Re: [PATCH] http(s): automatically try NTLM authentication first
- From
Mantas Mikulėnas <grawity@gmail.com>
- Date
- Feb 23, 2017, 09:13 UTC
- Message-ID
- <d5375d24-cfdd-2348-84ae-b878c4aaa369@gmail.com>
- In-Reply-To
- <b152fad7e79046c5aa6cac9e21066c1c@exmbdft7.ad.twosigma.com>
On 2017-02-23 03:03, David Turner wrote:
Show 6 quoted lines
> Actually, though, I am not sure this is as bad as it seems, because gssapi > might protect us. When I locally tried a fake server, git (libcurl) refused to > send my Kerberos credentials because "Server not found in Kerberos > database". I don't have a machine set up with NTLM authentication > (because, apparently, that would be insane), so I don't know how to > confirm that gssapi would operate off of a whitelist for NTLM as well.
NTLM and Kerberos work very differently in that regard.
Kerberos is ticket-based so the client *first* has to obtain a ticket from the domain's KDC, so a malicious server at minimum needs to know what principal name to provide (i.e. which real server to try impersonating). And even if it does that, the ticket doesn't contain crackable hashes, just data encrypted with a key known only to the KDC and the real server. So the whitelist is only for privacy and/or performance reasons, I guess?
NTLM is challenge/response without any third party, and yes, it requires the application to implement its own whitelisting to avoid the security problems.
-- Mantas Mikulėnas <grawity@gmail.com>