42

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


32

Why would I need a RADIUS server if my clients can connect and authenticate with Active Directory? RADIUS is an older, simple authentication mechanism which was designed to allow network devices (think: routers, VPN concentrators, switches doing Network Access Control (NAC)) to authenticate users. It doesn't have any sort of complex membership ...


27

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-enter ...


16

You do not need to process the DIT file to aquire hashes from AD or AD LDS, there is some protocol access as well. Even though a regular LDAP-reads on "userpassword" Attribute (as you can do on other directory products) will always be blocked completely in AD, there is another official way to read hashes from AD or AD LDS and its officially been there since ...


13

You put in the DMZ the servers which must be accessed from the outside. Since they are reachable from the external World (which is assumed hostile), these servers are potentially subject to hijack by attackers. The DMZ is a containment area so that a subverted server does not gain immediate access to your most valuable data (which will be presumably kept in ...


12

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


10

ARP poisoning and IP spoofing are one way to do this with nothing more than a node on the network. In general, what you end up doing is impersonating the AD server during negotiation. The technical details probably aren't interesting in this context, but if you pretend to be the AD server, you can do a lot of things. One of these things might be to ...


10

All the comments and answers boiled down the RADIUS protocol to simple authentication. But RADIUS is a triple A protocol = AAA: authentication, authorization and accounting. RADIUS is a very extensable protocol. It works with key value pairs and you can define new ones on your own. Most common scenario is, that the RADIUS server returns authorization ...


8

You need to distinguish between two types of non-personal account: Generic accounts are accounts that multiple humans can login to. These are generally bad as you lose accountability. If John and Fred both have access, and a malicious event occurs, who do we blame - John or Fred? Service accounts are used by applications, not by humans. Provided these are ...


8

Ideally, the user or application accessing SQL Server should be using the set of credentials that identifies them correctly, and that has been assigned the appropriate level of access to the SQL Server and/or database(s) as needed to perform the actions they need to perform. SQL Authentication is a legacy authentication mechanism that in a properly ...


8

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


7

I believe you need to have the domain administrator credentials to join a domain (or an account which has been delegated this ability). It should not be possible for a user to just add their personal computer to a domain. You should not be giving users the ability to copy system files off their work pc to their home pc (do not give them local admin ...


7

The answer is simple: do not allow Domain Admins. Give access to specific functions to specific people who are in the job of administration. The "Domain Admin" group should be empty with alerts when a user is added to this group. In small teams, this might be a little tricky, but you can include people outside of the IT admin staff for oversight, and you ...


7

Assuming that the LDAPS server does not have security holes, exposing it to the wide Internet should be no more risky (and no less) than exposing a HTTPS Web server. With LDAPS (SSL outside, traditionally on port 636, LDAP protocol in it), the authentication requested by the server will be performed under the protection of SSL, so that's fine (provided that ...


7

Several cloud vendors require LDAP access to AD in order to authenticate users... I can name 10 off the top of my head; so it's not uncommon in a limited scope. I would say it is unwise to open up LDAP to the broad internet (no IP filter) without additional controls (VPN, authentication,etc) Since you're exposing your LDAP server to additional load, I ...


7

It depends of the honeypot you are using. If you are using a low or medium interaction honeypot that only emulates some services, than the chances are very low that the attacker can break out of the honeypot (except if he finds a bug in the honeypot itself). If you are using full interaction honeypots, like a real Windows machine, that the chances are high ...


6

You need to get the NTDS.DIT binary file out of %SystemRoot%\ntds. You can use ntdsutil to create a snapshot of the AD database so that you can copy NTDS.DIT. Then you can use something like the Windows Password Recovery tool to extract the hashes. https://technet.microsoft.com/en-us/library/cc753343.aspx https://technet.microsoft.com/en-us/library/...


6

You generally trust your internal applications that you allow to authenticate against an internal user directory. If you don't trust them, it does not make sense to allow then on premises, and allowing login. Furthermore, user enumeration is usually not considered a high impact risk. Many companies have public usernames, in the form of firstname.lastname@...


5

I would not say it is common to expose LDAP services to the internett. What business case do you have to do this? Is is much like you do not want to expose your database server to the Internett. It is usually access only via. DMZ services, while your LDAP rests on the internal network. If I do Shodan search for port:389 I get no results, compared to MySQL ...


5

In the Microsoft / Active Directory world, there are several ways by which certificate-based authentication may happen, but the short answer is: yes, a user can have several certificates. In IIS terminology, that is called "certificate mapping", with the option clientCertificateMappingAuthentication (not to be confused with ...


5

Try type "any" or "SRV" Did you query for the "any" DNS resource record (wildcard/pseudo) type? (Otherwise the default is to simple query for A records. And the records in question are in fact SRV RRs.) (Also: you said you used type "all", I don't know if there is such a thing. What any does is translate to a query for ...


5

Firstly as per @EricG most of the administration should be handled using a network administrator account, using group policies and the like. If you need access to a users logged-in session the best way to approach this is to have the user login to their machine and then hand you the keyboard. That way you never learn there password, and the user can observe ...


5

UNC Path Hardening comes from the JASBUG vulnerabilities (MS15-011 and MS15-014). Microsoft suggests implementing workarounds to the SMB MITM issues easily found in the Responder.py or related tools and techniques (e.g., CORE Impacket, Potato, Tater, SmashedPotato, et al) which include but are not limited to SMB Signing. More information available via these ...


5

I would characterise the situation (as stated) as: "The dam has burst and the city is flooded with 3 feet of water. Where can I buy mops?" You appear to have a much, much bigger problem on your hands than limiting the access of your admins to certain days. Limit the people who have admins rights to those who have been trained in your company's policies and ...


4

The biggest reason I can think of as to why they might want to use RC4 is because of compatibility with Jira (and or this custom auth backend that we cannot vet.) AES128 support was introduced along with Server 2008 and Vista, and AES256 with 2008 R2 and Win7. However, the KDC will automatically negotiate down to (for instance) RC4 when talking to, say, a ...


4

1- Is it possible to force actions like "reset password" to require the approval of more than a single administrator? Its good idea to separate the creation of users from password reset, you could assign user creation to an admin, and leave the password reset to Help Desk for example. In active directory you don't need domain admin to create users, you can ...


4

The only way to have a secure authentication system for a company that can still function while the corporate network is unavailable, is to not use the corporate network. Consider hosting this service in the cloud, or having a cloud based hot-backup. Having a copy of the authentication database on each device is vulnerability, and a clear violation of ...


4

Security issues don't come from the presence of "anonymous" user accounts, but from user actually using them to perform actions (because then the user are not longer accountable: logs will tell you "Administrator did it" and not "Bob did it"). Logging as some account simply means knowing the associated password and using it (however, accounts can be locked ...


4

RODCs really are all about physcial security, and not at all about network security. They're an upgrade of ye olde Backup Domain Controllers, that had a nasty tendency to get stolen (and the database along with it). RODCs come with a unique kbtgt account, so they can't intrude on Active Directory, or decipher kerberos tickets on behalf of WDCs, in case of a ...


4

Using Active Directory for SQL Server has a number of advantages, which makes it the recommended approach. SQL DBAs will often want to have the database in Windows Integrated Authentication (WIA) mode only (instead of "Mixed mode" where SQL Authentication is also support) because of it: When using AD, account authentication is centralized. You have one ...


Only top voted, non community-wiki answers of a minimum length are eligible