[2235] in Kerberos
Re: Ticket Forwarding
daemon@ATHENA.MIT.EDU (dean@ksr.com)
Wed Sep 30 15:57:30 1992
Date: Wed, 30 Sep 1992 15:12:11 -0400
From: dean@ksr.com
To: ramus@nersc.gov (Joe Ramus)
Cc: kerberos@Athena.MIT.EDU
I am considering an extension in which a client could request a
ticket for the remote host to which the user wants to pass the
ticket.
The kerberos server would send back a tgt for that host (say for
principal user.tkp). Kerberized ticket passing rlogin authenticates
itself as usual and would pass this ticket and session key (encrypted
in the session key for the rcmd.remotehost) to the remote rlogind.
The rlogind then decrypts the ticket and creates a ticket file using
the session key and ticket just passed.
Services that use lib acl (or just look at the user and instance of
the ticket) for authorization would be able to discriminate "real"
tickets from passed tickets by looking at the instance.
Of course, these passed tickets and keys could be stolen if the
/etc/srvtab on the remote host has been compromised. But if this is
the case, then any tickets aquired on that host can also be stolen
from the users ticket file.
Turning off checking of the host address permits stolen tickets to be
used from anywhere. Tickets can still be stolen from the ticket
file, but they can only be used from that machine.
While my scheme presents the possiblity of using a stolen ticket to
get a ticket passing ticket for another machine, it can control the
extent of the damage by being able to specify whether passed tickets
can be trusted. It does not change the faked rlogin threat, but it
does make the use of kerberized network services much more
convenient, which hopefully improves the overall security of the
network.
Dean Anderson
KSR Computing Facilities
Kendall Square Research
