Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?
>> I'm a LITTLE confused as to what you're describing here. As I
>> understand you, the TRUSTED_FOR_DELEGATION flag doesn't appear on
>> the wire and only in the account properties.
>
>Yes. Apologies; I should have been more precise: when Microsoft AD is
>acting as the KDC, whether AD sets the the OK-AS-DELEGATE flag in the
>TGS-REP is determined by whether the userAccountControl attribute in
>Active Directory of the host for which a service ticket is being
>requested has the TRUSTED_FOR_DELEGATION flag set. If
>TRUSTED_FOR_DELEGATION is set, OK-AS-DELEGATE is set in the TGS-REP;
>otherwise, OK-AS-DELEGATE is not set in the TGS-REP.
Okay, THAT makes more sense.
>Heimdal appears to implement the same option (enforce_ok_as_delegate),
>but although the upstream source claims the default is false (do not
>enforce), Macs seem to enforce it by default. So either Apple has
>changed that default in the code, or else they are overriding the
>default somewhere in the Kerberos configuration.
>In terms of Windows, Microsoft’s Kerberos implementation seems to
>enforce compliance with the OK-AS-DELEGATE flag. (PuTTY on Windows
>will not delegate a credential unless the target host has the
>TRUSTED_FOR_DELEGATION flag set in AD.) Perhaps there is a way to
>disable this behavior, but we have not yet found a way to do so.
Well, I figured out what is going on there ... see below.
>> the RFC provides what I would consider a cognizant explanation:
>>
>> https://datatracker.ietf.org/doc/html/rfc4120#section-2.8
>
>Microsoft provides a similar explanation, but it is still an
>unsatisfying one, because it does not speak to our issue: if denying
>the ability to delegate a credential (in order to protect it from
>exposure to a possibly-untrustworthy host) forces the user to instead
>acquire a credential directly from the possibly-untrustworthy host
>(thereby exposing the user’s actual password), then this is not a
>security improvement. And while I acknowledge that RFC4120 is 19 years
>old and a lot has changed since it was originally published, neither
>the RFC authors nor Microsoft seems to have considered/predicted this
>scenario.
Simo already explained the thinking there, but I think the thing you're
not considering is that not all services require delegated credentials.
Yes, in your environment (and ours) delegated credentials for host
principals is essential, but you don't normallty need that for other
types of credentials. I haven't run into Simo's experience of badly
coded applications delegating credentials when they shouldn't, but I could
believe it happens. It does make sense to be able to control this
centrally based on KDC configuration (that's one of the advantages
to _having_ a KDC). And, well .. one thing I guess I do not understand
is, exactly, what is your problem with turning on that setting on your
KDC? If this is just a cri de cœur about lousy AD admins, fair enough;
I can understand your pain there (most AD admins really don't know how
Kerberos works, sadly).
Speaking about the OK-AS-DELEGATE flag, the ONLY thing that does is set
the flag in the ticket which the client uses as a hint (it is free to
ignore that hint). I cannot speak for the AD TRUSTED_FOR_DELEGATION flag
as a whole; it's possible it does something else than set the OK-AS-DELEGATE
ticket flag.
However, we use MIT Kerberos for our KDC and we occasionally use the
MacOS X ssh client and it delegates credentials just FINE for us without
the use of OK-AS-DELEGATE, so I was curious as to what was going on there.
I did some digging into the MacOS X Heimdal code, and here's what I found.
- The OpenSSH code is mostly the same for our purposes in terms of the
Kerberos support; use of the -K flag turns on the right flags for
credential delegation (in addition to GSSAPI authentication support).
- In the gss_init_sec_context() code path I found this little snippet:
/*
* If the credential doesn't have ok-as-delegate, check if there
* is a realm setting and use that.
*/
if (!ctx->kcred->flags.b.ok_as_delegate && ctx->ccache) {
krb5_data data;
ret = krb5_cc_get_config(context, ctx->ccache, NULL,
"realm-config", );
if (ret == 0) {
/* XXX 1 is use ok-as-delegate */
if (data.length < 1 || unsigned char *)data.data)[0]) & 1) == 0)
req_flags &= ~(GSS_C_DELEG_FLAG|GSS_C_DELEG_POLICY_FLAG);
krb5_data_free();
}
}
So if there is NOT a delegation flag on the ticket, the realm-config
entry is checked. If the first byte has the least-significant bit
set, the all of the delegation flags are cleared. I suspect this is
what you're hitting.
So, what sets that realm configuration? As far as I can tell, that
ONLY happens inside of kinit. Specifically, this code block:
if (ok_as_delegate_flag || windows_flag || use_referrals_flag) {
unsigned char d = 0;
Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?
