[33499] in Kerberos
CLIENT_NOT_FOUND reply to kinit a security vulnerability?
daemon@ATHENA.MIT.EDU (checker)
Mon Jun 20 14:18:46 2011
From: checker <checker@d6.com>
Date: Sat, 18 Jun 2011 01:29:38 -0700 (PDT)
Message-ID: <d169751a-f0b9-498c-9b98-6ad5597eb81b@glegroupsg2000goo.googlegroups.com>
Mime-Version: 1.0
X-Complaints-To: groups-abuse@google.com
Complaints-To: groups-abuse@google.com
To: kerberos@mit.edu
Reply-To: comp.protocols.kerberos@googlegroups.com
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Hi, I'm new to using Kerberos and I'm definitely not a security expert, and I tried searching for this but it's pretty difficult since most of the hits are about people trying to get Kerberos working, so here goes...
If I do "kinit notauser" to my KDC, it replies instantly with:
> kinit: Client not found in Kerberos database while getting initial credentials
If I "kinit realuser" then it replies by asking for the password as expected.
Doesn't this allow somebody to probe the KDC to find valid user names, which seems like a vulnerability? Other programs like SSH don't give any information away on bad usernames so you can't probe for valid ones. I thought this was a security best-practice, so I was suprised to find Kerberos doesn't do this. Or, is there a setting somewhere? Or, am I missing something?
Thanks,
Chris
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
