[33596] in Kerberos
Re: when would you not want +requires_preauth?
daemon@ATHENA.MIT.EDU (Ken Dreyer)
Tue Jul 19 15:01:29 2011
MIME-Version: 1.0
In-Reply-To: <1311100771.23877.104.camel@t410>
Date: Tue, 19 Jul 2011 13:01:24 -0600
Message-ID: <CAD3FbMUd4Vazq6Lbtt0s69bC=23sBZM5nhA3QeuifNu4UYuY4Q@mail.gmail.com>
From: Ken Dreyer <ktdreyer@ktdreyer.com>
To: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
On Tue, Jul 19, 2011 at 12:39 PM, Greg Hudson <ghudson@mit.edu> wrote:
> The best practice is to set +requires-preauth (and probably
> -allow_tgs_req) on principals with password-derived keys and leave it
> unset on principals with random keys.
I thought the "best practice" would be to set requires-preauth on
every principal? I don't want to give someone the ability to offline
attack any of my principals...
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
