin account and walk away from the Mini, my wife will be able to log into her account +and gain instant, unrestricted access to any file in the admin account on my iMac.+
Hmmm, I've just gone all the way from "unsettling" to "major heebie-jeebies."
This probably isn't much of a problem in a small family business like ours. My wife knows there are good reasons why I don't want her messing around with the admin accounts on our computers (not least of which is the danger of extended computer downtime), and I trust her to keep her mitts off them. But I still keep the admin account passwords to myself because I don't want her accidentally screwing something up. Leopard has given her a way around this failsafe: it's made it possible for her to unintentionally mess up the admin account on my computer!
In a large company, it could be a much bigger problem, made all the worse because the user gets no warning that the login info will persist after he logs out. Rewrite the above scenario, but replace me with a harried system admin who's new to Leopard and isn't aware of this "convenience," and in my wife's place imagine an unscrupulous employee who suddenly finds he has access to all the files in the admin's computer. What fun he (or she) could have!
This has gotten quite lengthy, but I don't think it makes sense to be word-stingy when a big stinkin' security hole is apparently being passed off as a convenience. I hope I've managed to get my point across.
That being said, I'd like to ask a question:
Is there some way to turn this functionality off so that users will be required to log in every time they try to access files via AFP? I'd rather do things the old way, if possible. (I know it's possible to use the Kerberos app to burn the ticket, as the blog author suggested. But there's always the chance that I'll forget; and even if I don't, it's a pain in the posterior.)
Also, a suggestion:
Wouldn't it be a good idea to rethink this functionality? It seems to me that at the very least, Leopard should display a warning anytime someone tries to connect to a remote machine via AFP:
*+Warning! For the next ten hours, anyone who uses this machine will have unrestricted access to the account you're about to log into. Are you sure you really want to go through with this?+*
But such a warning would beg the question: Why does this function even exist? Perhaps it would be better if the functionality were turned OFF by default...

Answer 1

Thanks for responding, Scott.
Yes, what you describe is exactly what happened. I wouldn't have written what I did without trying it first.
That said, I tried it again after reading your post, and it isn't happening now. In the meantime I've rebooted both of the computers in question and tinkered with a few settings, so it may be that the remote Mac was in a strange state that I've somehow jarred it out of. Or maybe I was just seeing things. In either case, I appreciate your taking the time to clarify the issue, and I'll allow myself to breathe a tentative sigh of relief -- on the assumption it'll keep working the way it is now.
On a more theoretical level ...
Although I understand that connection credentials are intended to persist, I'm not entirely convinced that there's nothing wrong with this. The blog I linked in my original post cites an example of how this arrangement can lead a user to inadvertently grant another user access to files on a remote machine.
Let's say my wife needs a file that I know I have in my admin account on my iMac. Rather than walk all the way over to my desk and put the file in her dropbox, I get her to scoot over, log into the iMac remotely, and drag the file onto her desktop. Then I unmount the iMac and let her get back to work. Presto! I've just given her access to my admin account (and indeed the whole iMac) for 10 hours.
I know, I know, this is really an example of bad computing practice. However, it's the sort of thing folks do every day without thinking about it. Still, we can say this in Leopard's defense: it's up to the user to know how the system works, and to avoid doing things that lead to undesired results.
What makes it a problem is the fact that Leopard is doing something, by default, that its predecessors did not do. And it does so without alerting the user to the fact that things are being done differently. Someone used to the pre-Leopard way of doing things is all too likely to disconnect from a remote computer and walk away, thinking that the remote account is still password protected.
All this makes it possible for a new Leopard user to give another user access to sensitive or valuable data +and remain completely unaware that he has done so.+ Even if that is not as bad as the "second account" scenario I described in my original post, it still strikes me as a bit of a security risk.
I'd be happier if credential persistence were turned off by default. Or if there's a way to turn it off, I'd sure like to know about it.