Ensure the KDC does not support DES, 3DES or RC4 encryption types

VisokaNivo 1Automatskakerberos

Opis

DES and RC4-HMAC (arcfour) keys are crackable and des3-cbc-sha1 is deprecated; principals created with them weaken every ticket. The audit checks the MIT KDC configuration (/etc/krb5kdc/kdc.conf on Debian/Ubuntu, /var/kerberos/krb5kdc/kdc.conf on RHEL) and fails if supported_enctypes or master_key_type names a des, des3, rc4 or arcfour type. When unset, MIT defaults to AES only.

Kako se proverava

Metod provere: Komanda ljuske

shell

n=0; bad=0
for f in /etc/krb5kdc/kdc.conf /var/kerberos/krb5kdc/kdc.conf; do
  [ -f "$f" ] || continue
  n=$((n+1))
  grep -Eiq '^[[:space:]]*(supported_enctypes|master_key_type)[[:space:]]*=.*(des|rc4|arcfour)' "$f" && { echo "$f lists weak enctypes"; bad=1; }
done
[ "$n" -gt 0 ] && [ "$bad" -eq 0 ] && echo compliant

Očekivani izlaz: compliant

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

In each [realms] entry of kdc.conf set supported_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal (add aes256-cts-hmac-sha384-192:normal on 1.15+). Restart krb5kdc and kadmind, then rekey affected principals (kadmin: cpw -randkey / change password) so old DES/RC4 keys are removed; rekeying krbtgt requires planning.

Svojstva

Operativni sistemi: Bilo koji
Oznake: kerberoskdccrypto
Referenca: CIS MIT Kerberos / Linux Benchmark guidance - Strong Kerberos encryption types (verify section number for your release)

Proverite ovaj računar

Pokrenite ovo na računaru za koji imate dozvolu za proveru. Skeniranje radi u režimu samo za čitanje.

shell

tmaegis scan --target kerberos