0

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also what does PCI DSS say about SSO once 2FA has occured through Raduis Server.

Thanks for any suggestion or comments

3

(2FA = Two Factor Authentication, for those just tuning in)

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance.

Kerberos is an authentication mechanism most commonly used to grant access based on password credentials. As such, it doesn't provide 2FA; it provides 1FA. I have seen Kerberos used as a 1FA in CDE environments.

There are 2FA systems which incorporate Kerberos, such as RedHat's Identity Management server, but in those cases Kerberos is used for "something you know" and glued to "something you have" (Software or Hardware OTP) using LDAP and possibly RADIUS. And MIT appears to have integrated Duo OTP more directly with Kerberos, at some cost of client support.

So - Kerberos may be part of a valid 2FA solution for your CDE, but in general it only provides one factor, so additional lifting is required.

Also what does PCI DSS say about SSO once 2FA has occured through Radius Server.

The DSS does not address Single Sign-On per se, however, it does state:

Multi-factor authentication can be performed either upon authentication to the particular network or to the system component.

(DSS 3.2 section 8.3)

I'm not a QSA, but I think one could make a legitimate case that that language could be used to argue that 2FA is not required upon each system component sign-on, as long as it's used for the initial login to the CDE network. Which is to say that the DSS does not appear to prohibit SSO when it requires 2FA.

  • Hey thanks SO much for the quick reply. :) That really helps. I forgot to mention that we are looking at using Google Authenticator for the 2FA piece, then they were going to use kerberos to generate the one time token for SSO. – Scott Sep 13 '16 at 17:53
  • I think - minor distinction - what you mean is that you're going to leverage Kerberos tickets to provide SSO to resouirces in the Kerberos realm once you've fully authenticated, which includes Google Authenticator as a 2nd factor. In your language there's a confusion between tickets, which can be presented to effect SSO, and tokens. – gowenfawr Sep 13 '16 at 18:22
  • I am wondering about your understanding of 2FA. Kerberos as a protocol supports many kind of 2FA like PKINI/RFC4556 with smartcards and also OTP/RFC6560 (which in may opinion is of no use). Of course in the end you get a TGT, which is one factor. But you could boil down every auth process to one factor. Yes, Kerberos supports 2FA. And as far as MIT Kerberos is concerned. Stop promoting this DUO crap. MIT has a RADIUS interface, which can be used to connect ANY 2FA system. – cornelinux Sep 14 '16 at 19:45
  • I am wondering if the writers of PCI DSS have in mind, to require 2FA but allow an external authentication instance like DUO. – cornelinux Sep 14 '16 at 19:48
  • @cornelinux, your grasp of keywords is far better than mine - I look forward to seeing your answer to the question. – gowenfawr Sep 14 '16 at 22:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.