Re: Wishlist: credential file update/access collision avoidance?

On Mon, Oct 03, 2011 at 03:19:37PM +0200, Harald Barth wrote:
>

> > Well, given that the historical best practices for Kerberos tickets
> > was to put addresses in them, I think that we can see that they
> > were not meant to be shared between computers without actually
> > being explicitly forwarded from one computer to the other.
> 
> And some of us still try to put adresses into the tickets, because we
> are - conservative? So yes, in my perspective that ticket cache is
> local. Isn't it endian dependent as well?

ccache_type 3 and higher are written in net byte order rather than
host byte order.  ccache_type 2 and prior are quite rare, as far
as I can tell ccache_type 3 was introduced before the first formal
release of MIT Kerberos and I've only seen one vendor (Cybersafe)
use ccache_type 2 in code that is not beta.

> > I think that this is still widely held as best practice.  IIRC,
> > addressless tickets were defined as the norm, not so that you could
> > put your ccaches on distributed file systems but rather because
> > addresses cause many issues with NAT and multi-homed host but do
> > not provide a terribly strong additional security component.
> 
> So how "terribly strong" is it in reality? Where can one read up on that?

Well, you can spoof IP addresses in various ways in certain
conditions.  The simplest is to be on the path between the endpoints.
This one isn't possible to prevent.  There have been various other
attacks which are more difficult to pull off, many of which are
prevented by firewall software.  But you can say with certainty
that if you do not trust every hop between yourself and the
destination that IP addresses in tickets do not provide an enormous
amount of value.  That said, they can limit the attack surface to
a much smaller group of people and so addresses are not completely
useless.  I think that the decision to promote addressless tickets
in preference to the variety with addresses was largely because
putting addresses in the tickets causes various problems in modern
networks and so the assurance that you buy from them is often
outweighed by the problem that you might experience.

But, there is also another consideration.  If you are able to get
a copy of my TGT and its session key then you are most likely
reading my ccache which means that you are on my computer because
ccaches are (should be) only stored in local file systems which
are not exported for reading.  In this case, you do not _need_ to
spoof my IP address, you've already got access to the ability to
use my network stack in which case you can simply perform a TGS_REQ
with my TGT and ask for an addressless one which you can take off
to any other computer and use.

--
    Roland Dowdeswell                      http://Imrryr.ORG/~elric/