Kerberos OTP with RADIUS for kadmin

Greg Hudson ghudson at mit.edu
Tue Aug 21 11:23:57 EDT 2018


On 08/16/2018 06:41 PM, John Devitofranceschi wrote:
> I’m thinking about securing Kerberos administrative principals (*/admin and the like) with OTP using RADIUS.
> 
> Will kadmin take kindly to that?

I believe it should be fine.  We don't test that particular combination 
as far as I know, but we do test kadmin with anonymous PKINIT.  I 
checked the code and it uses the appropriate interface to be able to 
prompt for an OTP code as well as the password.


More information about the Kerberos mailing list