Subject: Re: [Ietf-krb-wg] Re wglc of draft-ietf-krb-wg-iakerb-01

From: Larry Zhu <[email-masked]>
Date: Tue, 24 Mar 2009 13:37:41 -0700

Hi Love

> I think the draft does not explain how the proxy protects itself
> agaist unwanted traffic, how the proxy only allow kerberos traffic but
> not any other encrypted kerberos like traffic.

The IAKERB proxy just forwards the request to port 88 of the targeted DCs. It does not handle any other traffic. Can you expand the comments if I did not fully understand your concern?

Can I address your comments by adding the following text in the security considerations section?

In section 5, I propose to replace OLD:

   Similar to other network access protocols, IAKERB allows an
   unauthenticated client (possibly outside the security perimeter of an
   organization) to send messages that are proxied to interior servers.

With NEW:

   Similar to other network access protocols, IAKERB allows an
   unauthenticated client (possibly outside the security perimeter of an
   organization) to send messages that are proxied to interior servers. To reduce attack surface,
   IPSEC filters can be applied to allow from which hosts the client requests can be proxied
   And the proxy can additionally restrict to which realms the requests can be proxied.

Note that only the last sentence is new and it is appended to the end of the existing paragraph. Does this fully address your concern?

Thanks,

--larry

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Love Hörnquist Åstrand
Sent: Monday, November 24, 2008 4:21 PM
To: Kerberos-wg -
Subject: [Ietf-krb-wg] Re wglc of draft-ietf-krb-wg-iakerb-01

Re wglc of draft-ietf-krb-wg-iakerb-01

I think the draft does not explain how the proxy protects itself
agaist unwanted traffic, how the proxy only allow kerberos traffic but
not any other encrypted kerberos like traffic.

Only allow traffic to port 88 seems a little bit weak.

If it can't it should limit to what hosts and for what realms it allows.

Love

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

_______________________________________________
ietf-krb-wg mailing list
[email-masked]
https://lists.anl.gov/mailman/listinfo/ietf-krb-wg

---

From: Jeffrey Hutzelman <[email-masked]>
Date: Tue, 24 Mar 2009 14:14:23 -0700

--On Tuesday, March 24, 2009 01:37:41 PM -0700 Larry Zhu 
<[email-masked]> wrote:

> The IAKERB proxy just forwards the request to port 88 of the targeted
> DCs. It does not handle any other traffic. Can you expand the comments if
> I did not fully understand your concern?
>
> To reduce attack surface,    IPSEC filters can be applied to allow from
> which hosts the client requests can be proxied    And the proxy can
> additionally restrict to which realms the requests can be proxied.
>
> Note that only the last sentence is new and it is appended to the end of
> the existing paragraph. Does this fully address your concern?

I think by "IPSEC" here you mean some Microsoft host firewall thing.  In 
the IETF, "IPsec" means the security extensions for IP, and talking about 
"IPSEC filters" is almost certainly going to confuse someone.

-- Jeff

---

From: Larry Zhu <[email-masked]>
Date: Tue, 24 Mar 2009 14:31:49 -0700

How about:

To reduce attack surface, IP filters can be applied to allow from
which hosts the client requests can be proxied and the proxy can
further restrict the set of realms to which the requests
can be proxied.

--larry

-----Original Message-----
From: Jeffrey Hutzelman [mailto:[email-masked]]
Sent: Tuesday, March 24, 2009 2:14 PM
To: Larry Zhu; Love Hörnquist Åstrand; Kerberos-wg -
Cc: [email-masked]
Subject: Re: [Ietf-krb-wg] Re wglc of draft-ietf-krb-wg-iakerb-01

-- Jeff

---

From: Love Hörnquist Åstrand <[email-masked]>
Date: Tue, 24 Mar 2009 17:51:51 -0700

How about:

The proxy should not allow clients to proxy to any realm since that  
would allow clients to use a tunnel channel to any hosts.
There should be put restriction on what IP addresses and/or realm the  
proxy find it acceptable to proxy too.

Love

24 mar 2009 kl. 14:31 skrev Larry Zhu:

>> Can I address your comments by adding the following text in the  
>> security
>> considerations section?
>>