Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses (Form- based login/password). All I want is to get the domain username of the incoming user if they are coming from corporate network. I'm using keytab file on the webserver created with ktpass. Webserver is in DMZ and isolated from intranet. The Kerberos implementation in question is Active Directory.

  • Is Kerberos suitable for public internet webserver authentication in this kind of setup?
  • Are there some specific security considerations related to a setup like this?
  • What are the necessary steps if the keytab file gets compromised?
share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

I don't see any immediate weaknesses. Kerberos is going to look for the user to supply an access token generated by the Kerberos server which should only be available on your private network. The web server shouldn't know how to generate an access token that would allow access to the private network so all that could be done by compromising the service shared key of the web server would be to allow access to the webserver (which presumably the attacker already has access if they've compromised your service secret key.)

In fact, I don't believe the web server should even need access to the Kerberos server since it only needs to be able to verify a TGT which only requires knowledge of the service secret key. The client that is logged in to the private network should be the only one with a connection to both worlds.

share|improve this answer
    
Yes, KDC is not accessible to the web server at all. Thanks for confirming this. So all attacker could gain is to authenticate users coming from intranet and impersonate as those users in the service. Domain passwords of these users are not compromised. The keytab can only be used on the same server as Kerberos clients (at least IE) use reverse DNS lookup to find out for which service they request the service ticket from KDC. –  StrangeLoop Dec 6 '12 at 15:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.