Imagine the following scenario: A company network with "domain joined" linux clients (e.g they have a
HOST$@DOMAIN.LOCAL principal in their keytabs file + A computer entry in the DC).
Now an attacker gains access to this network with his laptop (where he obviously has root privileges), he issues a
kinit <valid_company_user> (lets assume he is in possession of the user's password and he started
rpc.gssd with the
-n parameter) and then mounts the user's nfs share (which is secured with kerberos).
Is this scenario preventable? (e.g enforce that the client is domain joined)
Initial testing suggested that there is some authentication going on (gssapi traffic between nfs-server and kdc after the client connects) but later experiments showed that this is most likely not client authentication but user verification. I've done a lot of research regarding this topic but non of the resources found could give me a definitive answer.