Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Oh, wait, that was Randal...nevermind... -- Larry Wall in <199709261754.KAA23761@wall.org>


devel / comp.protocols.kerberos / Re: kfw-4.1: ms2mit in virtual setups?

SubjectAuthor
o Re: kfw-4.1: ms2mit in virtual setups?Greg Hudson

1
Re: kfw-4.1: ms2mit in virtual setups?

<mailman.1.1631940640.2760.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=142&group=comp.protocols.kerberos#142

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: ghud...@mit.edu (Greg Hudson)
Newsgroups: comp.protocols.kerberos
Subject: Re: kfw-4.1: ms2mit in virtual setups?
Date: Sat, 18 Sep 2021 00:50:33 -0400
Organization: TNet Consulting
Lines: 11
Message-ID: <mailman.1.1631940640.2760.kerberos@mit.edu>
References: <66D74D06-DA25-4B49-9CB5-2A74ED7A412C@gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 8bit
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="19354"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Thunderbird/78.11.0
To: John Devitofranceschi <foonon@gmail.com>, <kerberos@mit.edu>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=IZZLYjfRhBaXWOC/qoNydjiloZHSX2rtn3XzEAFYCSF0YSEVkitO2ooV/ZDKPaIaqeBglkGJlwxQTgdWJYLWFvU7Xn2JQCIrqZhHxRhOzKNR1ZgMHumkOkYDttsLoSU3F2i1T1jFyOA8TIV5qSlO9quu5c0MBvSxme8fIPJ2oqQNZ8ULGSxajru7+G5atJVabiWgH+AHGt/9bQO3HWEbwc2qAO1RaQBY6pPK2VAA1Lrnzw3+tpVLJRvFl77DysAH+BfPjNdn018FM3EXM//8/jUNkHmI5r2PyiCh7IFZ3RoQH/gfrJSpLSDR5ZVZUMqwnK+BvBnCBKfjDocgnr4gww==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version;
bh=PkgpVqazyyzHhEdZBizbE8XMH8cmIxW0qfDNZhl+QDw=;
b=WqkHiwRoN9HsZyn1eiWZX85RXQ9dOkm3IvyzAP0jq0ZiTdagNHcz7I5eBLAiV1i8hNVEKYhsGepIyajsvf0t9Up0sGCYL+ge0BcUUYNa0VX0RYrSggr/yoI5eHB/cEeX6LQuoYQ/aDe5VTdYN9DC8iNUsbh8xp8IzcEHMzKZld6KzyvJfnibipy6Pd4dCOo5oxg4gxTUybZWQVj8IRN3I1Yv5BEGk997apj9ywIFDliPbhlPn8okIwooBdDLkrf+u6iaCZDVFBZtf8erJZKjjc0MNxFfCekJ7QECWN7LmPwK3TC10lRs5Mrpr3wsu4DXD5q7IyW04YcOY2BIonaaXg==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=mit.edu; s=selector2;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=PkgpVqazyyzHhEdZBizbE8XMH8cmIxW0qfDNZhl+QDw=;
b=BpSQsfokORSegsiBvohhZ8EGWJaqIvE3wOVSAylzL0JUF2yBW7nTJD0XOZguZHM1RjZEGhEwdLDg64ng4kDDWipPcmJBxM3DwSusNTnCB+WsH7AG9Rm+9wmqrUlBbPnQID/RxnxcLiwldXmyrm3XUfjRTjTz1mnap0cK8a01TOM=
Authentication-Results: spf=pass (sender IP is 18.9.28.11)
smtp.mailfrom=mit.edu; mit.edu; dkim=none (message not signed)
header.d=none; mit.edu;
dmarc=bestguesspass action=none header.from=mit.edu;
Received-SPF: Pass (protection.outlook.com: domain of mit.edu designates
18.9.28.11 as permitted sender) receiver=protection.outlook.com;
client-ip=18.9.28.11; helo=outgoing.mit.edu;
In-Reply-To: <66D74D06-DA25-4B49-9CB5-2A74ED7A412C@gmail.com>
Content-Language: en-US
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: 32e31d96-15d1-4399-3b71-08d97a5fdac0
