[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: Mechglue



On Sun, 2005-10-23 at 13:05 -0400, Michael B Allen wrote:
> On Sun, 23 Oct 2005 22:41:57 +1000
> Andrew Bartlett <abartlet@samba.org> wrote:
> 
> > On Sat, 2005-10-22 at 22:55 -0400, Michael B Allen wrote:
> > 
> > > 3) This one's a little CIFS specific but the
> > > spnego/accept_sec_context.c:send_supported_mechs function sends
> > > the quark$@FOO.NET style name in negHints but I see Samba returns
> > > cifs/quark.foo.net@FOO.NET. What is the difference between these service
> > > principal types? Is the first NetBIOS based (port 139 only) and the
> > > other DNS based (port 445 only)?
> > 
> > Samba3 did send the previous form, matching windows until very recently,
> > when I changed it, because only samba clients read that feild, I thought
> > it gave better behaviour on the network.  I didn't intend it to get into
> > the release, but once it was in it was decided it wasn't doing any harm.
> > 
> > Samba4 again matches windows and sends the former form, but does not use
> > that value in the client.
> 
> Oops, I was using that to create the target_name for GSSAPI
> init_sec_context. Are you *SURE* clients don't use it? Then I wonder
> what purpose it serves.

My understanding is that it is useful, and insecure.  One of the things
that makes kerberos fairly secure is that the KDC controls what hosts
may be contacted:  A host outside your network cannot ask to be
authenticated to with kerberos, expecting a ticket of a trusted host
inside your network, as your KDC won't know the name.  

When using this target_name, the client bypasses this, any any host can
ask to be sent tickets intended for any other host.  On a practical
standpoint, this value may not always be available and I wanted
consistent behaviour cross-protocol.

(Sidebar:  I can get the same value out of LDAP, by doing a SASL bind
with an empty first blob...).

Andrew Bartlett

-- 
Andrew Bartlett                                http://samba.org/~abartlet/
Samba Developer, SuSE Labs, Novell Inc.        http://suse.de
Authentication Developer, Samba Team           http://samba.org
Student Network Administrator, Hawker College  http://hawkerc.net

This is a digitally signed message part