Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

We are setting up a SharePoint 2010 site. Don't worry, this is not a Sharepoint question, just adding it for context. Most of the site will be anonymous, but some users are able to authenticate in and edit content. They use NTLM (users exist in AD). Is there any concern about exposing NTLM login for users that can modify content over the internet via http or should that only be exposed via https?

share|improve this question
1  
FYI, NTLM is deprecated. Microsoft recommends Kerberos instead (which is safe to use over plaintext protocols). – grawity May 5 '11 at 13:37
1  
And to add to what @grawity said, any users behind certain proxies and filters (squid is one I know of for sure) won't be able to log in with NTLM authentication. – KJ-SRS May 5 '11 at 14:07
And before you ask, one can use Kerberos over HTTP, and SharePoint supports it. – grawity May 5 '11 at 14:13
More clarification, we are using NTLMv2 – Shane May 5 '11 at 14:33
1  
@KJ-SRS: As long as a proxy supports HTTP/1.1 it won't present a problem using NTLM authentication. – Evan Anderson May 5 '11 at 14:43

2 Answers

up vote 2 down vote

You won't be exposing credentials in cleartext using NTLM over HTTP. You will be exposing everything else, so your data won't be secure from confidentiality or integrity breaches (eavesdropping or modification of the data "in flight").

share|improve this answer
That's okay, this is a public anonymous site. The only reason we need authentication is because it is a CMS, so certain users that have rights to edit content are able to log in via NTLMv2 – Shane May 5 '11 at 14:52
up vote 0 down vote

I don't know a thing about Sharepoint, but the generic approach to it would be to put a sniffer on it. If you can see the passwords or their hashes being passed, then it's bad. If you can't see it, then you need to look into it some more, it still might be lightly obfuscated (base64 encoding or something like that).

share|improve this answer
"if you see it, it's bad" doesn't always apply. NTLM v2 is a challenge/response protocol, supposed to remain secure even in this case (the password hash sent cannot be reused). On the other hand, authentication mechanisms very often have subtle flaws unnoticeable through simple visual grep of packets. (You cannot see the difference between a chunk of AES ciphertext and a chunk of XOR ciphertext.) – grawity May 5 '11 at 14:10
1  
'If you see it it's bad' is true. 'If you don't see it then it's good' is not necessarily true however. With challenge/response protocols you gotta study the protocol of what is being asked and how the response is generated, then seeing if you can obtain all the necessary information. en.wikipedia.org/wiki/NTLM#NTLMv2 has the details of what gets used. Time can be closely estimated, user and domain names can be determined, so the only truly random bit is 8byte random nonce, so that can probably be guessed in not too many tries. – Marcin May 5 '11 at 14:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.