I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
(2FA = Two Factor Authentication, for those just tuning in)
I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance.
Kerberos is an authentication mechanism most commonly used to grant access based on password credentials. As such, it doesn't provide 2FA; it provides 1FA. I have seen Kerberos used as a 1FA in CDE environments.
There are 2FA systems which incorporate Kerberos, such as RedHat's Identity Management server, but in those cases Kerberos is used for "something you know" and glued to "something you have" (Software or Hardware OTP) using LDAP and possibly RADIUS. And MIT appears to have integrated Duo OTP more directly with Kerberos, at some cost of client support.
So - Kerberos may be part of a valid 2FA solution for your CDE, but in general it only provides one factor, so additional lifting is required.
Also what does PCI DSS say about SSO once 2FA has occured through Radius Server.
The DSS does not address Single Sign-On per se, however, it does state:
Multi-factor authentication can be performed either upon authentication to the particular network or to the system component.
(DSS 3.2 section 8.3)
I'm not a QSA, but I think one could make a legitimate case that that language could be used to argue that 2FA is not required upon each system component sign-on, as long as it's used for the initial login to the CDE network. Which is to say that the DSS does not appear to prohibit SSO when it requires 2FA.
SSO is a moot point, for example are you concerned that a single computer allows you to run different programs without authenticating each time. Your enterprise computer environment is a single system which is required to only allow access to Authenticated and Authorised users using 2FA.
In short, Kerberos is a protocol that supports single and multifactor authentication. You can implement a policy on your Key Distribution Center (KDC) to allow one, two or multifactor authentication.
Microsoft implemented a Kerberos based authentication service, and as is their way they supported some of the Kerberos protocol's capabilities, but not all. Your ability to implement policy is dictated by your choice of implementation and the policies available on your choice of KDC.
For example, using kerberos you can require that some services require 2 factor auth and can only be accessed using an initial ticket. ie forcing more frequent proof of identity for high value systems.
However, rather than trusting me go to the source. The protocol definition is not complex: https://tools.ietf.org/html/rfc4120
The following extract from another Kerberos RFC is enlightening. https://tools.ietf.org/html/rfc8129
Kerberos [RFC4120] allows secure interaction among users and services over a network. It supports a variety of authentication mechanisms using its pre-authentication framework [RFC6113]. The Kerberos authentication service has been architected to support password-based authentication as well as multi-factor authentication using one-time password devices, public-key cryptography, and other pre-authentication schemes. Implementations that offer pre-authentication mechanisms supporting significantly different strengths of client authentication may choose to keep track of the strength of the authentication that was used, for use as an input into policy decisions.