Rocksolid Light

Welcome to novaBBS (click a section below)

mail  files  register  newsreader  groups  login

Message-ID:  

Perfection is achieved only on the point of collapse. -- C. N. Parkinson


devel / comp.protocols.kerberos / Re: 2FA with krb5

SubjectAuthor
o Re: 2FA with krb5Russ Allbery

1
Re: 2FA with krb5

<mailman.6.1633634215.13936.kerberos@mit.edu>

  copy mid

https://www.novabbs.com/devel/article-flat.php?id=166&group=comp.protocols.kerberos#166

  copy link   Newsgroups: comp.protocols.kerberos
Path: i2pn2.org!i2pn.org!weretis.net!feeder6.news.weretis.net!tncsrv06.tnetconsulting.net!.POSTED.pch.mit.edu!not-for-mail
From: eag...@eyrie.org (Russ Allbery)
Newsgroups: comp.protocols.kerberos
Subject: Re: 2FA with krb5
Date: Thu, 07 Oct 2021 12:16:29 -0700
Organization: The Eyrie
Lines: 11
Message-ID: <mailman.6.1633634215.13936.kerberos@mit.edu>
References: <5ee92454-ec38-d5de-5b36-4b2d87fd7f@prime.gushi.org>
<202110070127.1971R4KA032759@hedwig.cmf.nrl.navy.mil>
<87pmsgpt36.fsf@hope.eyrie.org>
<202110071914.197JEXTD007325@hedwig.cmf.nrl.navy.mil>
Mime-Version: 1.0
Content-Type: text/plain
Injection-Info: tncsrv06.tnetconsulting.net; posting-host="pch.mit.edu:18.7.21.50";
logging-data="5424"; mail-complaints-to="newsmaster@tnetconsulting.net"
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/27.1 (gnu/linux)
Cc: kerberos@mit.edu
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
ARC-Seal: i=1; a=rsa-sha256; s=arcselector9901; d=microsoft.com; cv=none;
b=Fd4S5LfPgeqDsEl25ztRd+zLKHsZtT4VNEuiiFpZyuxEx2Rbz+lCCXsDJ4xHpHSNTTzXbJL4ZPtoOJrUlGxMbjcOjNxdeAhI/mO7QOyOl/g6rJmI3otrj/9lHf/E+n9eiO5cAiFPWzcnCyn3xktzFCsFkcBbTR8Ru3brJrk+q03mHDiMDjZaMupM1JSYvM95w+++OSKKhHVWQ1rAW9Y6yzu1WrB/LaOQ23uIvBJxTwRNbckBMWTSCh35K1KUjpza/Giwlkdz9hwG1rKjEeU/e06/2TLSPUgX2iYANS7MBEFQReFpwtXYfXWdeug8wfpj8h/EKtABvEhbJkCsaU8Vjg==
ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com;
s=arcselector9901;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1;
bh=GLNYdQsZk62SeEVxccga9EtDDWCPVzMrKXEF+eKYipI=;
b=VM6apYvyBeWRbmNPQLwL6ay37dB29ItolxibNZwQgbQaKiuZoJuTlQkDSd9QUTtqG97+M69z1Z3i4lE0jrhLBBz6Shov4fk9vUDP9/+l7K8jHGqarEDpxwgKlPsbhmN5hkUZ7YUSdtSKMY6oomfXcq+6z3hfvGYgKKAkMCIu4q75xhDeG299xRtg+WdNygo6Ub7jwK1SNf9ic+nKoYfB2t2dDQykB948j1YEQFc71ECFJyStA4vhUC3HzRwVJD9Lkt/FeM1O/M33XKx1mLIdpxF5NBCxJFq7mMw+bEEeTPt4KjhFg/nC0kuBkNj2Nxp8BzAG0tiwrC0CMVNKuJjM4Q==
ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=none; dmarc=none;
dkim=none; arc=none
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;
d=mitprod.onmicrosoft.com; s=selector2-mitprod-onmicrosoft-com;
h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck;
bh=GLNYdQsZk62SeEVxccga9EtDDWCPVzMrKXEF+eKYipI=;
b=hPvy6EhG1jpzFi0k5pMXaIvVAp1WLlPEAriR5+Eo1kaGeoI1iYrStVVkG5yaQujPRowiZQTmmzLO05ZU0DMj83V7AoDvZv/3enFzIt8lYmIsYTWSxOclH2sxzdV/fLoWup1+dhoI+5dOUxgh57phk8TtI+5GGmmdE7RpIPugqIc=
Authentication-Results: spf=pass (sender IP is 166.84.7.159)
smtp.mailfrom=eyrie.org; mit.edu; dkim=none (message not signed)
header.d=none; mit.edu;
dmarc=bestguesspass action=none header.from=eyrie.org;
Received-SPF: Pass (protection.outlook.com: domain of eyrie.org designates
166.84.7.159 as permitted sender) receiver=protection.outlook.com;
client-ip=166.84.7.159; helo=haven.eyrie.org;
In-Reply-To: <202110071914.197JEXTD007325@hedwig.cmf.nrl.navy.mil> (Ken
Hornstein's message of "Thu, 07 Oct 2021 15:14:33 -0400")
X-EOPAttributedMessage: 0
