TARDIS Project

Since MIT Kerberos KDC acts as the source of truth for authentication, it is probably best to disable accounts there.

To do this, one could:

1. SSH into `enclave`, you may have to SSH proxy through sandbox or another gateway.
2. Enter the Kerberos admin shell
   • kadmin -p sonic/admin@TARDISPROJECT.UK
   • Password is stored on the admin vaultwarden.
   • (other principles are available)
3. Disable ticket issuance
   • Disable: modprinc -allow_tix [username]
   • Re-enable: modprinc +allow_tix [username]
   • This does not kick the user out of any active sessions, which could take up to a day or two to expire.
   • The user will receive a generic Invalid username or password. error when logging in via keycloak OIDC or password SSH.

This does not block authentication via SSH key, ie. ~/.ssh/authorized_keys which should be handled separately. To do this, one could modify /etc/ssh/sshd_config on sandbox, adding the username to the DenyUsers section. For example:

DenyUsers username1 username2 username3