[kitten] firewalls and cross realm trusts

["Nordgren, Bryce L -FS" <[e-mail]>]

I appreciate your patience in advance. :)

> Also, to use Kerberos outside the firewall would require configuring the
> firewall to permit DNS and Kerberos, which might be too difficult, and
> anyways might be considered risky (considering all that can be smuggled in
> DNS and Kerberos messages).

Please elaborate these issues within the context of cross-realm trusts and perhaps your pkcross draft. It seems like no matter where you are, you're always outside of somebody's firewall and DNS is not very mobility friendly.

In particular, I'm curious about the following: Say person A and laptop B belong to realm X. Person A and laptop B visit realm Y. Person A is the same, laptop B is the same, but laptop B's DNS entry (if it exists) is now issued by realm Y instead of X. Assume no firewalls and realms X and Y have a cross realm trust. Will laptop B be recognized by realm X even though its DNS is wrong? :) Can it, for instance, be an NFS client?

Now X and Y both have firewalls.  Say realms X and Y don't have a cross realm trust, but they both are pkcross friendly. Can pkcross + iakerb allow realm Y to contact realm X to validate person A and laptop B? Can pkcross concepts be used to eliminate the need for Y  to contact X? (e.g., A and B have been issued certificates signed by X, which has a certificate that Y would either trust or not, so why bother contacting a firewalled X?)

Bryce








This electronic message contains information generated by the USDA solely for the intended recipients. Any unauthorized interception of this message or the use or disclosure of the information it contains may violate the law and subject the violator to civil or criminal penalties. If you believe you have received this message in error, please notify the sender and delete the email immediately.