From: David Schenz (schenz.9_at_DPS.OHIO-STATE.EDU)
Date: Fri, 10 Sep 2004 12:37:06 -0400 To: NTBUGTRAQ@LISTSERV.NTBUGTRAQ.COM
Two important points need to be remembered here: first, in order to join
a domain in the first place, NTLMv2 is still necessary (as the joining
member is not a part of the Kerberos realm), and second, windows
requires NTLMv2 to authenticate when opening a cif share via ip address.
Authentication falls back to NTLMv2 if Kerberos can't meet the following
1. A KDC service has to be available (i.e. a domain controller)
2. The host SPN must be registered
Evaluating the situation in discussion (assuming no implicit or explicit
trusts are setup i.e. the domains are in separate forests - remember
domains and trees are not security boundaries)..... User 1 in domain A
tries to authenticate to File Server 2 in domain B. User 1 will try to
authenticate against a domain A dc. Since no SPN is available for file
server 2 is registered on domain A's dc, the authentication will fall
back to NTLM. I'm certainly glossing over the finer details of Kerberos
here, but it gets the point across.
So yes, you're certainly right in that it is less secure. Unfortunately,
as currently designed, fallback to NTLMv2 is still necessary. I agree
that legacy support in Windows needs to be disabled by default. Too
often the trade off has been chosen in favor of compatibility over
security (causing many of Microsoft's security issues.
NTBugtraq Editor's Note:
Want to reply to the person who sent this message? This list is configured such that just hitting reply is going to result in the message coming to the list, not to the individual who sent the message. This was done to help reduce the number of Out of Office messages posters received. So if you want to send a reply just to the poster, you'll have to copy their email address out of the message and place it in your TO: field.