How to Restrict Access for KDC servers

Both master and slave KDC servers have copies of the KDC database stored locally. Restricting access to these servers so that the databases are secure is important to the overall security of the SEAM installation.

1. Disable remote services in /etc/inetd.conf.

   To provide a secure KDC server, all non-essential network services should be disabled by commenting out the entry that starts the service in /etc/inetd.conf. In most circumstances the only services that would need to run would be time and krdb5_kprop. In addition, any services that use loopback tli (ticlts, ticotsord, and ticots) can be left enabled. After editing, the file should look something like (to shorten the example many comments have been removed):

   kdc1 # cat /etc/inetd.conf # #ident "@(#)inetd.conf 1.33 98/06/02 SMI" /* SVr4.0 1.5 */ . . #name dgram udp wait root /usr/sbin/in.tnamed in.tnamed # #shell stream tcp nowait root /usr/sbin/in.rshd in.rshd #login stream tcp nowait root /usr/sbin/in.rlogind in.rlogind #exec stream tcp nowait root /usr/sbin/in.rexecd in.rexecd #comsat dgram udp wait root /usr/sbin/in.comsat in.comsat #talk dgram udp wait root /usr/sbin/in.talkd in.talkd # #uucp stream tcp nowait root /usr/sbin/in.uucpd in.uucpd # #finger stream tcp nowait nobody /usr/sbin/in.fingerd in.fingerd # # Time service is used for clock synchronization. # time stream tcp nowait root internal time dgram udp wait root internal # . . # 100234/1 tli rpc/ticotsord wait root /usr/lib/gss/gssd gssd #dtspc stream tcp nowait root /usr/dt/bin/dtspcd /usr/dt/bin/dtspcd #100068/2-5 dgram rpc/udp wait root /usr/dt/bin/rpc.cmsd rpc.cmsd 100134/1 tli rpc/ticotsord wait root /usr/krb5/lib/ktkt_warnd kwarnd #klogin stream tcp nowait root /usr/krb5/lib/rlogind rlogind -k #eklogin stream tcp nowait root /usr/krb5/lib/rlogind rlogind -k -e #telnet stream tcp nowait root /usr/krb5/lib/telnetd telnetd #ftp stream tcp nowait root /usr/krb5/lib/ftpd ftpd #kshell stream tcp nowait root /usr/krb5/lib/rshd rshd -k -c -A krb5_prop stream tcp nowait root /usr/krb5/lib/kpropd kpropd

   Reboot the server after the changes are made.

2. Restrict access to the hardware supporting the KDC.

   In order to restrict physical access, make sure that the server and its monitor are located in a secure facility. Normal users should not be able to access this server in any way.

3. Store KDC database backups on local disks or on the slaves.

   Making tape backups of your KDC should only be done if the tapes are stored securely. This is also true for copies of keytab files. It would be best to store these files on a local file system that is not shared to other systems. The storage file system can be on either the master KDC server or any of the slaves.