1 / 23

ACCESS CONTROL MANAGEMENT

PROJECT GROUP # 3. ACCESS CONTROL MANAGEMENT. Poonam Gupta Sowmya Sugumaran. Overview. Goal of the project Project Progress Closer look at the TGTs Few security issues in Kerberos

egil
Download Presentation

ACCESS CONTROL MANAGEMENT

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript


  1. PROJECT GROUP # 3 ACCESS CONTROL MANAGEMENT Poonam Gupta Sowmya Sugumaran

  2. Overview • Goal of the project • Project Progress • Closer look at the TGTs • Few security issues in Kerberos • Brief intro to Kerberos commands • Few screen shots • Immediate tasks ahead

  3. Goal of the Project • The goal of the project is to allow clients access the service servers in a secure and controlled manner using Kerberos

  4. Project Progress • Installed Kerberos version5 • Assigned password for pre-authentication • Working on incorporating SRP protocol in pre-authentication

  5. Closer look at the TGT • TGT : Ticket-to-get-Ticket(between client and authentication server to get access to get access to Ticket Granting Server) • There are 9 field in a TGT request TGT Request Format

  6. Contd.. • The server can’t authenticate the TGT packet • An intruder can construct a similar looking packet • It can be indistinguishable from the legitimate packet

  7. Contd.. • Kerberos authenticates the client by sending back an encrypted packet • The packet is encrypted using the key from the user’s password • If the user enters the correct password upon logging in, the client can decrypt the packet to obtain the valid TGT • Unauthorized users get random useless bits

  8. TGT Return Packet Format • Ticket length and Ticket block are encrypted using the key derived from the user’s password.

  9. In Enemy Hands • Prone to Dictionary Attack –Password cracker • Intruder sends a fake TGT request and saves the encrypted TGT to a file • He then trial tests the password(P) • Convert P to DES key(K): K=string-to-key(P) • Decrypt TGT with K and check if it is the valid TGT • If so, P is the user’s password

  10. Timestamp in Pre-authentication • Including Ts during pre-authentication C S C S Drawback: • Prevents an attacker from requesting TGT; but does not prevent an eavesdropper from capturing Ek{Ts} or Ek{TGT} R, Ek{Ts} Ek{TGT}

  11. Solution: Stronger Cryptography • A variant of public-key cryptography • Secure Remote Password(SRP) • Properties: Resistant to dictionary attack Secure even if the password is of low entropy Only one password can be guessed per attempt in SRP 6 • SRP can be incorporated into Krb v5 as a pre- authentication mechanism

  12. Getting the Tickets • kinit –forwards request for TGT to KDC • KDC encrypts TGT with pswrd and sends back • kinit has following options - l(lifetime) - f(forwardable tickets) -r(renewable life)

  13. Listing the Tickets • klist – lists the tickets of the authenticated user. output of an unsuccessful authentication is: klist: No credentials cache file found (ticket cache /tmp/krb5cc_1234)

  14. Contd.. • klist provides: • Information of all tickets • Expiration time of each ticket • Flags that apply to the ticket Example: Ticket cache: /tmp/krb5cc_1234 Valid starting Expires 29 Jul 98 11:25:47 30 Jul 98 12:25:42

  15. Changing Kerberos Password • Kpasswd is used for changing Kerberos passwords • kpasswd: Changing password • Old password: your_old_password • kpasswd:your_new_password • New password (again): your_new_password • Kerberos password changed

  16. Immediate Tasks Ahead • Clock Synchronization • Setting the Master key

  17. Clock Synchronization • All clocks within the organization must be synchronized • Very important – Protects against replay attack • Possible solution: • Installing time server on one machine and having all clients synchronize their clocks with this machine

  18. Setting the Master Key • Database master key – protects from accidental disclosure • Derived from pass phrase and stored in stash file • Don’t back up stash file while making backups of database in a tape • Master key:<enter pass phrase> Verifying password – Master key:<enter pass phrase again>

  19. References • http://en.wikipedia.org/wiki/Kerberos_(protocol) • http://www.isoc.org/isoc/conferences/ndss/99/proceedings/papers/wu.pdf

  20. Thank You!

More Related