<html>
<head>
<meta content="text/html; charset=ISO-8859-1"
http-equiv="Content-Type">
</head>
<body bgcolor="#FFFFFF" text="#000000">
On 07/12/2013 05:36 PM, Erinn Looney-Triggs wrote:
<blockquote cite="mid:51E076C3.50201@gmail.com" type="cite">
<pre wrap="">On 07/12/2013 05:03 PM, Dmitri Pal wrote:
</pre>
<blockquote type="cite">
<pre wrap="">On 07/12/2013 11:33 AM, Erinn Looney-Triggs wrote:
</pre>
<blockquote type="cite">
<pre wrap="">GSSAPI inside of a TLS channel apparently isn't secure unless the
channel is secure and verified. The irony being that GSSAPI auth outside
of a TLS connection is just fine for postfix.
</pre>
</blockquote>
<pre wrap="">
Is this really the case? I am under the impression that Kerberos is
secure enough outside of the TLS tunnel and this is would be just a
precaution rather than a security measure.
</pre>
</blockquote>
<pre wrap="">
I'll be honest, I doubt I am smart enough/ have enough time to figure
all this out. However, this is via a user on the Postfix mailing list:
"GSSAPI inside TLS currently does not perform channel binding, and
so your session can be hijacked, after the client authenticates
with GSSAPI. You can use "fingerprint" security if your server
certificate is not signed by a usable CA."
I asked for some more details and got this back:
<a class="moz-txt-link-freetext" href="https://tools.ietf.org/html/rfc5056">https://tools.ietf.org/html/rfc5056</a>
It sounds to me like this is Postfix specific. But again I don't know
all of the nuances of this, and security on this level can be very nuanced.
Now whether this fellow who gave this information to me is the designer
of TLS in Postfix or just some other poor schlub like myself I can't
say. But it certainly appears like it could be a problem.
-Erinn</pre>
</blockquote>
<br>
OK, makes sense. Thanks for clarifying.<br>
<br>
<blockquote cite="mid:51E076C3.50201@gmail.com" type="cite">
<pre wrap="">
</pre>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
Freeipa-users mailing list
<a class="moz-txt-link-abbreviated" href="mailto:Freeipa-users@redhat.com">Freeipa-users@redhat.com</a>
<a class="moz-txt-link-freetext" href="https://www.redhat.com/mailman/listinfo/freeipa-users">https://www.redhat.com/mailman/listinfo/freeipa-users</a></pre>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
Thank you,
Dmitri Pal
Sr. Engineering Manager for IdM portfolio
Red Hat Inc.
-------------------------------
Looking to carve out IT costs?
<a class="moz-txt-link-abbreviated" href="http://www.redhat.com/carveoutcosts/">www.redhat.com/carveoutcosts/</a>
</pre>
</body>
</html>