0

I have WCF application services running under a custom domain services account in IIS. This account has access to a 2008 R2 SQL Server instance through Windows Authentication over Kerberos. As I understand it the Kerberos authentication process between the application server and the sql server is secure. What I can't confirm is if the messages between the application server and SQL are encrypted and secured by Kerberos as well.

4
  • Kerberos is just the authentication protocol -- so it depends on what protocol you are using to communicate with the server.
    – Hogan
    Apr 27, 2016 at 17:20
  • Thanks @Hogan. When I read the following statement from technet could be interpreted to mean all communication in the session would be secure. "In the Kerberos protocol model, every client/server connection begins with authentication. Client and server, in turn, step through a sequence of actions designed to verify to the party on each end of the connection that the party on the other end is genuine. If authentication is successful, session setup completes and a secure client/server session is established."
    – bkstill
    Apr 27, 2016 at 19:02
  • yes secure is modifying established not session. Later on that page they list the types of protocols used. It is very possible to set up those protocols to be insecure. However, it is hard to have Kerberos be insecure (but possible if you use microsoft extensions to turn off certain features.) But if you don't specifically set ignore flags in your setup Kerberos is very strong.
    – Hogan
    Apr 27, 2016 at 20:50
  • In other words: Kerberos makes sure that communication between client and KDC (to get tickets), and between server and KDC (to check client tickets are valid) are secure. What happens between client and server is a matter of adult consent, Kerberos does not care 0:-) Apr 28, 2016 at 20:51

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.