New answers tagged

6

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


1

JWT is a reasonable way to do this, as is OpenID or OAuth (With OAuth, what you are doing is creating a provider that will verify the userid). Try to use standard libraries as much as possible - it is really easy to get Tokens wrong (enabling replay attacks and similar). As well, all communications should be encrypted (TLS).


0

The primary benefit of Kerberos is to enable account change and password change to synchronize immediately. I have solutions on hand for centralized administration of distributed accounts, and client-side password agents that respond to 99% of password prompts after login, but all of them assume that user changes password is rare and that we can wait until ...


33

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


11

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


26

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-...



Top 50 recent answers are included