[OpenAFS] AFS Token / Kerberos v5 ticket

[Rainer Toebbicke]

Xavier,

the "forge" code that Remi tried to get working is capable of decrypting an=
=20
AFS token both for K4 and K5, however it can only re-encrypt a K4 one, not =
K5.

When he asked me for advice I suggested to drop that code and rather use=20
Heimdal's kadmin extract to temporarily extract a keytab entry for the user=
 in=20
question and then simply do a "kinit -k" + aklog to build a new token for=20
shipment back to the batch worker.

This is also possible with MIT Kerberos, using a mod to ktutil developed by=
=20
Andrei.

Sure enough, all this has to take place on a trusted server using an=20
authenticated and secure channel, no keys are available to the batch worker=
.

For both, once the batch job is running, within the ticket refresh period a=
n=20
occasional "kinit -R" + aklog is sufficient and safer.

BTW: for the brave, "impersonating" as a user (which is what your batch sys=
tem=20
does in the end) is also possible without hacking or C-coding, using a=20
suitably mapped certificate, with Heimdal and even Windows. Probably MIT as=
=20
well. Just increasingly tricky to keep it hackerproof.

Cheers, Rainer

Xavier Canehan schrieb:

> Our home made batch system used to save and forge kas tickets. No=20
> Kerberos 5, not very secure, easiest. Moreover, it was just navigating=20
> through bit fields to forge a ticket. No AFS primitive implied.
>=20
> We are migrating: away from current batch system and to Kerberos 5.
> During process, we have to modify our batch system, whilst main=20
> developer retired.
>=20
> As R=C3=A9mi worked on Kerberos 5 migration here, he has been volunteered=
 to=20
> provided code to migrate our batch system. Thus, he is investigating=20
> several options to cope either with kas, fakeka, K5.
> He may have not been clear: we are not willing to put a keyfile in=20
> unsecure places. We have to modify our batch master and prepare the=20
> place for the next.
>=20
> Thanks to every one who helped, either with directions or code.
> R=C3=A9mi is adapting code from Rainer Toebbicke. If not successful, we w=
ill=20
> certainly switch to Heimdal, as suggested by Derrick Brashear.
>=20
>=20

--=20
=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D=
-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=3D-=
=3D-=3D
Rainer Toebbicke
European Laboratory for Particle Physics(CERN) - Geneva, Switzerland
Phone: +41 22 767 8985       Fax: +41 22 767 7155