Subject: Password sync question

From: "Boza, Tom" <[email-masked]>
Date: Mon, 10 Sep 2001 14:00:05 -0700

Can Kerberos by used for password synchronization between Unix systems and
Windows Active Directory servers, similar to Microsoft's SFU (services for
unix) application?

Thanks, Tom...
Intel Corp. ITGE Unix Engineering
Chandler Arizona USA
Office: 480.554.4387  Pager: 602.201.0941

---

From: Nicolas Williams <[email-masked]>
Date: Mon, 10 Sep 2001 17:27:26 -0400

Well, that's an implementation specific question. Technically, the
answer is "yes" because most implementations require that the KDC get
the new password in cleartext (not the string2key() of it) of a user
changing her password.

But not all implementations provide a standard hook to get at the new
passwords...  I have made a modification to MIT's kadmind to support
password synchronization from MIT KDCs to any kind of system for which
you can script the sync. I've not posted patches.

Cheers,

Nico

--
-DISCLAIMER: an automatically appended disclaimer may follow. By posting-
-to a public e-mail mailing list I hereby grant permission to distribute-
-and copy this message.-

Visit our website at http://www.ubswarburg.com

This message contains confidential information and is intended only 
for the individual named.  If you are not the named addressee you 
should not disseminate, distribute or copy this e-mail.  Please 
notify the sender immediately by e-mail if you have received this 
e-mail by mistake and delete this e-mail from your system.

E-mail transmission cannot be guaranteed to be secure or error-free 
as information could be intercepted, corrupted, lost, destroyed, 
arrive late or incomplete, or contain viruses.  The sender therefore 
does not accept liability for any errors or omissions in the contents 
of this message which arise as a result of e-mail transmission.  If 
verification is required please request a hard-copy version.  This 
message is provided for informational purposes and should not be 
construed as a solicitation or offer to buy or sell any securities or 
related financial instruments.

---

From: "Tim Bass" <[email-masked]>
Date: Mon, 10 Sep 2001 17:44:14 -0400

No.  Kerberos cannot be used for password synchronization
between UNIX platforms and W2K/AD or between any
plaforms.  Kerberos is not a 'password synchronization'
protocol.

Finest Regards, Tim

www.silkroad.com

---

From: Matt Crawford <[email-masked]>
Date: Tue, 11 Sep 2001 11:01:24 -0500

> Windows Active Directory servers, similar to Microsoft's SFU (services for

If you mean, can Kerberos help me make it so changes in my unix
password are reflected in windows and vice-versa, the answer is no.

If you mean, can I use Kerberos for a single authentication authority
for logging into unix and windows 2000 systems, the answer is yes.

---

From: "Booker C. Bense" <[email-masked]>
Date: Tue, 11 Sep 2001 19:10:30 -0700 (PDT)

> password are reflected in windows and vice-versa, the answer is no.

- Well, we'd like the answer to be no, but in fact kerberos is
extremely useful in doing such things. There is code on the
MS web site that allows you to change AD passwords from unix
machines. It uses kerberos to do this securely.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnw2k/html/kerberossamp.asp

- I could go into this problem at much further length[1], but
this is not the correct forum.  I suggest you try

	[email-masked]

> for logging into unix and windows 2000 systems, the answer is yes.

- This is a much better solution. In general passwords should live
on KDC's and not in unix password files.

- Booker C. Bense

[1]- Going the other way is more complicated, but apparently
possible.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 12 Sep 2001 09:29:31 -0400

> password are reflected in windows and vice-versa, the answer is no.

The answer, actually, is yes.

The reason is: the password change / account create protocols used by
MIT, Heimdal (I think) and Microsoft, as well the change password
protocol being considered for standardization, ALL require that the KDCs
involved get the CLEARTEXT of all new passwords.

It is a very simple change to MIT's libkadm5srv to hook into the
password change / add_princ process and pass cleartext passwords to
external synchronization processes -- I have done this here.

