4 ms·
Considering this seems intended for use in somewhat corporate situations, it may or may not be that serious of a problem. This is yet another situation where K
by hlieberman 11y ago
Considering this seems intended for use in somewhat corporate situations, it may or may not be that serious of a problem.
This is yet another situation where Kerberos got it right years and years ago, but is almost impossible to actually /use/ even now after n years.
- beagle3 11y agoCould you give a quick summary (or a link) about how Kerberos works in this respect ?
- joushou 11y agoExactly. And yes, Kerberos got it somewhat right, but as someone who have used configured and used it, it is quite the exercise to set up. It took ages to get working, and even then, it was slightly cumbersome to use.
- cpach 11y ago"It took ages to get working, and even then, it was slightly cumbersome to use." I've wondered from time to time why Kerberos more or less faded into obscurity. I guess we have the answer then.
- asdfaoeu 11y agoKerberos is just as open as ssh-agents. The middle server is still able to impersonate you.
- joushou 11y agossh-agent, as a protocol-concept is not as broken as it sounds. It's just that the implemented interface (socket) is bad when combined with no user acknowledgment of sign requests. I think the worst part is that the agent doesn't ask the user for confirmation, which would essentially invalidate most of the ways you would abuse the agent. Attacks would be reduced to spamming or attempted phishing with agent requests. Kerberos could have bad interface as well, but I don't know how that would work in this scenario. The protocol itself is secure, but just as with ssh agent forwarding, if you let everyone make authentication requests without requiring user interaction to verify it, it will have the same problems.
- throwaway2048 11y agoyou can have the agent ask you for confirmation, see ssh-add -c in the appropriate manpage.