The correct action is for you to ask the Domain Administrators to mark the target hosts as ok for delegation, it is unclear why MIT Kerberos should make it easy to override Realm policies. Delegating a whole TGT is generally a bad idea, and often clients are misconfigured to broadly forward it everywhere. That is why Microsoft took back control in the hands of administrators. It is not a bad thing, and if your setup has been vetted such that TGT delegation is an acceptable risk, then it should be easy to get it fixed the proper way, by getting your domain admins to set the right flag on the permitted target hosts. Note that if ticket delegation is needed solely to allow jumping from hosts to host, you should be able to achieve the same result via agent forwarding, it would be a safer option. But all that said I would like to note that it is certainly inappropriate to call people names before fully understanding the scope of a security measure, just because it is a little inconvenient. If you wanted a knob like the one you ask for it should probably be called: dishonor_trusted_for_delegation_mr_auditor_please_be_lenient As for users that type their passwords onto random hosts, that is a user education problem in general, but that can be addressed simply by forcing the use of 2FA authentication on the user's part, preferably via a hardware token and pkinit, but an OTP solution would work as well. Cheers, Simo. On Tue, 2024-04-16 at 03:03 -0400, James Ralston wrote: > On Mon, Apr 15, 2024 at 7:56 PM Ken Hornstein wrote: > > > I'm a LITTLE confused as to what you're describing here. As I > > understand you, the TRUSTED_FOR_DELEGATION flag doesn't appear on > > the wire and only in the account properties. > > Yes. Apologies; I should have been more precise: when Microsoft AD is > acting as the KDC, whether AD sets the the OK-AS-DELEGATE flag in the > TGS-REP is determined by whether the userAccountControl attribute in > Active Directory of the host for which a service ticket is being > requested has the TRUSTED_FOR_DELEGATION flag set. If > TRUSTED_FOR_DELEGATION is set, OK-AS-DELEGATE is set in the TGS-REP; > otherwise, OK-AS-DELEGATE is not set in the TGS-REP. > > > the [MIT Kerberos] library already provides an option to ignore that > > [the OK-AS-DELEGATE] flag and it seems that by default it DOES > > ignore that flag) > > I think the enforce_ok_as_delegate is the option you’re referring to? > > The man page claims it is disabled by default (unless an application > specifically requests it). That matches our experiences. > > Heimdal appears to implement the same option (enforce_ok_as_delegate), > but although the upstream source claims the default is false (do not > enforce), Macs seem to enforce it by default. So either Apple has > changed that default in the code, or else they are overriding the > default somewhere in the Kerberos configuration. > > In terms of Windows, Microsoft’s Kerberos implementation seems to > enforce compliance with the OK-AS-DELEGATE flag. (PuTTY on Windows > will not delegate a credential unless the target host has the > TRUSTED_FOR_DELEGATION flag set in AD.) Perhaps there is a way to > disable this behavior, but we have not yet found a way to do so. > > > the RFC provides what I would consider a cognizant explanation: > > > > https://datatracker.ietf.org/doc/html/rfc4120#section-2.8 > > Microsoft provides a similar explanation, but it is still an > unsatisfying one, because it does not speak to our issue: if denying > the ability to delegate a credential (in order to protect it from > exposure to a possibly-untrustworthy host) forces the user to instead > acquire a credential directly from the possibly-untrustworthy host > (thereby exposing the user’s actual password), then this is not a > security improvement. And while I acknowledge that RFC4120 is 19 years > old and a lot has changed since it was originally published, neither > the RFC authors nor Microsoft seems to have considered/predicted this > scenario. > > On Mon, Apr 15, 2024 at 8:40 PM Stephen Frost wrote: > > > I'd *strongly* encourage you to ignore what OSX comes with in terms > > of Kerberos "support" and push to move everything away from what OSX > > ships with and to instead use MIT Kerberos. In my experience, this > > is far from the only issue you're going to run into with the hacked > > up Kerberos from OSX and they don't seem to care to properly > > maintain it. > > It has been our experience that ripping out a vendor-supplied > library/package and replacing it with an in-house version almost > always has a higher long-term cost than simply living with whatever > warts the vendor-supplied library/package has. So we are reluctant to > take this approach unless there is truly no other choice. > > But this segues back to my original question: how are other sites that > use Microsoft AD as their KDCs handling this? > > Are other sites ensuring that the TRUSTED_FOR_DELEGATION flag
Re: honoring the TRUSTED_FOR_DELEGATION KDC MS-SFU Kerberos Protocol Extensions flag?
