Kerberos n00b question.

[Russ Allbery]

Grant Taylor <gtaylor at tnetconsulting.net> writes:

> I wonder if there is any possibility of users using a random key that is
> password protected.  Thus using the password unlocking the random key
> that is used to secure communications.  - I suspect that would make keys
> used for users as secure as -randkey for services, at least as far as
> brute forcing things.  Of course you would need to protect the encrypted
> key.  But that's a different issue.

If you want to go down this path, I would take a look at PKINIT, which
replaces the initial authentication request using a password-derived key
with X.509 mutual authentication.  You have to figure out a PKI strategy
to give the users certificates, but that then effectively gives you what
you describe: a password-protected random key.

I have also implemented half-assed versions of this, such as putting a
service with permissions to mint Kerberos TGTs for users behind SSH public
key authentication, so that users can use an SSH keypair to get a Kerberos
TGT.

> I /think/ that client <-> server is okay as part of SSH.  - I'm trying
> to understand if the client <-> server is okay on it's own, or if it's
> also relying on security offered by SSH.  Mainly so that I can judge how
> safe it is to use for other protocols between the client and server
> (with or without other encryption).

The client/server exchange uses GSS-API, which is fine on its own and
doesn't rely on the SSH encrypted tunnel to be secure.

> I think the biggest issue is that I need to get the keytab to the server
> in a secure manner.  I would expect that something like scp / sftp would
> suffice.

You may or may not want to think about the chain of trust for the server
(i.e., how do you know that you're scp'ing the keytab to the correct
machine).  In an ideal world, the machine is launched with some existing
credentials (like a TLS private key) that are installed on it securely,
and then you use those credentials to bootstrap other credentials it
needs, such as keytabs.

-- 
Russ Allbery (eagle at eyrie.org)              <http://www.eyrie.org/~eagle/>