Questions tagged [gssapi]

The Generic Security Service Application Program Interface is an application programming interface for programs to access security services. The GSSAPI is an IETF standard that addresses the problem of many similar but incompatible security services in use today.

Filter by
Sorted by
Tagged with
0
votes
1answer
118 views

Is traffic subsequent to a SASL/GSSAPI bind encrypted?

When making a SASL/GSSAPI bind to an LDAP server over port 389 (ldap:///), after the authentication is finished is the resulting LDAP traffic encrypted? If so, is there a document or RFC that ...
1
vote
1answer
782 views

Want to verify confidentiality of GSS-SPNEGO SASL mechanism (LDAP)

I've been doing some research on LDAP supportedSASLMechanisms and am trying to assert whether or not there is confidentiality protection in play when using GSS-SPNEGO. My initial assessment is that ...
0
votes
0answers
423 views

Can I disable GSSAPI Proxy Daemon without consequences? (Linux desktop)

I'm running Arch Linux on a desktop. I am not using Kerberos or Microsoft NTLM. sshd_config has this option set: GSSAPIAuthentication no I am not sure why the gssproxy.service is active or why it ...
1
vote
1answer
84 views

Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
2
votes
1answer
280 views
33
votes
4answers
2k views

What attacks, if any, are possible against Security Support Provider Interface (SSPI)?

I've been looking at SSPI recently, as it is used for authentication in a variety of Microsoft products. From the looks of it, it's based on GSSAPI and provides an abstraction for wrapping various ...
3
votes
1answer
2k views

How secure is GSSAPI single-signon over SSH?

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords. However, I have been unable to find ...
6
votes
1answer
2k views

Relative merits of Heimdal and MIT Kerberos?

What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports ...