Hi, What would be the implications if my KDC was compromised and an attacker got a hold of the KDB or in my case the LDAP directory storing principal information?
As far as I have been able to tell this attacker can now authenticate as any of my users. I know the passwords are hashed in the directory but it is this hash that is the shared private key between the kdc and the client correct? So an attacker can use this hash to do any pre-auth that is required and authenticate to my KDC. Am I missing something or is it the case that if my KDC was compromised I am in big trouble? If I am using pkinit with certs I believe this problem can be eliminated but using certs is not always an option. Thanks, -- Bram Cymet Software Developer Canadian Bank Note Co. Ltd. Cell: 613-608-9752 ________________________________________________ Kerberos mailing list [email protected] https://mailman.mit.edu/mailman/listinfo/kerberos