X-EOPTenantAttributedMessage: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b:0
X-MS-PublicTrafficType: Email
X-MS-Office365-Filtering-Correlation-Id: e0ae850c-3993-4559-811b-08d989c6f8fe
X-MS-TrafficTypeDiagnostic: SN6PR01MB4831:
X-LD-Processed: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b,ExtAddr
X-MS-Exchange-AtpMessageProperties: SA
X-Microsoft-Antispam-PRVS: <SN6PR01MB483199D28DA1A5948C4538E9A6B19@SN6PR01MB4831.prod.exchangelabs.com>
X-MS-Oob-TLC-OOBClassifiers: OLM:5797;
X-MS-Exchange-SenderADCheck: 0
X-MS-Exchange-AntiSpam-Relay: 0
X-Microsoft-Antispam: BCL:0;
X-Microsoft-Antispam-Message-Info: gomPvoz2lWp4nuG+O2hXA7oO5hae0zrXRkPZB5mXB7g0SkWjLh25bTV4LyTYib7Uh/bS6XrAEmm/HHqhYpl4nY4ngvSX4FnxhoROj+SV5uqucSi8uw/xcxZF3IqjGkcDulxFsA/jqDrMd3wSRDH7l7PTSb9XU1SU9r2NKk5j71z8gmxf1IpdHxWSxlsAUoub6fxdbaaiw13CCfutk8XwKSHfB+l0kU/i9dEZk7lhvRxYSYYqWT7el+PFIP8OMPililRHOC5CNw5FJxj3xGvnU7J8gNjqw5o912Aj7hDC8NBz3iL3MAEECMY5YPh/HG8ocgdN8rw2C3uNM/AFMcTCPGimEIwuxnXnMhKt+Xj0htfj757X0o4qgHHiaeUKtjOt8ZyI9U/CRqCM6rPsSnDpxpoBnAyWrXE59vL85AZNetedDKzrNCU92mSWWaW8Mc0APdQCMEYjAO6nr7IcMUZ8eGlYlY9Zn+cH0NQZad+0q/iw9V59RXoN9/EMudULJJ2bbPdfirTMcCm6dLfYDA4f/kKnIiEjGs8yeSLJ8WZ2SJUaKOgO+8axek7qBrIGh0y99ZjPOSJXMbka0kkYCL0iFk1vUA5P8uqQ4l4bw0N+iaYZaOZ0wpyxqd2KYCOi9zYkWk2D7JuCiKDf5lr1ljhHw8W0cOSrMEr6HWScdQmqwJ/RwLcFy72UQW9Dp7lUXtBH
X-Forefront-Antispam-Report: CIP:166.84.7.159; CTRY:US; LANG:en; SCL:1; SRV:;
IPV:NLI; SFV:NSPM; H:haven.eyrie.org; PTR:haven.eyrie.org;
CAT:NONE;
SFS:(4636009)(6862004)(2160300002)(4326008)(6266002)(68406010)(70586007)(36916002)(7636003)(7596003)(316002)(426003)(786003)(508600001)(5660300002)(86362001)(8676002)(42186006)(4744005)(26005)(2906002)(356005)(336012);
DIR:OUT; SFP:1102;
X-Auto-Response-Suppress: DR, OOF, AutoReply
X-MS-Exchange-Transport-Forked: True
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Oct 2021 19:16:32.1845 (UTC)
X-MS-Exchange-CrossTenant-Network-Message-Id: e0ae850c-3993-4559-811b-08d989c6f8fe
X-MS-Exchange-CrossTenant-Id: 64afd9ba-0ecf-4acf-bc36-935f6235ba8b
X-MS-Exchange-CrossTenant-AuthSource: DM6NAM11FT003.eop-nam11.prod.protection.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Anonymous
X-MS-Exchange-CrossTenant-FromEntityHeader: Internet
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SN6PR01MB4831
X-OriginatorOrg: mitprod.onmicrosoft.com
X-BeenThere: kerberos@mit.edu
X-Mailman-Version: 2.1.6
Precedence: list
List-Id: The Kerberos Authentication System Mailing List <kerberos.mit.edu>
List-Unsubscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=unsubscribe>
List-Archive: <http://mailman.mit.edu/pipermail/kerberos>
List-Post: <mailto:kerberos@mit.edu>
List-Help: <mailto:kerberos-request@mit.edu?subject=help>
List-Subscribe: <https://mailman.mit.edu/mailman/listinfo/kerberos>,
<mailto:kerberos-request@mit.edu?subject=subscribe>
 by: Russ Allbery - Thu, 7 Oct 2021 19:16 UTC

Ken Hornstein <kenh@cmf.nrl.navy.mil> writes:

> Huh, I _kinda_ thought that if you had FAST going, you got FAST OTP (on
> the client at least) for free! Which shows what I know. Maybe it works
> already and you never tested it?

The bit that I suspect doesn't work is all the interactions between the
prompting and the prompt control options like use_first_pass.

--
Russ Allbery (eagle@eyrie.org) <https://www.eyrie.org/~eagle/>


devel / comp.protocols.kerberos / Re: 2FA with krb5

1
server_pubkey.txt

rocksolid light 0.9.81
clearnet tor