[35726] in Kerberos
Re: Query - How to determine the KDC
daemon@ATHENA.MIT.EDU (Rick van Rein)
Fri Jan 31 10:34:20 2014
Mime-Version: 1.0 (Mac OS X Mail 7.1 \(1827\))
From: Rick van Rein <rick@openfortress.nl>
In-Reply-To: <5C4F32DD-8C7D-4D20-9B93-E150AA5A6676@openfortress.nl>
Date: Fri, 31 Jan 2014 16:34:04 +0100
Message-Id: <46ED823C-501E-4944-BC25-7DEEC6A8A517@openfortress.nl>
To: Priya Balakrishnan <priya9907@gmail.com>
Cc: kerberos@mit.edu
Content-Type: text/plain; charset="windows-1252"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hello,
>> Hope this isn't a silly question. Is there a command/tool that tells us
>> which is the KDC for a particular realm ?
Silly me, I only gave half an answer.
Once you have established that the realm of a DNS zone is the right one, you can rely on the KDC mentioned in SRV records with subnames _kerberos._udp and/or _kerberos._tcp — this has less requirement for DNSSEC because the KDC is less susceptible to MITM attacks, but that is only valid if you can have 100% reliance on your users to work with 128-bit (or better) entropy in their passwords...
-Rick
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
