Re: HEAD's UP: possible 0day SSH exploit in the wild
Peter Jordan <usernetwork@gmx.info> writes:
> It would be a stand alone MIT KDC (with krb-rsh) on debian lenny.
>
> "safe" in the sense of "you better attack the services which depends on
> kerberos than kerberos itself"
That's what we've done at Stanford for many, many years, and I'm
comfortable doing so. The Debian MIT Kerberos maintainers (of which I'm
one) receive advance notice of upcoming security vulnerability
announcements and always prepare security updates in advance for any KDC
vulnerabilities.
The one additional vulnerability that you do open is brute-force attacks
on weak keys, which generally means password-based keys since the
randomly-generated service keys are generally too strong to bother with.
Ensuring that you use AES enctypes for all keys (disable DES and ideally
also 3DES) and that your users have to pick strong passwords should
eliminate most of that concern.
--
Russ Allbery (rra@debian.org) <http://www.eyrie.org/~eagle/>
Reply to: