mod_auth_kerb+ apacahe+kerberos

[Russ Allbery]

"Henry B. Hotz" <hotz at jpl.nasa.gov> writes:
> On Jun 30, 2008, at 9:07 AM, krbdev-request at mit.edu wrote:

>> to answer your question: for apache auth_mod_krb SSL is recomended,
>> however not necessary. the fact is, it would work without it, but it's
>> definitely something you do not want to do. without SSL your kerberos
>> passwords will fly to the web server in cleartext (yes) and therefore
>> totally compromise your kerberos infrastructure (all your kerberized
>> services use the same useraname/password yes?)

> No, it's not remotely that bad.

> In fact your passwords don't go over that link (or any other) at all
> with Kerberos.  It's just Kerberos tickets with short (~1 day at most)
> lifetimes.  The main issue is that the ticket could be sniffed and re-
> used to let someone else access the same web server.

This is only true if you enable negotiate-auth.  The default in
mod_auth_kerb is to do basic auth and verify the password on the server,
which does have the behavior described by the previous poster.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>