Windows OpenSSH SFTP Server Support for Kerberos Protocol Transition

Question

I wish to setup an SFTP Server front-end for file shares (virtual roots) located on backend hosts. Does the OpenSSH-based SFTP server available with the newer Windows Server OSes support the Kerberos Protocol Transition (KPT) feature? In addition, what are the known security vulnerabilities or threats associated with KPT?

Answer 1

Hello KenOnwere

Unfortunately Microsoft OpenSSH SFTP does not support KPT.

Reference: https://learn.microsoft.com/en-us/windows-server/administration/openssh/openssh_server_configuration
The following configuration options are not available in the OpenSSH version that ships in Windows Server 2019 and Windows 10 build 1809:
...
KbdInteractiveAuthentication
KerberosAuthentication
KerberosGetAFSToken
KerberosOrLocalPasswd
KerberosTicketCleanup...

-------------------------------------------------------------------------------------------------------------------------------------------------------------------

--If the reply is helpful, please Upvote and Accept as answer--

Answer 2

I can't speak about the SFTP/Open SSH part of your question.

But regarding the second about the risks of Kerberos Protocol Transition, I can :) To allow protocol transition, you basically need to allow a system to impersonate an account without having to know any of the shared secrets usually necessary to authenticate. So you would have to highly trust the system allowed to perform protocol transition. This way to delegate authentication to a third party service (outside of the domain controllers) makes it a primary target for attackers wishing to perform credential thefts and other impersonation techniques. There are plenty of posts and videos available that described how protocol transition and delegation can be abused in general and other specific vulnerabilities found using Kerberos delegation (Sean Metcalf’s website is usually a good starting point). Note that delegation can be disabled on sensitive accounts to avoid those accounts from being abused from systems allowed to perform delegation. But mitigation is another conversation...

Answer 3

Thanks all for the feedback.