7

We have few customer facing servers in DMZ that also have user accounts , all accounts are in shadow password file. I am trying to consolidate user logons and thinking about letting LAN users to authenticate against Active Directory.Services needing authentication are Apache, Proftpd and ssh. After consulting security team I have setup authentication DMZ that has LDAPS proxy that in turn contacts another LDAPS proxy (proxy2) in LAN and this one passes authentication info via LDAP (as LDAP bind) to AD controller.Second LDAP proxy only needed because AD server refuses speak TLS with our secure LDAP implemetation. This works for Apache using appropriate module.At a later stage I may try to move customer accounts from servers to LDAP proxy so they are not scattered around servers.

For SSH I joined proxy2 to Windows domain so users can logon using their windows credentials.Then I created ssh keys and copied them to DMZ servers using ssh-copy, to enable passwordless logon once users are authenticated.

Is this a good way to implement this kind of SSO?Did I miss any security issues here or maybe there is a better way ofachieving my goal?

1 Answer 1

8

If you're using PAM for your authentication stack, you can use pam_krb5 to provide kerberos authentication for your services. Kerberos was designed out-of-the-box to deal with hostile environments, handles authentication-by-proxy, and is already a part of the AD spec. Why struggle with LDAP when you can get Kerberos to do the heavy lifting for you, and get on with life? Yeah, you'll have to do some reading, and yeah, it'll take a bit of time, but I've used Kerb-to-AD authentication for years and have found it to be the easiest, quickest way to get SSO working out of the box when you have Active Directory as the authentication backend.

The main thing you'll run into is that Microsoft decided to be very specific about the default encryption types (they basically made their own), so you'll need to set up your Kerberos clients to have the correct matching encryption types, or the AD servers will continue to reject it. This is thankfully an easy procedure and shouldn't require more than a few edits to krb5.conf.

And now, some links for you to consider...

Microsoft's View of Kerberos

Meshing Kerberos and Active Directory

ssh and Kerberos authentication via PAM

Apache and Kerberos

ProFTP and Kerberos

RFCs of Microsoft's Activities with Kerberos (which you really don't want to read about):

10
  • Thank you Avery,I did look at kerboros,and it is sort of implemeted in the setup.Proxy2 is a linux box joined to windows kerberos realm - so AD users can authenticate to proxy2 logging on via ssh which uses pam winbind and then logon to DMZ servres using public keys created by me.This of course requires local users on DMZ servers to be precreated. The reasons of not joining DMZ servers to Winows realm is that security team said I must have intermediate DMZ with server that proxsies auth requests.I could not find ways to proxy kerberos requests so LDAPS it is...
    – Sergei
    Jul 3, 2009 at 7:43
  • Maybe security team is too paranoid and it is a common practice to make DMZ authentication to use AD without this intermediate DMZ - this is what I am trying to find out...
    – Sergei
    Jul 3, 2009 at 7:45
  • If you can control traffic to your DMZ, then you can control traffic /flows/ inside of it. This is how I handle exposed DMZ services - traffic originating from the outside is heavily filtered and only has access to specific ports, traffic within the DMZ sees everything inside the DMZ (but not everything internally), and traffic internally can see both the outside and the DMZ. Attackers on the outside can't get to internal services and can only see the ports of specific services hosted inside the DMZ. But DMZ computers can clearly see each other - including any proxy services. Jul 3, 2009 at 14:01
  • So when you say "including proxy services" do you mean proxy servre that can pass over kerberos requests too?I am just trying to please our security team.Their policy is that we must have intermediate DMZ that contains authentication proxy in order to pass authentication traffic from DMZ to LAN.
    – Sergei
    Jul 3, 2009 at 16:39
  • With the right setup, Kerberos authentication will "proxy" itself, i.e. the server facing the DMZ can be made to contact the (interior) KDC that holds the "keys to the kingdom". This requires a bit of setup but it can be done Jul 3, 2009 at 16:41

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .