On Fri, 2008-06-27 at 11:31 -0400, Jeffrey Altman wrote: > Simo Sorce wrote: > >> There are several issues here. First, DNS TXT records are known to be > >> insecure. > > > > Jeff, > > this statements is interesting, how are TXT records "insecure" ? > I will refer you to the security considerations section of the internet > draft. Note that > the insecurity is one reason that the TXT record portion of the draft > was not > added to RFC 4120 as the DNS SRV records portion was. > > http://tools.ietf.org/html/draft-ietf-krb-wg-krb-dns-locate-03
Thanks, the explanation there makes a lot of sense, but reading through the lines it probably would not affect the original poster security, because the "insecurity" of the TXT record is exploitable only in case a trusted realm is compromised (and the DNS spoofed at the same time). But it is a very interesting consideration nonetheless. > > How is local configuration data trustworthy given that to resolve names > > to IPs we still rely on DNS ? Or do you also rely on /etc/hosts for most > > of the data ? > If the host name resolves to a different IP address, the authentication > will fail. Uhmm perhaps we are thinking of two different things, once you control DNS you control both direct and reverse address resolution. > >> The safe way to add DNS TXT records back into the equation would be to > >> add the DNS TXT > >> lookup after the referrals request fails. > > > > Do we have information on which clients support referrals ? > > And are they implemented in MIT KDC (and how) ? > > > Heimdal, MIT, and Microsoft support referrals as implemented in Windows > Active Directory. > The IETF Kerberos working group is still working on an RFC for referrals. > > http://www.ietf.org/internet-drafts/draft-ietf-krb-wg-kerberos-referrals-10.txt Thanks a lot, lots of very useful info here. Simo. -- Simo Sorce * Red Hat, Inc * New York ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