Cheers,

Nico

---

From: "Tim Bass" <[email-masked]>
Date: Wed, 12 Sep 2001 10:21:16 -0400

I don't think people replying to this thread have had a chance to
view the internals of MS Active Directory and how the manage
user password in the AD environment.

According to MS, it is not possible for any non-MS product to
read or write passwords stored in AD.    Regardless of the threads
to the contrary,   there is no possibility of a UNIX based system to
write and change words in Active Directory according to MS.

Since 'password synchronization' is a process of 'sharing passwords
cross platforms' and since is is not possible to write or read PWs
outside of AD, then the PW-sync is not possible.

Using KV5 to create credentials (tickets) and sharing tickets in
a KV5 environment is not password synchronization (obviously),
it is Kerberos.

Finest Regards, Tim

www.silkroad.com

----- Original Message -----
From: "Nicolas Williams" <[email-masked]>
To: "Matt Crawford" <[email-masked]>; "Boza, Tom" <[email-masked]>
Cc: <[email-masked]>
Sent: Wednesday, September 12, 2001 9:29 AM
Subject: Re: Password sync question

> > for logging into unix and windows 2000 systems, the answer is yes.

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 12 Sep 2001 10:29:50 -0400

> user password in the AD environment.

You are referring to the AD object fields storing principals' keys.

You can, however, set password through the administrative interfaces.

Otherwise how would you create new principals or change their keys/passwords?

So yes, it is, in fact, possible to synchronize passwords *to* AD, and
it is, in fact, possible to synchronize *from* AD.

---

From: nshishir <[email-masked]>
Date: Wed, 12 Sep 2001 20:15:13 +0100 (BST)

> outside of AD, then the PW-sync is not possible.
	you are wrong. MS has a password sync tieup with cybersafe. 

Shishir.

---

From: "Booker C. Bense" <[email-masked]>
Date: Wed, 12 Sep 2001 07:51:16 -0700 (PDT)

> write and change words in Active Directory according to MS.

- VIA LDAP. Perhaps you should READ the actual documentation. There
is a published RFC that describes how to change a password in AD.

> outside of AD, then the PW-sync is not possible.

- Hey, I should get a raise. I've done not only the annoying, but
the impossible.

- Booker C. Bense

---

From: "Tim Bass" <[email-masked]>
Date: Wed, 12 Sep 2001 11:14:13 -0400

Thanks.  We will have our folks look into this.  We
were told different by MS in our client's architecture work
with MS Kerberos and AD engineers.

Thanks for the strong notes.

Finest Regards, Tim

www.silkroad.com

----- Original Message -----
From: "Booker C. Bense" <[email-masked]>
To: "Tim Bass" <[email-masked]>
Cc: "Nicolas Williams" <[email-masked]>; "Matt Crawford"
<[email-masked]>; "Boza, Tom" <[email-masked]>;
<[email-masked]>
Sent: Wednesday, September 12, 2001 10:51 AM
Subject: Re: Password sync question

---

From: Matt Crawford <[email-masked]>
Date: Wed, 12 Sep 2001 10:37:30 -0500

> > > Can Kerberos by used for password synchronization between Unix
> > > systems and Windows Active Directory servers, similar to
> > > Microsoft's SFU (services for unix) application?

> involved get the CLEARTEXT of all new passwords.

I still say that's a "no" because in my lexicon, "unix password"
means the thing you find hashed into /etc/passwd, /etc/shadow, or
wherever.  I would not like to see someone putting the hash of the
Kerberos password into such a vulnerable location.

But I agree with others who say we're wasting the WG's bandnarrowness
with this topic.

---

From: Nicolas Williams <[email-masked]>
Date: Wed, 12 Sep 2001 12:04:32 -0400

Come now, clearly you need the cleartext Unix password. There are always
places where you can hook -- MIT's krb5 has one such place (though you
have to hack it); MS's AD has such a hook, PAM provides a hook for more
traditional Unix systems, etc...

Nico