Groups | Search | Server Info | Login | Register

Groups > comp.protocols.kerberos > #5358

Re: Why do "strict acceptor checking"?

Show key headers only | View raw

On Tue, 2024-10-08 at 09:42 -0400, Ken Hornstein via Kerberos wrote:
> > > However, this has made me wonder: why do this at all?  What is the
> > > possible security gain here?  It's not the default in the code; you have
> > > to explicitly write code to enable this behavior.  But I can't really
> > > think of a case where NOT having strict acceptor checking is a security
> > > problem; I could maybe squint and envision some kind of weird hosted
> > > server setup where it might matter, but I'm not sure that is ever done
> > > in the real world.  I will admit it is entirely possible I am missing
> > > something; if I am, I'd sure like to understand what I am missing.
> > 
> > I have always operated under the theory that one should make sure that
> > the keytab accepts exactly the set of principals that are required.
> > This is something that is under the ultimate control of the system
> > administrator.  When an application turns on strict acceptor checking,
> > they remove this configrability from the system administrator which I
> > think makes the system much less flexible.
> 
> I'm completely with you, but clearly plenty of application writers do not
> agree with this sentiment!  So I'm wondering what I am missing.

There *are* weird cases where the keytab needs to contain multiple keys
for different principals, but you want to use only one of them for
*accepting* connections.

These days you can easily have separate keytabs for "client" vs
"server" keys and programmatically specify which keytab you want via
gss_acquire_cred_from(), but it hasn't always been like that. In the
past in some cases your only option was to use a fixed specific file on
the filesystem not even env vars...

Granted I think 99% of the time it is the other way around, so it would
be nice if we could rewind to the past and make strict acceptor default
to false, but there have been "reasons" for this behavior, and changing
the default now would risk opening up unsuspecting admins to unexpected
failures.

Simo.

-- 
Simo Sorce
Distinguished Engineer
RHEL Crypto Team
Red Hat, Inc

Back to comp.protocols.kerberos | Previous | Next | Find similar

Thread

Re: Why do "strict acceptor checking"? Simo Sorce <simo@redhat.com> - 2024-10-08 10:04 -0400

csiph-web