On Mon, Apr 15, 2024 at 7:56 PM Ken Hornstein wrote: > I'm a LITTLE confused as to what you're describing here. As I > understand you, the TRUSTED_FOR_DELEGATION flag doesn't appear on > the wire and only in the account properties. Yes. Apologies; I should have been more precise: when Microsoft AD is acting as the KDC, whether AD sets the the OK-AS-DELEGATE flag in the TGS-REP is determined by whether the userAccountControl attribute in Active Directory of the host for which a service ticket is being requested has the TRUSTED_FOR_DELEGATION flag set. If TRUSTED_FOR_DELEGATION is set, OK-AS-DELEGATE is set in the TGS-REP; otherwise, OK-AS-DELEGATE is not set in the TGS-REP. > the [MIT Kerberos] library already provides an option to ignore that > [the OK-AS-DELEGATE] flag and it seems that by default it DOES > ignore that flag) I think the enforce_ok_as_delegate is the option you’re referring to? The man page claims it is disabled by default (unless an application specifically requests it). That matches our experiences. Heimdal appears to implement the same option (enforce_ok_as_delegate), but although the upstream source claims the default is false (do not enforce), Macs seem to enforce it by default. So either Apple has changed that default in the code, or else they are overriding the default somewhere in the Kerberos configuration. In terms of Windows, Microsoft’s Kerberos implementation seems to enforce compliance with the OK-AS-DELEGATE flag. (PuTTY on Windows will not delegate a credential unless the target host has the TRUSTED_FOR_DELEGATION flag set in AD.) Perhaps there is a way to disable this behavior, but we have not yet found a way to do so. > the RFC provides what I would consider a cognizant explanation: > > https://datatracker.ietf.org/doc/html/rfc4120#section-2.8 Microsoft provides a similar explanation, but it is still an unsatisfying one, because it does not speak to our issue: if denying the ability to delegate a credential (in order to protect it from exposure to a possibly-untrustworthy host) forces the user to instead acquire a credential directly from the possibly-untrustworthy host (thereby exposing the user’s actual password), then this is not a security improvement. And while I acknowledge that RFC4120 is 19 years old and a lot has changed since it was originally published, neither the RFC authors nor Microsoft seems to have considered/predicted this scenario. On Mon, Apr 15, 2024 at 8:40 PM Stephen Frost wrote: > I'd *strongly* encourage you to ignore what OSX comes with in terms > of Kerberos "support" and push to move everything away from what OSX > ships with and to instead use MIT Kerberos. In my experience, this > is far from the only issue you're going to run into with the hacked > up Kerberos from OSX and they don't seem to care to properly > maintain it. It has been our experience that ripping out a vendor-supplied library/package and replacing it with an in-house version almost always has a higher long-term cost than simply living with whatever warts the vendor-supplied library/package has. So we are reluctant to take this approach unless there is truly no other choice. But this segues back to my original question: how are other sites that use Microsoft AD as their KDCs handling this? Are other sites ensuring that the TRUSTED_FOR_DELEGATION flag is set for Linux hosts, so that all various Kerberos libraries (including ones that enforce OK-AS-DELEGATE by default) will correctly delegate credentials to Linux hosts? Are other sites configuring their Kerberos libraries (on a per-OS basis) to ignore the OK-AS-DELEGATE flag? Have few other sites that use Microsoft AD as their KDC even run into this, because they don’t have services (e.g. home directories mounted via NFSv4+RPCGSS) that require a Kerberos credential, and therefore don’t need to forward Kerberos credentials to the remote host when making an ssh connection to it? My read of the MIT Kerberos kdc.conf man page is that ok-as-delegate is not one of the flags in default_principal_flags that defaults to enabled. So heterogeneous sites that use MIT Kerberos as their KDCs (not AD) should also be seeing this issue. At least so far, we *think* the best course of action is to always set the TRUSTED_FOR_DELEGATION flag for Linux hosts in AD, so that credential delegation won’t depend on whether the Kerberos library that any specific host uses pays attention to the OK-AS-DELEGATE flag. And this does seem to be the intention of the TRUSTED_FOR_DELEGATION / OK-AS-DELEGATE flags: it’s advice to Kerberos clients that it’s OK to delegate credentials to the target host, which is exactly what we want to happen. The only thing we’re not completely sure about is whether setting the TRUSTED_FOR_DELEGATION flag in AD will have other security ramifications that aren’t clear from Microsoft’s documentation. Which is why I was hoping that others on this list have already been down this particular road and could
