On Tue, 23 Feb 2010, Ken Raeburn wrote: > From: Ken Raeburn <[email protected]> > To: Greg Hudson <[email protected]> > Cc: "[email protected]" <[email protected]> > Date: Tue, 23 Feb 2010 07:17:17 > Subject: Re: bind KDC to single interface? > > On Feb 22, 2010, at 18:32, Greg Hudson wrote: > > On Mon, 2010-02-22 at 16:56 -0500, Abe Singer wrote: > >> Am I missing something in the documentation, or is there no way to tell > >> krb5kdc to bind to a single network interface (as oppposed to binding to > >> all of them)? > > > > My reading of the code is that the KDC listener sockets are always bound > > to INADDR_ANY (or the IPv6 equivalent). > > Sort of... the KDC needs to be able to return a response from the > same (KDC-side) address that the client used, so it either needs > something like IP(V6)_PKTINFO support, in which case it can use > IN(6)ADDR_ANY, or it needs to bind a socket on each local address. > While I've occasionally heard queries about whether it's possible > to bind to one address only, and it would probably be good to > offer that someday, I've never heard anyone indicate why accepting > Kerberos traffic on the other addresses is a problem.... Perhaps > if you want to run a KDC for a different realm on a different > address on the same machine, but you can serve up multiple realms > from one KDC process. Or maybe they're running the KDC on a > machine accessible from both internal and external networks, and > have a security policy in place that prohibits the latter because > of the offline-password-attack risk?
This is where your firewalling software (iptables on Linux, pf on OpenBSD etc) comes in. Use it to make sure that only Kerberos connections on the desired interface are allowed and all others are denied. I'd also be strongly tempted to make pre-authentication the default on all principals if offline-password-attacks are a worry. -- Dennis Davis, BUCS, University of Bath, Bath, BA2 7AY, UK [email protected] Phone: +44 1225 386101 ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
