Richard E. Silverman

less info
186 reputation
3
bio website qoxp.net
location New York, United States
age
visits member for 2 years, 4 months
seen May 29 at 23:31

sysadmin, O'Reilly author, security, math, SSH, Kerberos, ...


Apr
6
comment How to reset Keytab for FreeIPA Server and Client
You haven't mentioned kadmin before. Do you mean kadmin, or ipa-getkeytab? For the latter, it looks as if you need to kinit a principal authorized for IPA administrative access.
Mar
29
answered Convert EC2 ssh .pem key to Azure X.509 certificate?
Mar
22
awarded  Commentator
Mar
22
comment How to solve problematic cpu load due to encryption when using SFTP on a VM
Have you tried adjusting the SSH encryption and MAC algorithms for a better security/performance tradeoff? What SSH server are you using? Which algorithms are you currently offering? Which ones are actually being negotiated by the clients?
Mar
22
comment How to solve problematic cpu load due to encryption when using SFTP on a VM
Kiwy: I don’t see why using FTPS (FTP with TLS) would be “lighter.” TLS uses similar mechanisms to encrypt bulk data with well-known ciphers like AES, 3DES, etc., and will have similar performance characteristics (implementation differences aside).
Mar
22
comment apache poor performance with Kerberos Authentication
mod_auth_kerb supports two forms of HTTP authentication related to Kerberos: HTTP Negotiate using Kerberos tickets, and HTTP Basic, in which it verifies the user’s password against the KDC. You have then both enabled here. For “SSO,” as you say, you would normally be using Negotiate. That does not require the server to talk to the KDC at all. This is a fundamental design fact about Kerberos: a server does not need to contact a KDC to verify a ticket. This would only happen if you were using Basic (which is in fact very chatty, since it requires multiple Kerberos protocol messages).
Mar
21
revised How to reset Keytab for FreeIPA Server and Client
typo
Mar
20
answered How to reset Keytab for FreeIPA Server and Client
Mar
6
awarded  Editor
Mar
6
revised Kerberos Authentication for workstations not on domain
added 976 characters in body
Mar
6
answered Kerberos Authentication for workstations not on domain
Mar
6
comment Override SSH message when accessed via HTTP
Small amendment: you can in fact remove or change anything after "SSH-2.0-". Those are required by the SSH protocol; the rest of the string is a comment, not interpreted by the protocol. Note that if you do that, however, you may cause trouble for clients which identify server implementations in this way and turn on specific features or workarounds for known incompatibilities.
Mar
5
answered Why do kerberos HOWTOs specify to copy keytabs securely to the host? Is networked kadmin not secure?
Mar
5
answered setting kerberos ktpass ktab all that JAAS
Mar
5
comment REMOTE_USER variable without @DOMAIN suffix
It is important to note that these are not the same thing (although they have a similar effect in simple situations), and there is a security problem with the mod_map_user suggestion. See the answer I posted.
Mar
5
answered REMOTE_USER variable without @DOMAIN suffix
Mar
5
answered Apache SSO for a service that runs as local user
Mar
5
comment Some systems cannot connect to ldap via ldaps, but others can, is it the wildcard cert?
That was not clear to me when I read your post initially, though I see what you mean now. Anyway, the TLS debugging info you've added shows the problem; I've added an answer to follow up.
Mar
5
answered Some systems cannot connect to ldap via ldaps, but others can, is it the wildcard cert?
Mar
1
comment Some systems cannot connect to ldap via ldaps, but others can, is it the wildcard cert?
You mentioned three different client hosts. The one which is not working might have been unable to connect due to a networking issue while the others could.