4 ms·
Why are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that
by napierzaza 15y ago
Why are they not using Kerberos and SSL though? Does this affect those users who actually do take security seriously or just the bare bones implementations that aren't safe anyways?
- tptacek 15y agoThis got downvoted but is a perfectly valid question, since LDAP->OSX authentication is used virtually exclusively on internal networks where the assumption needs to be that attackers can see network traffic anyways.
- marshray 15y agoI don't know about Macs specifically (Apple makes servers?) or why they aren't using Kerb, but LDAP is commonly used over SSL/TLS. "LDAPS" some call it. LDAP wasn't originally designed to be an authentication protocol. If Mac clients are using it to make authentication decisions, they had better be requiring SSL/TLS on that connection (and validating the server cert perfectly, too).
- marshray 15y agoApparently, the forum poster says he's not using SSL/TLS with LDAP for the login authentication. Sounds to me like impersonating an LDAP server would grant login to Macs configured thusly.
- paxswill 15y agoNot entirely relevant, but Lion's Kerberos is pretty funky as well. Apple switched to Heimdal from MIT, supposedly marked the Heimdal API 'private' and provided a worse than broken shim between the MIT API and Heimdal.