Quoting "Amir Saad" :

> actually, i was thinking of two separate machines one for the KDC
> and the other for the OpenLDAP, i read an article that suggests the
> separation to avoid to secure the KDC.

To avoid securing the KDC!?!? Sorry, but whoever wrote that must be
drunk (or know something I don't .

The KDC is the single most important part of you whole network! If that
is cracked (i.e. someone gains root access on it), then you're screwed!
It have access to EVERYTHING basically.


In my opinion, the KDC is the one you should 'guard with your life'.
Everything else can be fixed if it get's cracked, but if the KDC is
cracked, EVERY SINGLE USER must change password/passphrase and the machine
MUST (for safety) be totaly reinstalled.


The LDAP server is nowhere NEAR as important. If they crack that,
all they'll get is ... what, nothing basically?

If _I_ had my LDAP server on a totaly separate machine, and that
was cracked, all the cracker would get is information on what
email addresses the user(s) have, what shell, uid/gid and home/mail
directory they have. True, there's somewhat censetive information
there - their telephone number and address (not all users have that
info though).
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

On Sun, Jan 08, 2006 at 01:04:08PM +0100, Turbo Fredriksson wrote:
> The LDAP server is nowhere NEAR as important. If they crack that,
> all they'll get is ... what, nothing basically?

Depends on who's relying on the LDAP server and for what.

If important systems are using LDAP for user information like, say, UID,
group memberships, and so on, well, then your LDAP server is practically
as important as your KDC (losing a KDC would still be worse, primarily
because re-keying an entire realm is painful).

Nico
--
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

Quoting Nicolas Williams :

> On Sun, Jan 08, 2006 at 01:04:08PM +0100, Turbo Fredriksson wrote:
>> The LDAP server is nowhere NEAR as important. If they crack that,
>> all they'll get is ... what, nothing basically?
>
> Depends on who's relying on the LDAP server and for what.
>
> If important systems are using LDAP for user information like, say, UID,
> group memberships, and so on, well, then your LDAP server is practically
> as important as your KDC (losing a KDC would still be worse, primarily
> because re-keying an entire realm is painful).

Exactly, that was what I was assuming. _I_ use it with my mail system
_as well_, but not everyone/that many (?) use it that way. So _my_ LDAP server is
'almost' more important than the KDC. I don't have that many users (<50), and
I know them in person, so recreating a KDC wouldn't be THAT much job for me.
But recreating the LDAP database with all information would be 'almost impossible'.


But if the LDAP server is 'only' used for authorization (uid/gid/home etc);
which most users use it as when using Kerberos (?) then it's _just slightly_
less important than the KDC..
In such a case, recreating the LDAP server can be scripted but recreating
a KDC would be a SERIOUS pain.


So as I see it, LDAP and Kerberos (should) have the same weight regarding
security...
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos

Turbo Fredriksson wrote:

> So as I see it, LDAP and Kerberos (should) have the same weight regarding
> security...

Here is how I see it.

* losing the LDAP contents to an attacker is a royal pain. if the loss
is read-only, then you have privacy issues to deal with but the rest
of your network infrastructure is still in tact.

if the loss is read-write, then the attacker is capable of modifying
the authorization associated with any authenticated ID. However,
once you close the hole and restore the LDAP contents to a previous
state much of those authorization escalations are removed. You still
have the problem of figuring out what was done with the authorization
enhancements.

* losing the KDC on the other hand is worse. whether read-only or
read-write the attacker no has all of the key material for your
realm. The attacker is now capable of accessing your LDAP service
and making whatever authorization changes s/he wishes. However,
now you need to contact all users and re-key everything in the
realm.

While losing LDAP is bad, the KDC is much much worse. The purpose of
running the KDC on a machine that has no services on it other than the
KDC is to reduce the attack footprint. You want the only reason for a
KDC machine to be compromised to be due to a coding failure in the KDC
programming.

The LDAP directory has similar security concerns as the KDC. Hence, it
can be treated the same way. The machine running LDAP should only be
running LDAP. You do not want a root hack against LDAP to allow the
KDC to be compromised. However, you also do not want a root hack
against any other daemon with open network ports to result in LDAP
being compromised.

Jeffrey Altman