Strong Auth Index Page | Presentation Outline
PREV NEXT

Introduction to Strong Authentication
at Fermilab

What is Strong Authentication?

Strong authentication is a system of verifying the identities of networked users, clients and servers without transmitting passwords over the network. It does not require that the network be protected. Both parties in a connection must demonstrate knowledge of some "secret" to establish their identities.

What is Kerberos?

The Kerberos Network Authentication Service V5, developed at MIT, is the network authentication program that Fermilab has chosen to implement strong authentication. In addition to establishing identity (authentication), it supports encrypted network connections, thereby providing confidentiality.

The "heart" of a Kerberos installation is the Key Distribution Center (KDC). All the computers associated with a KDC make up what's called a strengthened realm. At Fermilab, the strengthened realm for UNIX machines is called FNAL.GOV. For Windows 2000, you will use FERMI.WIN.FNAL.GOV.

The KDC's main functions include:

Password-derived information is stored in the central KDC, but not passwords themselves.

Why has Fermilab implemented Kerberos authentication?

There have been several computer security breaches at Fermilab and other DOE facilities. Our funding agencies are requiring Fermilab to demonstrate that it is implementing a computer security system that exercises tight control over who uses the lab's computers and network.

What advantages does Kerberos have over other possible solutions?

What other advantages will you see?

How does Kerberos work?

Here is a sample scenario for a Windows desktop user:

  1. User logs into Windows desktop computer on which Kerberos-aware software has been installed. User requests authentication. Entry of Kerberos password is required.
  2. Password is used to derive a key to encrypt the exchanges between local host and KDC, but is not transmitted between them.
  3. Upon authentication, user gets "ticket" from KDC.
  4. User can now connect over the network to other strengthened hosts without typing a password again. By forwarding tickets when logging into remote host, the user can do all of the following without typing a password:
    • connect from one remote strengthened host to another
    • obtain AFS tokens
    • ksu to other accounts as permitted

If local machine does not have Kerberos-aware software, user connects to remote strengthened host over the network using a CRYPTOCard to provide a non-reusable password for authentication.

Fermilab Strong Authentication Policy

As of the end of 2001, Kerberos V5 is implemented on virtually all the computers at Fermilab. Our working definition of computer , as regards strong authentication, is: "any machine to which you can log in, and on which you can run arbitrary code".

On-site Machines

Kerberos authentication is currently not required for:

All other network accesses to computers on the Fermilab site must be preceded by Kerberos V5 authentication if the access is comparable to login or FTP service.

Currently, Windows desktop systems (W2K, NT4, Win95/98) must run Kerberos-aware software to access Kerberized UNIX resources. If your W2K desktop is in the W2K domain, you must use your FERMI.WIN.FNAL.GOV Kerberos password at login. Otherwise, the Windows desktops themselves do not require Kerberos authentication as long as they don't support remote login over the network. The NT4 domain resources will not be Kerberized until they get migrated to the W2K domain. What's status of NT4 resource migration??

After users and resources migrate from the Windows NT domain to the Windows 2000 (W2K) domain, things change. We'll discuss this at end of talk.Fix after last chapter is fixed

Furthermore, an on-site system may not be configured to prompt for or accept a reusable login password over the network.

This is typically not an issue for Windows desktop machines.

Off-site Machines

Off-site computers participating in Fermilab's strengthened realm must enforce secure access mechanisms, but they are not required to use Kerberos V5. (Refer to manual section 2.2 Authentication Guidelines for On-site vs. Off-site Machines.)

DHCP works fine: If you get tickets under one address and then get a new address, you need to reobtain tickets.

NAT can be a problem (see http://www.fnal.gov/docs/strongauth/html/offsite.html#60786).

If your machine is in a different domain (not fnal.gov), you may have to tweak your configuration. Fermi Kerberos is built to look for domains in DNS.

Documentation and References

PREV NEXT
Strong Auth Index Page | Presentation Outline