[33709] in Kerberos
Re: (mk|rd)_(priv|safe) and NAT
daemon@ATHENA.MIT.EDU (Jeffrey Altman)
Wed Aug 3 06:05:20 2011
X-Envelope-From: jaltman@secure-endpoints.com
X-MDaemon-Deliver-To: kerberos@mit.edu
Message-ID: <4E391D52.2020902@secure-endpoints.com>
Date: Wed, 03 Aug 2011 06:05:06 -0400
From: Jeffrey Altman <jaltman@secure-endpoints.com>
MIME-Version: 1.0
To: kerberos@mit.edu
In-Reply-To: <4E38FD1A.6090009@d6.com>
Reply-To: jaltman@secure-endpoints.com
Content-Type: multipart/mixed; boundary="===============0330250134=="
Errors-To: kerberos-bounces@mit.edu
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--===============0330250134==
Content-Type: multipart/signed; micalg=pgp-sha1;
protocol="application/pgp-signature";
boundary="------------enigC18F181022EFAC77C6B873FC"
This is an OpenPGP/MIME signed message (RFC 2440 and 3156)
--------------enigC18F181022EFAC77C6B873FC
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: quoted-printable
Is there a reason you are using mk|rd_priv|safe instead of gss?
On 8/3/2011 3:47 AM, Chris Hecker wrote:
>=20
> It almost looks like I can just set 1.2.3.4:5 for the address of any=20
> host behind a NAT, since at that point the code doesn't actually talk t=
o=20
> the internet. Is there a security implication for doing that, given=20
> that tickets have already moved away from containing addresses?
>=20
> Thanks,
> Chris
>=20
>=20
> On 2011/08/03 00:11, Chris Hecker wrote:
>>
>> I'm still in the process of getting my app and server up and running
>> with kerberos, so I can't test this yet, but the code for
>> mk_priv/rd_priv and mk_safe/rd_safe seems to want addresses set on the=
>> auth_context, and all the samples show various permutations of this.
>>
>> I'm doing NAT traversal/punchthrough potentially on both sides of the
>> connection, maybe even with a relay server in the middle for really ba=
d
>> cases, so there are a lot of potential addresses in play here. Which
>> addresses do I set in a NAT-heavy environment like this?
>>
>> It looks like the mk versions require a local address set, and the rd
>> versions require the remote address set (presumably to the local addre=
ss
>> set when the mk is called?). I'm going to be sending safe/priv message=
s
>> both directions...
>>
>> I'm doing full mutual authentication with subkeys in both directions t=
o
>> avoid the need for a replay cache, if that matters.
>>
>> I found a post[*] that said kerberos was moving away from addresses
>> since they're not very secure, but the current code seems to require
>> them for these functions at least.
>>
>> Thanks,
>> Chris
>>
>> * http://mailman.mit.edu/pipermail/kerberos/2007-December/012743.html
>>
>>
> ________________________________________________
> Kerberos mailing list Kerberos@mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
--------------enigC18F181022EFAC77C6B873FC
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: OpenPGP digital signature
Content-Disposition: attachment; filename="signature.asc"
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
iQEcBAEBAgAGBQJOOR1UAAoJENxm1CNJffh4s4oH/iEcUu9huD+Xps+F02tUnvVP
cdwE/IZZ9GugpRQxr9lufKJr0dRBpBZYTM1DfhMAqh7CGS+6u9jVVHcnQPHSb0vR
XUpr7KNYZBoHvQo1mm6JJJ8CAi5uvDj82NxDewlNplJ2yY11tgy2t+WRdZhMZlTE
hHkbwz75Rx6pKPx8xtI5spNiYQnVfnsOHmmE5pg6EOfBBFiGUHu63RYEKY687xcZ
dtZqPYIeuAQctmf6IAniOKluDjTDm0dRV9s+tirJGJddf3nE5Optdb/u8fbiJY5j
OOs6SUWW/N+VSHaaRDcWvoRFiAAWhJQac1M9xGe4c0HKdevzx6BsTRvgtRg1wI8=
=wYB5
-----END PGP SIGNATURE-----
--------------enigC18F181022EFAC77C6B873FC--
--===============0330250134==
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Disposition: inline
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
--===============0330250134==--
