freeipa

#9031 Harden FreeIPA KDC processing of PAC buffers
Closed: fixed by abbra. Opened by abbra.

Closed: fixed
Reopen Issue

Implement suggestions outlined in https://www.samba.org/samba/security/CVE-2020-25721.html

In order to avoid issues like CVE-2020-25717 AD Kerberos accepting
services need access to unique, and ideally long-term stable
identifiers of a user to perform authorization.

The AD PAC provides this, but the most useful information is kept in a
buffer which is NDR encoded, which means that so far in Free Software
only Samba and applications which use Samba components under the hood
like FreeIPA and SSSD decode PAC.

Recognising that the issues seen in Samba are not unique, Samba now
provides an extension to UPN_DNS_INFO, a component of the AD PAC, in a
way that can be parsed using basic pointer handling.

From this, future non-Samba based Kerberised applications can easily obtain
the user's SID, in the same packing as objectSID in LDAP, confident
that the ticket represents a specific user, not matter subsequent
renames.

This will allow such non-Samba applications to avoid confusing one
Kerberos user for another, even if they have the same string name (due
to the gap between time of ticket printing by the KDC and time of
ticket acceptance).

Implement PAC_UPN_DNS_INFO_EX, PAC_ATTRIBUTES_INFO, PAC_REQUESTER_SID, and other hardening improvements as suggested by Samba Team and Microsoft.

Additional information:
Microsoft: https://support.microsoft.com/en-us/topic/kb5008380-authentication-updates-cve-2021-42287-9dafac11-e0d0-4cb8-959a-143bd0201041
Samba Team: https://www.samba.org/samba/latest_news.html#4.15.2

PR: https://github.com/freeipa/freeipa/pull/6076

Metadata Update from @abbra:
- Custom field on_review adjusted to https://github.com/freeipa/freeipa/pull/6076

master:

  • 6cfb9b7193aeb87e372af42e1d589486625ee34e ipa-kdb: store SID in the principal entry
  • 637653a53339435f26b57058f4ad3f22b5855c31 ipa-kdb: enforce SID checks when generating PAC
  • 443a99060cfe78c8ad907775a400db1c0580582d ipa-kdb: use entry DN to compare aliased entries in S4U operations
  • 6828273b562947b63459f7276c78d6de76a21022 ipa-kdb: S4U2Proxy target should use a service name without realm
  • 23336160f21611942512e7b1996051d34817873d ipa-kdb: add support for PAC_UPN_DNS_INFO_EX
  • 9a0bcbbe82aec0bde30c34ef62320820cd7c0a76 ipa-kdb: add support for PAC_REQUESTER_SID buffer
  • 0022bd70d93708d325855d5271516d6cd894d6e8 ipa-kdb: add PAC_ATTRIBUTES_INFO PAC buffer support
  • 3042a1d544b479ee0372f8d8ebcccce0b4a1ba3e ipa-kdb: Use proper account flags for Kerberos principal in PAC
  • 6e6fad4b762f426f967106a5a335302ead8e3982 SMB: switch IPA domain controller role

ipa-4-9:

  • 9ded98b66ed62a2edc7b27c02e0b94a6e6fa8ae9 ipa-kdb: store SID in the principal entry
  • 9ecbdd8e5968b1b4033bedb90fccdd0f05720b40 ipa-kdb: enforce SID checks when generating PAC
  • eb5a93ddbe0ab17c36d5c78e5c0fcf020745484a ipa-kdb: use entry DN to compare aliased entries in S4U operations
  • 8b5e496101963c7059fac2a4a5c8b5e15ad9f726 ipa-kdb: S4U2Proxy target should use a service name without realm
  • 4cafdac1dfbd95087c3d0510cbf2638fc31c4d94 ipa-kdb: add support for PAC_UPN_DNS_INFO_EX
  • 879ef1b1a69ed187fcfa8fff007ab95ec72a1a65 ipa-kdb: add support for PAC_REQUESTER_SID buffer
  • b71467e2fe5942688d2d988999340ef398b97a29 ipa-kdb: add PAC_ATTRIBUTES_INFO PAC buffer support
  • adf5ab7344b810106cb4b493c798af597d14a080 ipa-kdb: Use proper account flags for Kerberos principal in PAC
  • 693c165ce83df9e21a4928cde64bdea9f997d1a6 SMB: switch IPA domain controller role

master:

  • 4062e7b963bbc23fc6ed908e94c4a0747712905a ipa-kdb: honor SID from the host or service entry
  • 0c08faf3c1881661723a03b7ce7abce25147974c ipa-kdb: validate domain SID in incoming PAC for trusted domains for S4U

ipa-4-9:

  • a95ccd908f9e04375380f5dba1110f6c55a93638 ipa-kdb: honor SID from the host or service entry
  • 5213c1e42cdedf4a862bf7173d7c632d0c1460b5 ipa-kdb: validate domain SID in incoming PAC for trusted domains for S4U

master:

  • aed5fd871abe90b39bd0795a9ead6b346fba4753 freeipa.spec.in: -server subpackage should require samba-client-libs

ipa-4-9:

  • c850cd52dcee8d2e5107af5ddf33e79b4e33527f freeipa.spec.in: -server subpackage should require samba-client-libs

Metadata Update from @abbra:
- Custom field changelog adjusted to FreeIPA now implements PAC structure hardening as coordinated with Samba Team and Microsoft in CVE-2020-25719 and CVE-2021-42287 correspondingly.

Metadata Update from @abbra:
- Issue tagged with: rfe

master:

  • bda59110f172231a5b123d1259ade943c9df5428 ipa-kdb: issue PAC_REQUESTER_SID only for TGTs
  • 637412acfd20eaa9e741db7a5d548d6daa14aebd ipa-kdb: fix requester SID check according to MS-KILE and MS-SFU updates

ipa-4-9:

  • 669f3d71161741c676ddd6a08bd08d4a4ccd495b ipa-kdb: issue PAC_REQUESTER_SID only for TGTs
  • 7d93bda31ce0b4e0e22c6e464c9138800dcf8b1c ipa-kdb: fix requester SID check according to MS-KILE and MS-SFU updates

We are trying to get more consistent details from Microsoft documented in MS-KILE, MS-PAC, and MS-SFU specs. It looks like there's still a need to tune the settings when these buffers issued and verified.

I am closing this now that RBCD support is merged.

Metadata Update from @abbra:
- Issue close_status updated to: fixed
- Issue status updated to: Closed (was: Open)
Metadata

rfe

None
None
Lowest
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.