8 reputation
2
bio website
location
age
visits member for 1 year, 4 months
seen Feb 6 '13 at 18:28

Dec
6
awarded  Scholar
Dec
6
accepted Public web server and AD- based Kerberos authentication
Dec
6
comment Public web server and AD- based Kerberos authentication
Yes, KDC is not accessible to the web server at all. Thanks for confirming this. So all attacker could gain is to authenticate users coming from intranet and impersonate as those users in the service. Domain passwords of these users are not compromised. The keytab can only be used on the same server as Kerberos clients (at least IE) use reverse DNS lookup to find out for which service they request the service ticket from KDC.
Dec
6
awarded  Student
Dec
6
asked Public web server and AD- based Kerberos authentication