Re: Remote process with network access

From: Ivan Brugiolo [MSFT] (ivanbrug_at_online.microsoft.com)
Date: 09/02/04 

Date: Thu, 2 Sep 2004 15:47:07 -0700

If you have a internet-exposed web server,
does this web server allows authenticated connections ?
If yes, via Windwos-Integrated-Authentication, or via SSL ?
If you have SSL, then credentials does not need to be delegated
(actually, kerberos is not even involved).
If a server gets compromised, then it can run arbitrary code
with either the process account (NetworkService in modern-era Web Servers),
or any other token that happens to be in that process.
If these are SSL tokens, than delegation OFF will not save you.

There's not much point discussing the different security requirements
of your deployment here. I just pointed out what are the options.
Sorry. 

-- 
This posting is provided "AS IS" with no warranties, and confers no rights.
Use of any included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
"Gerry Hickman" <gerry666uk@yahoo.co.uk> wrote in message
news:#KirX0TkEHA.524@TK2MSFTNGP15.phx.gbl...
> Hi Ivan,
>
> In my own scenario, it's a corporate network, but the users don't have
> local Administrator access. There are two reasons delegation has not
> been allowed in my environment to date:
>
> 1. Some servers are also web servers (world facing) running IIS and we'd
> like to use ASP in conjunction with Active Directory and WMI, but the
> risk is that if the server was compromised the local system would be
> able to access other boxes on the network.
>
> 2. When the guys in head office try to enable delegation in AD they get
> big dialog boxes saying it's not safe. In days gone by, they'd have been
> less cautious, but with all the recent security scandals they refuse to
> consider anything that may be a risk. It's also no good if we have to do
> it for every box on the network we want to manage.
>
> Ivan Brugiolo [MSFT] wrote:
> > The credentials of the account needs to be delegatable
> > and the machine account needs to be trusted for delegation.
> >
> > The only reason I can see for not structing for delegation a machine
account
> > is that the machine is compromiseable, that is, it's easy to have
arbitrary
> > code running as localsystem.
> > If you have code running as localsystem in a machine trusted for
delegation,
> > then, if you can induce an authentication over it (for example,
> > by creating a web server and forcing a user to navigate that web server
> > with non anonymous credentials), then you can impersonate delegat-able
> > credentials,
> > and perform any action on behalf of the user.
> >
> > I guess that your scenario is a corporate network where users are
allowed
> > to log-in as local administraotrs. In this case, delegation is
dangerous.
> >
>
>
> -- 
> Gerry Hickman (London UK)

Relevant Pages

  • Re: access to network file server through web server denied
    ... Before I check with the network team to ... see whether the network has been configured with "Delegation", ... On our local developer's web server (It can be IIS 5 on Windows XP ...
    (microsoft.public.inetserver.iis.security)
  • Re: Access denied. delegation scenario accessing to a shared resource in cluster
    ... Depending on how your web server is configured ... for delegation, ... application via Kerberos too. ... web server and the cluster server and find out what kind of authentication ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: CA web component problems
    ... Could you please confirm that the Enterprise Admin account you are using is ... > for delegation via the ADUC check box. ... is there a way to install the Web enrollment pages ... >>> enabled the web server for delegation via ADUC and rebooted the ...
    (microsoft.public.win2000.security)
  • Kerberos Constrained Delegation for Writing Files
    ... We have a web application deployed on web server, ... We have tried to use constrained delegation through multiple tiers as ... This seemed to work at first but then stopped working. ...
    (microsoft.public.dotnet.framework.aspnet.security)
  • Re: access to network file server through web server denied
    ... For setting up Kerberos and Delegation, I have a set of FAQ available here: ... On our local developer's web server (It can be IIS 5 on Windows XP ... Integrated windows authentication> checked. ...
    (microsoft.public.inetserver.iis.security)
Loading