Subject: RE: New draft coming your way

From: "Mike Swift (NT)" <[email-masked]>
Date: Thu, 6 Nov 1997 12:50:17 -0800

Dialup authentication is one of the primary motiviations for this draft. By
allowing Kerberos to be used before the network is available clients can
authenticate to the dial-in server or firewall before being granted access
to the rest of the network.

- Mike

> -----Original Message-----
> From:	Doug Engert [SMTP:[email-masked]]
> Sent:	Thursday, November 06, 1997 6:41 AM
> To:	Mike Swift (NT)
> Cc:	[email-masked]
> Subject:	New draft coming your way
> 
> Mike Swift writes:
>  > I submitted a new draft last night, draft-ietf-cat-iakerb-00.txt, that
>  > specifies a protocol for using Kerberos and the GSS-API for initial
>  > authentication, such as in a dialup situation where there is
> connectivitiy
>  > available on the client. The general principal is that the client will
>  > create an AS request and rather than send it to the KDC, instead
> returns it
>  > from GSS_init_sec_context(). The client application sends the AS
> request to
>  > the service, which then forwards the request to a KDC and fowards the
> AS
>  > respons from the KDC back to the client. This allows use of Kerberos in
>  > situations where the client can't easily locate a KDC, such as on the
>  > Internet.
>  > 
>  > - Mike Swift
> 
> Interesting. Sounds like you are addressing the misuse of Kerberos by
> many of the firewall/terminal-server vendors. They require you to send
> your Kerberos password over the phone line to the concentrator who
> then authenticates you via Kerberos.
> 
> I have long said that this is backwards, the firewall should really
> allow you to send requests to the KDC before you are authenticated.
> (and maybe to DNS as well.)  Then you could use normal Kerberos
> authentication to authenticate to the firewall/terminal-server which
> would then give you full access to other addresses.
>  
> The "service" in your approach could be the firewall/terminal-server.  
> 
> -- 
>  
>  Douglas E. Engert  <[email-masked]>
>  Argonne National Laboratory
>  9700 South Cass Avenue
>  Argonne, Illinois  60439 
>  (630) 252-5444

---

From: Derek Atkins <[email-masked]>
Date: 07 Nov 1997 11:46:07 -0500

Take a look at "Charon: Kerberos Extensions for Authentication over
Secondary Networks", which made extensions to Kerberos to allow secure
authentication to a server using in-band signalling.  This is most
useful for secure authentication of dialup connections, where you
don't have IP connectivity from the client to the KDC.

In your particular case, the firewall/terminal server would act as the
"login host", to which the user truly authenticates securely.  Based
on that authentication, the firewall/terminal server can grant
connectivity to the rest of the network.

Take a look at http://web.mit.edu/warlord/www/thesis.ps

-derek

-- 
       Derek Atkins, SB '93 MIT EE, SM '95 MIT Media Laboratory
       Member, MIT Student Information Processing Board  (SIPB)
       URL: http://web.mit.edu/warlord/      PP-ASEL      N1NWH
       [email-masked]                        PGP key available