Preventing an attacker to steal credential and to compromise a whole kerberized network?

[Mike Spinzer]

Hello,

I set up the MIT Kerberos in my network (mainly compounded of Ubuntu servers), and it's working fine. My concern is now to prevent that if an attacker manages to be root on one server, he could after compromise other servers. Some of the users need to have root access on several servers; By now, they connect to servers through SSH with a forwardable ticket, that they can use either to bounce on another server or to become root with ksu without entering any password (so that they never enter their password on a server that could have been compromised).
However, the problem is that if an attacker is root on one server, he can easily steal other users credentials (stored by now in files in /tmp) and connect and become root on other servers.

Does Kerberos include any solution to mitigate this risk?

Thanks a lot,

Mike.