[2162] in Kerberos
Re: New User Accounts
daemon@ATHENA.MIT.EDU (Jeffrey I. Schiller)
Thu Sep 3 15:27:07 1992
Date: Thu, 3 Sep 1992 19:05:45 GMT
From: jis@mit.edu (Jeffrey I. Schiller)
To: kerberos@shelby.Stanford.EDU
In article <199209021630.AA04209@magrathea.ksr.com> dean@ksr.com writes:
I think one can use a service key to get a ticket and session key for
a mutually authenticated private session with a "kerberos-SecurID"
server, which is on the same machine as the kerberos server.
You are assuming that each workstation has an /etc/srvtab file. In our
environment that simply isn't true. Furthermore *if* each workstation has
a /etc/srvtab file, it must be get confidential from the users of the
workstation (unless the workstation is only used by one person, i.e.,
it is in their office).
The SecurID code would be sent to this server, and if authenticated
by the SecurID software, the kerberos passwd would be changed to the
securID code, and then changed to something random 30 seconds later.
I would recommend changing this procedure do instead return the TGT
(and associated session key) via the already encrypted channel that
was used to supply the SecurID code (assuming that the code proved
valid). Leave the person's entry in the kerberos database with a random
value (or leave the DES key NULL). This is more secure then:
The client would get initial kerberos tickets as usual using the
SecurID code as the password.
Many of the SecurID cards that I have seen only have a 5 or 6 digit
value on them. If I watch you login, given your proposal, I can obtain
your TGT and session key encrypted in a value which I *know* is a 5
or 6 digit purely numeric string. I can then do an offline search of
all valid 5 and 6 digit values (and with modern computers and fast DES
software, this can be done quite quickly, easily within the session
lifetime).
-Jeff
