[SSSD-users] sssd and sudo ldap problems with IPA.

Simo Sorce simo at redhat.com
Fri Aug 29 14:21:02 UTC 2014


On Fri, 2014-08-29 at 14:54 +0100, John Hodrien wrote:
> On Fri, 29 Aug 2014, Simo Sorce wrote:
> 
> > Although if one of the machines is compromised, now you can fool the
> > others, still better than no validation at all.
> 
> If I give you a null/unused.hostname at DOMAIN credential in a keytab, what can
> you fool?

If you use the same keytab on multiple machines and one machine is
compromised (and the keytab stolen) then I can impersonate a fake KDC
against the other machines using the same keytab for validation.

That's all.

Simo.

-- 
Simo Sorce * Red Hat, Inc * New York



More information about the sssd-users mailing list