0

I have a folder on a Remote Domain:

\DomainRemote\Shared_Folder

And a process on a local Domain which needs to access said share:

Trusts exist between the domains - but only authenticated users from Local Domain should be able to access the share.

Fine - i get prompted for credentials and can access the share...

How are these credentials transmitted accross the network? Are they in clear?

If in clear is there anyway to handle this more securely?

1 Answer 1

0

If you have a valid and functional trust and the remote server providing the share is a member of the remote domain, you never should be asked for credentials. The fact that you are asked for credentials, it is an indication that the trust is broken in some way.

The trust issue put aside, authentication for SMB shares might be performed with one bunch of these mechanisms:

  • LANMAN (deprecated and insecure)
  • NTLM v1 (deprecated and insecure)
  • NTLM v2
  • Kerberos tickets (only available within AD domains)

which one gets picked is a matter of client and server support and configuration. In your case, you are likely to authenticate using NTLMv2 which is a challenge/response process and thus does not expose passwords to the remote side.

Nonetheless the protocol itself has weaknesses. One of them is that offline bruteforce cracking is feasible having just the transmitted authentication packets at hand and have succeeded for password lengths <= 8 characters more than a decade ago. Also, the NTLMv2 authentication is prone to an attack vector called reflection attacks where the adversary tricks you into authenticating against a host she controls and uses the information to "proxy" the auth data for a session she wants to establish.

So the auth does not use clear-text passwords but might be insecure nonetheless. If you are paranoid about this, make sure both sides are authenticated and preferably encrypted - e.g. by using end-to-end IPSEC for all your traffic.

1
  • Thanks for this.... i had thought that the trust relationship should take care of the authentication. It was a seed of doubt sewn by one of our Security Architects that forced the question. Mar 27, 2013 at 14:51

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .