3

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords.

However, I have been unable to find much information about the security of this solution.

Perhaps someone could assist by explaining the security model and any inherent weaknesses?

Edit: Let me clarify that I am looking specifically at implementing GSSAPIAuthentication in openssh.

1

This is really broad question and not exact. There are two ways how to use GSSAPI for SSH logins:

  • GSSAPI Key Exchange - not implemented in openssh, but distributed as a patch (part of RHEL, Fedora, but probably also Debians)
  • GSSAPIAuthentication - part of openssh

GSSAPI Key Exchange

The plus is certainly the manageability - with GSSAPI key exchange you don't have to even care about host keys. Just register the host to domain.

For key exchange, there are used basically these methods. The first is considered possibly vulnerable, because they use 1024 b primes. They are based on respective DH key exchange methods.

  • gss-group1-sha1-*
  • gss-group14-sha1-*
  • gss-gex-sha1-*

GSSAPI AUthentication

About the GSSAPI Authentication, you use normal SSH key excahnge methods (ECDH preferably), which has to be managed somehow else (certificates?) to mitigate MitM. Then authenticate to remote host using kerberos. This communication is already encrypted so there is no different security question than authenticating to any other service.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.