X-MS-TrafficTypeDiagnostic: SN6PR01MB5071:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SN6PR01MB50713E2914D77AFABE46A338BCDE9@SN6PR01MB5071.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:8273;
X-MS-Exchange-SenderADCheck: 1
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: uDLIi3VNkzqOogd4WOtOLKv6q8x2ed2u2bhB4jBuzkka2Zjp2idwJIZnX87/MBn5z/fapBtZ9fEoEywccbf1GN0Xn9jJgX7J4Sf9bRZfKWKvK7rzJo4IgMj1nFTN6HHEqkYdOCLtHEp71kkVVWtBdwjCiSxQG7hXlMxMdvqXWiejRnUddMR7GQEiKE401dDcFkTjS/jivYJihU6N7lKV9/YXzb/Te24VMIExQ5BcsMyV/sP7YR4bX/ipjSpk5+3SG/CZlWebZAg304oeVzSWGgMBVR2LtB+5is133nsnPryKPlm8mCEVfgmZDydZ+KBMSLC9Ung7SACrz/F5xTeIQNyFXM/hqlvJppYVqofrAUbP7TlQNOtASi7YdMwXJGp+d6ZCfFZqixflcqfl7xVLifNSCOB1ikzwKGmF4XTMVWbJeizNLcwxNzcZaQHF1fhSeaMNJbLFe9pOyVJdds4ssCW+HlMRpFQtjIP8ihNsHUhd8rOipUG0R/ZYahhktnH2JJlgzeEzEjHoCG0MwQtWnbvWGvYOl8MmG4fX/XQ5gGi5a1S7ZhVi8RP4kWNz06tdHGVkfasPlGlvz6WbvmQBYS1ayGBCWRweElc+U+iKIwG1LR3W25W09RxgRUTrSTjGSSacB+UuG0DjRtxol5+Ji4tg6NH4/oVIsrLKZirlOOh5MRsh/JA9KwZipRu6j1khe/0OVSLI7uKyQcBa8NYO2VoC3iUL6JczZx+bzqpb4LjGIahuS47pba/nVxDmrs4SlQmZd1J8+ytO7Ym/x+62lDP7f36Kdx5wFY7cNv8vLEorEacqRQbHhXSeNhYzL/+aq/wTa4xULwrUSUZc18pOIg==
X-Forefront-Antispam-Report: CIP:18.9.28.11; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:CAL; SFV:NSPM; H:outgoing.mit.edu;
PTR:outgoing-auth-1.mit.edu; CAT:NONE;
SFS:(4636009)(136003)(346002)(396003)(376002)(39860400002)(26005)(68406010)(8676002)(6636002)(2616005)(478600001)(966005)(86362001)(31686004)(336012)(956004)(7696005)(5660300002)(53546011)(426003)(83380400001)(70586007)(2906002)(4744005)(75432002)(6706004)(316002)(36756003)(31696002)(356005)(43740500002);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 18 Sep 2021 04:50:35.8769 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: 32e31d96-15d1-4399-3b71-08d97a5fdac0
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: BN8NAM11FT035.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR01MB5071
X-OriginatorOrg: mit.edu
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Greg Hudson - Sat, 18 Sep 2021 04:50 UTC

On 9/17/21 5:14 PM, John Devitofranceschi wrote:
> I can see that “AllowTGTSessionKey” is set to ‘1’ in the virtual registry. Is that not sufficient? Any way around this?

The current documentation of AllowTgtSessionKey says: "With active
Credential Guard in Windows 10 and later versions of Windows, you cannot
enable sharing the TGT session keys with applications anymore." That's
from:
https://docs.microsoft.com/en-us/troubleshoot/windows-server/windows-security/kerberos-protocol-registry-kdc-configuration-keys

There's more on Credential Guard at:
https://docs.microsoft.com/en-us/windows/security/identity-protection/credential-guard/credential-guard

1
server_pubkey.txt

rocksolid light 0.9.8
clearnet tor