Harden password attributes and Kerberos keys

9.1. Harden password attributes and Kerberos keys#

Nubus stores password-related attributes for different authentication protocols and services.

You can reduce the amount of legacy credential material in the directory service by deactivating NT hash generation and restricting the Kerberos encryption types. This page describes the required checks, configuration, and cleanup.

Warning

Don’t apply these settings before checking the integrations in your environment.

Existing users and service accounts can continue to contain the affected values until you run the cleanup commands.

After cleanup, you can’t restore the removed values without resetting the affected passwords.

9.1.1. Credential attributes#

The directory service contains several password representations because different services use different authentication protocols. The following password representations are relevant for Kerberos:

sambaNTPassword

An unsalted password hash that supports legacy NTLM-based authentication. The hash isn’t required for Kerberos authentication.

krb5Key

Stores Kerberos keys for a principal. A principal can have several keys with different encryption types. This supports authentication by clients and services during a migration. The attribute can contain insecure or deprecated keys.

userPassword

Stores a crypt hash that uses a configurable hashing method. For more information about password hashes, see Password hashes.

9.1.2. Choose hardening measures#

Before choosing a hardening measure, identify the services in your environment that depend on NT hashes or specific Kerberos encryption types. You can apply the following controls independently:

password/samba/nthash

Controls whether Univention Directory Manager (UDM) generates sambaNTPassword when a password changes.

kerberos/defaults/enctypes/permitted

controls the encryption types that Univention Corporate Server (UCS) permits for Kerberos keys.

Changing either UCR variable doesn’t remove values that already exist. For existing environments, use Remove existing NT hashes or Remove weak Kerberos keys.

You can’t deactivate sambaNTPassword in environments where one of the following services uses NT hashes for core functionality:

Samba and Active Directory

UCS can operate a Samba domain based Active Directory that offers authentication and file services compatible to Active Directory. To keep Samba synchronized with the directory service in UCS, it uses krb5Key.

Active Directory Connection

Password synchronization between UCS and Active Directory requires the NT hash sambaNTPassword.

univention-squid

The squid_ldap_ntlm_auth authentication backend requires the NT hash for transparent proxy authentication.

univention-radius

The univention-radius-ntlm-auth helper requires the NT hash for MS-CHAP and NTLM authentication.

If one of these services is active, keep password/samba/nthash enabled. Removing existing NT hashes breaks the affected authentication or synchronization function and isn’t reversible without resetting passwords.

Removing weak or deprecated encryption types from krb5Key can prevent a principal from authenticating when a client or service supports only a removed type. This includes legacy Windows clients, service accounts that haven’t migrated to AES encryption, and trusts that support only removed encryption types. Check the encryption types used by domain integrations before proceeding.

9.1.3. Deactivate NT hash generation#

To stop UDM from generating sambaNTPassword for future password changes, change the password/samba/nthash UCR variable.

If no active service requires NTLM-based authentication or password synchronization, as outlined in Choose hardening measures, set the UCR variable on every UCS system that performs password changes through UDM. Use the command in Listing 9.1.

To configure the UCR variable on multiple systems, consider a UCR policy. For more information, see Configure UCR variables with policies.

UDM then stops generating sambaNTPassword during password changes and removes the value when the password changes next. The setting doesn’t remove existing values immediately.

Listing 9.1 Deactivate NT hash generation#
$ ucr set password/samba/nthash=false

9.1.4. Remove existing NT hashes#

The cleanup script remove values from all matching directory objects. Before running it, create, and verify a directory backup as described in Daily backup of LDAP data. Run the dry-run mode first to see which objects the command would change.

On the Primary Directory Node verify that password/samba/nthash has the value false. Then run the command in Listing 9.2 only on the Primary Directory Node.

Listing 9.2 Verify the accounts for removal of NT hashes on the Primary Directory Node#
$ /usr/share/univention-directory-manager-tools/remove_sambantpassword --dry-run

If the dry-run output lists only affected user accounts, and you have approved them for cleanup, run the command without --dry-run on the Primary Directory Node, as shown in Listing 9.3. The command removes sambaNTPassword from all affected user accounts. It prints a warning when the UCR variable isn’t set to false.

Listing 9.3 Remove NT hashes from matching accounts Primary Directory Node#
$ /usr/share/univention-directory-manager-tools/remove_sambantpassword

9.1.5. Restrict Kerberos encryption types#

To permit only AES-256 and AES-128 keys, set the kerberos/defaults/enctypes/permitted UCR variable on each UCS system that provides or manages Kerberos credentials, as shown in Listing 9.4.

To configure the UCR variable on multiple systems, consider a UCR policy. For more information, see Configure UCR variables with policies.

Listing 9.4 Restrict permitted Kerberos encryption types#
$ ucr set kerberos/defaults/enctypes/permitted='aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96'

This setting excludes the following types that are insecure or deprecated in the default key set:

  • arcfour-hmac-md5, also known as rc4-hmac

  • des-cbc-crc

  • des-cbc-md5

  • des-cbc-md4

  • des3-hmac-sha1 and des3-cbc-sha1

The setting affects newly generated keys and Kerberos negotiation. It doesn’t remove weak keys that are already stored in krb5Key.

Caution

After changing the permitted encryption types, test domain joins, trusts, service accounts, and applications. If a required principal has no mutually supported encryption type, its authentication fails.

9.1.6. Remove weak Kerberos keys#

The Kerberos cleanup command removes the default set of weak and deprecated key types listed in Restrict Kerberos encryption types. Run the dry-run mode first, as shown in Listing 9.5.

Listing 9.5 Identify weak Kerberos keys#
$ /usr/share/univention-directory-manager-tools/remove_krb5key_keytypes --dry-run

If no client, service, or domain integration requires the key types in the dry-run output, run the command shown in Listing 9.6. The command increments krb5KeyVersionNumber on each object that it changes. If a krb5Key value can’t be decoded, the command skips that object instead of modifying it.

Listing 9.6 Remove weak Kerberos keys#
$ /usr/share/univention-directory-manager-tools/remove_krb5key_keytypes

To remove a specific key type, use the command in Listing 9.7. You can specify the --keytype option multiple times. The argument accepts a Kerberos key type name or an encryption type ID. For example, specify rc4-hmac to remove only RC4-HMAC keys, as shown in Listing 9.7.

You can’t reverse this cleanup without resetting the affected account passwords.

Listing 9.7 Remove a specific Kerberos key type#
$ /usr/share/univention-directory-manager-tools/remove_krb5key_keytypes --keytype rc4-hmac

9.1.7. Verify the result#

After cleanup, verify the following authentication paths:

  • A regular user’s access to the services that they use.

  • Each service account that runs an application or scheduled task.

  • Each configured domain join, trust, and Active Directory integration.

  • Each configured proxy or RADIUS authentication service.

UDM then stops generating sambaNTPassword during password changes. The next time a password changes, UDM removes sambaNTPassword. The setting doesn’t remove existing values immediately.

On this page