meta user
network profile
| bio | website | |
|---|---|---|
| location | ||
| age | ||
| visits | member for | 5 months |
| seen | Feb 6 at 18:28 | |
| stats | profile views | 1 |
|
Dec 6 |
awarded | Scholar |
|
Dec 6 |
accepted | Public web server and AD- based Kerberos authentication |
|
Dec 6 |
comment |
Public web server and AD- based Kerberos authentication Yes, KDC is not accessible to the web server at all. Thanks for confirming this. So all attacker could gain is to authenticate users coming from intranet and impersonate as those users in the service. Domain passwords of these users are not compromised. The keytab can only be used on the same server as Kerberos clients (at least IE) use reverse DNS lookup to find out for which service they request the service ticket from KDC. |
|
Dec 6 |
awarded | Student |
|
Dec 6 |
asked | Public web server and AD- based Kerberos authentication |
