[33600] in Kerberos
Re: when would you not want +requires_preauth?
daemon@ATHENA.MIT.EDU (Russ Allbery)
Tue Jul 19 21:09:35 2011
From: Russ Allbery <rra@stanford.edu>
To: Ken Dreyer <ktdreyer@ktdreyer.com>
In-Reply-To: <CAD3FbMUd4Vazq6Lbtt0s69bC=23sBZM5nhA3QeuifNu4UYuY4Q@mail.gmail.com>
(Ken Dreyer's message of "Tue, 19 Jul 2011 13:01:24 -0600")
Date: Tue, 19 Jul 2011 18:09:24 -0700
Message-ID: <874o2hpxkr.fsf@windlord.stanford.edu>
MIME-Version: 1.0
Cc: "kerberos@mit.edu" <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
Ken Dreyer <ktdreyer@ktdreyer.com> writes:
> On Tue, Jul 19, 2011 at 12:39 PM, Greg Hudson <ghudson@mit.edu> wrote:
>> The best practice is to set +requires-preauth (and probably
>> -allow_tgs_req) on principals with password-derived keys and leave it
>> unset on principals with random keys.
> I thought the "best practice" would be to set requires-preauth on
> every principal? I don't want to give someone the ability to offline
> attack any of my principals...
If you're starting from scratch with a new cell, I'd be inclined to do
this (although there can be some weird implications for cross-realm). If
you didn't start that way, getting there is really annoying due to the
existing intermingling of roles of require-preauth, and probably isn't
worth it for non-user principals.
--
Russ Allbery (rra@stanford.edu) <http://www.eyrie.org/~eagle/>
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
