Re: [kitten] I-D Action: draft-ietf-kitten-iakerb-01.txt

[Nico Williams <[e-mail]>]

On Fri, Feb 14, 2014 at 5:47 PM, Nordgren, Bryce L -FS
<[e-mail]> wrote:
> "Remote access" to me means "outside the firewall of the organization operating the KDC, which is not exposed to the public internet." What you appear to be talking about is authenticating to an access point which is operated by the same entity which operates the KDC?
>
> So the big question is: if an organization is hiding their KDC behind a firewall, or they just haven't configured their access points to use the KDC as a back end, how is a proxy easier to implement or more secure than just configuring access thru their firewall or access point? Or really how does providing 1000 routes to the KDC thru any public-facing, Kerberos-authenticated service (nfs, web apps, ssh...) beat just opening up port 88 to the wide world?
>
> Not trying to be a pita, just not seeing it yet...

The remote access protocol might not be able to allow any traffic
other than EAP until the user is authenticated.

Also, to use Kerberos outside the firewall would require configuring
the firewall to permit DNS and Kerberos, which might be too difficult,
and anyways might be considered risky (considering all that can be
smuggled in DNS and Kerberos messages).

Nico
--