Local Networks Go Global When Domain Names Collide – Krebs on Security
krebsonsecurity.com

The proliferation of new top-level domains (TLDs) has exacerbated a well-known security weakness: Many organizations set up their internal Microsoft authentication systems years ago using domain names in TLDs that didn’t exist at the time. Meaning, they are continuously sending their Windows usernames and passwords to domain names they do not control and which are freely available for anyone to register. Here’s a look at one security researcher’s efforts to map and shrink the size of this insidious problem.

  • magic_smoke@links.hackliberty.orgEnglish
    19·
    3 months ago

    Unrelated but this pissed me off.

    using a Microsoft innovation called Active Directory

    The only Microsoft innovation there was Embracing, Extending, and Extinguishing LDAP and Kerberos.

    I will NEVER forgive boomer admins for allowing that. I don’t mean to be presumptive, maybe its just where I work, but old guard windows admins seem to be fucking lazy dipshits as a rule.

    I’ve never met sysadmins/engies who give so little a shit about what they’re setting up and why. If you only care that it works, and not how, why the fuck are you in this industry? Go get an MBA like the unskilled, uncaring sap you are and fuck off from my special interest.

    Man that got derailed quickly lol, though I guess it explains why they’re all using domains they don’t own…

    • Findmysec@infosec.pubEnglish
      5·
      3 months ago

      Yeah I will make sure to use OpenLDAP/FreeIPA at home. I’d rather play along with RedHat’s bullshit than Microsoft’s bullshit

      • magic_smoke@links.hackliberty.orgEnglish
        3·
        3 months ago

        That’s what I’ve been doing for a good bit now.

        I used to do a split environment on ad but I didn’t feel I was really getting anything out of windows, other than ease of use with TrueNAS.

        Still haven’t gotten TrueNAS working with FreeIPA, but running a NAS off of rocky isn’t too bad either if you don’t mind the extra setup.

        The nice thing about downstream distros is you don’t actually have to deal with redhats shit to use their stuff.

        • DisasterEnglish
          2·
          3 months ago

          I dropped truenas, ran fedora server + zfs dkms module. It’s been perfectly fine for a couple of years (even accounting for that nasty silent data corruption bug…)

          And domain permissions work properly now. People have been asking Ix for proper support for IPA for over a decade, they aren’t interested in solving it.

          • magic_smoke@links.hackliberty.orgEnglish
            2·
            3 months ago

            Which is why I’m no longer interested in supporting them lol.

            You don’t get to run a commercial entity under the guise of open source software, and giving back to the community, while prioritizing inter-compatibility with the king of EEE over the most popular FLOSS alternative.

            Rocky has been good to me, but I still miss centos.

            Honestly the only thing I’ve had trouble getting working with freeIPA with no alternative is some sort of centralized ROM management. Then again they all kinda lack any sync features with retroarch which is what would really bring me to them anywho.

        • Findmysec@infosec.pubEnglish
          1·
          3 months ago

          TrueNAS is just better QoL for people who don’t want to deal with the cli all the time. I don’t care so I don’t need it. I have a separate k8s cluster anyway so it’s pretty much pointless for me other than specific things like the ACLs which the GUI is good at

          • magic_smoke@links.hackliberty.orgEnglish
            1·
            3 months ago

            Pretty much. Its nice but I find trying to get it to do anything other than cookie cutter operations requires you to not only go around the GUI, but in many cases break it.

            Also lotta shit that was supposed to work sucked too. The GUI always seemed to have a 50% chance of clobbering my ACLs when editing them, and encryption was either entirely password based, or the keys where stored with no passphrase on an unencrypted dataset.

            My rocky nas has Luks on mdraid for the root which hold the keys for the zfs pools, and CLI based acl management is pretty ezpz once you learn it.

        • magic_smoke@links.hackliberty.orgEnglish
          3·
          3 months ago

          Been using this in my homelab. Pretty great for Linux machines.

          If you need to host for a windows network, samba can provide a Windows Server 2008 level AD DC, as well as print and file servers.

          You could always install bare LDAP and Kerberos, but then again you could also try eating a cinderblock.

          There are alternatives, but they all have their usecases and compromises in comparison. Most businesses want a cookiecutter one size fits all solution. AD is the closest thing.

      • taladarEnglish
        1·
        3 months ago

        From what I recall Kerberos didn’t work all that well in environments with NAT so it is unlikely to replace modern single sign on systems like OpenID Connect.