Increasing Security on Kerberos Servers

Follow these steps to increase security on Kerberos application servers and on KDC servers.

Table 23–4 Increasing Security on Kerberos Servers (Task Map)

Task	Description	For Instructions
Enabling access using Kerberos authentication	Restrict network access to a server to allow Kerberos authentication only	How to Enable Only Kerberized Applications
Restricting access to the KDC servers	Increases the security of the KDC servers and their data.	How to Restrict Access to KDC Servers
Increasing password security by using a dictionary file	Increases the security of any new passwords by checking the new password against a dictionary.	How to Use a Dictionary File to Increase Password Security

How to Enable Only Kerberized Applications

This procedure restricts network access to the server that is running telnet, ftp, rcp, rsh, and rlogin to use Kerberos authenticated transactions only.

1. Change the exec property for the telnet service.

   Add the -a user option to the exec property for telnet to restrict access to those users who can provide valid authentication information.

   # inetadm -m svc:/network/telnet:default exec="/usr/sbin/in.telnetd -a user"

2. (Optional) If not already configured, change the exec property for the telnet service.

   Add the -a option to the exec property for ftp to permit only Kerberos authenticated connections.

   # inetadm -m svc:/network/ftp:default exec="/usr/sbin/in.ftpd -a"

3. Disable other services.

   The in.rshd and in.rlogind daemons should be disabled.

   # svcadm disable network/shell # svcadm disable network/login:rlogin

How to Restrict Access to KDC Servers

Both master KDC servers and slave KDC servers have copies of the KDC database stored locally. Restricting access to these servers so that the databases are secure is important to the overall security of the Kerberos installation.

1. Disable remote services, as needed.

   To provide a secure KDC server, all nonessential network services should be disabled . Depending on your configuration, some of these services may already be disabled. Check the service status with the svcs command. In most circumstances, the only services that would need to run would be krb5kdc and kadmin if the KDC is a master. In addition, any services that use loopback tli (ticlts, ticotsord, and ticots) can be left enabled.

   # svcadm disable network/comsat # svcadm disable network/dtspc/tcp # svcadm disable network/finger # svcadm disable network/login:rlogin # svcadm disable network/rexec # svcadm disable network/shell # svcadm disable network/talk # svcadm disable network/tname # svcadm disable network/uucp # svcadm disable network/rpc_100068_2-5/rpc_udp

2. Restrict access to the hardware that supports the KDC.

   To restrict physical access, make sure that the KDC server and its monitor are located in a secure facility. Users should not be able to access this server in any way.

3. Store KDC database backups on local disks or on the KDC slaves.

   Make tape backups of your KDC only if the tapes are stored securely. Follow the same practice for copies of keytab files. It would be best to store these files on a local file system that is not shared with other systems. The storage file system can be on either the master KDC server or any of the slave KDCs.

How to Use a Dictionary File to Increase Password Security

A dictionary file can be used by the Kerberos service to prevent words in the dictionary from being used as passwords when creating new credentials. Preventing the use of dictionary terms as passwords makes it harder for someone else to guess any password. By default the /var/krb5/kadm5.dict file is used, but it is empty.

1. Become superuser on the master KDC.

2. Edit the KDC configuration file (kdc.conf).

   You need add a line to instruct the service to use a dictionary file. In this example, the dictionary that is included with the spell utility is used. See the kdc.conf(4) man page for a full description of the configuration file.

   kdc1 # cat /etc/krb5/kdc.conf [kdcdefaults] kdc_ports = 88,750 [realms] EXAMPLE.COM = { profile = /etc/krb5/krb5.conf database_name = /var/krb5/principal admin_keytab = /etc/krb5/kadm5.keytab acl_file = /etc/krb5/kadm5.acl kadmind_port = 749 max_life = 8h 0m 0s max_renewable_life = 7d 0h 0m 0s sunw_dbprop_enable = true sunw_dbprop_master_ulogsize = 1000 dict_file = /usr/share/lib/dict/words }

3. Restart the Kerberos daemons.

   kdc1 # svcadm restart -r network/security/krb5kdc kdc1 # svcadm restart -r network/security/kadmin