[7783] in Kerberos
Re: Mundane kerberos question: srvtab management
daemon@ATHENA.MIT.EDU (Gary Gaskell)
Thu Aug 15 18:10:47 1996
To: kerberos@MIT.EDU
Date: 15 Aug 1996 08:16:30 GMT
From: gaga@celsius.oz.au (Gary Gaskell)
Ken Hornstein (kenh@cmf.nrl.navy.mil) wrote:
: Now that we are increasing the number of hosts that are in our Kerberos
: realm, one thought comes to mind: the current method for managing srvtabs
: really bites.
Agreed. And to my thinking it is the key management that really adds
the overhead to IT security, and therefore a source of operational
cost, which tends to scare people away from deploying good security
when they should. But as this is a techno group, I won't ramble on.
: Specifically, the thought of doing "ark host/foo", "xst foo host", etc etc,
: a billion times is giving me screaming nightmares.
Yes, but the assumption is that these "master" keys for the services
are long lived (at least their life should be according to a
security policy).
: I am wondering what larger sites do w.r.t. srvtab management. Are there
: any custom scripts that people use? Do people actually change the keys
: in the srvtabs, or do they leave them at the initial value?
Well, I'm sure that some OSF folks are listening. The DCE enhancements
to Kerberos v5 add some tools for the updateing of server keys. I
don't have any DCE documentation at this office, so don't read this
as gospel. But DCE provides some assistence. Based on the server
key that is already available, the key may be updated. Of course
if the key is compromised, any future keys will also be compromised,
as the former key is used to secure the transmission of the new key.
Hopefully an OSF person will respond with the definitive answer,
otherwise I'm sure that Doug Engert would have been experimenting
with this.
Cheers,
Gary Gaskell
: And as a site note, how many people _really_ use a floppy/tape drive/whatever
: to send the srvtab to various machines, and how many people just ftp it
: over in the clear? I know that the stuff in the srvtabs should never go
: in the clear, but since you only do it once ...
: --Ken
--
regards,
Gary Gaskell
Security Software Engineer
CelsiusTech Australia
