[2509] in Kerberos
Re: KDC/Kadmin IP Addr Question
daemon@ATHENA.MIT.EDU (Shawn Mamros)
Wed Jan 13 13:08:26 1993
Date: 13 Jan 93 15:05:26 GMT
From: mamros@athena.lkg.dec.com (Shawn Mamros)
To: kerberos@shelby.Stanford.EDU
khirata@EMULEX.COM (Ken Hirata) writes:
>Is it dangerous to get the IP addresses for the KDC and Kadmin servers
>from a nameserver? Since no secrets are sent in the clear over the
>network, I would think that even if somebody managed to redirect your
>ticket requests, the information they get would be just as useful as
>if they just passively monitored the net. Am I wrong? Is the answer
>the same for both kerberized clients and servers? Thanks.
Spoofing a nameserver to provide a false IP address for the Kerberos
server(s) could be used for a denial of service attack on the clients,
if nothing else. Depending on what software runs on the clients, you
might also be able to do more serious damage; for example, if you have
a login program that accepts the ability to obtain a TGT as proof of your
identity (without verifying that TGT by also obtaining from the server
an authenticator that can be decoded by a key in a local srvtab file),
you could login as any user by setting up a false Kerberos server for
the realm and setting up the principal(s) appropriately so that you
know the password(s). This is why, if you do use such a login program,
and you want to prevent users from getting on without knowing the *right*
password, you need to have a local srvtab file with a key that gets used
by the program to verify any TGTs obtained.(*)
Basically, all of Kerberos works on the assumption that only two entities
know a given key: the Kerberos server and the principal to whom the key
belongs. Authentication to another entity holding their own key requires
that the server knows what that key is. Spoofing a Kerberos server gives
you a way to potentially get a (false) TGT for anyone, but you won't be able
to use it to authenticate to anyone else unless you know the key they're
holding. Also, it won't work to spoof the server, get a TGT, "un-spoof" the
server and then get an application ticket, since the TGT you have is a false
one.
(*) Note that, for Athena-style single-user stateless client workstations,
verification of the TGT locally isn't really necessary, as long as the
user's local identity on that machine doesn't really matter. Without
a real TGT, a user in an Athena environment can't obtain access to user
resources such as their home directory or their mail, since all such
user resources are provided not by the local machine, but by network
servers which use Kerberos. Of course, a denial-of-service attack could
impact such an environment fairly severely...
-Shawn Mamros
E-mail to: mamros@athena.lkg.dec.com
