andy/nexus
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

feat(rdp): Kerberos logon through a configured KDC

Browse Source 
An RDP profile can name a Kerberos KDC; CredSSP then authenticates with
Kerberos instead of NTLM, reaching the KDC through a small TCP client
(RFC 4120 length-prefixed framing, 5 s connect / 10 s read timeouts,
replies capped at 1 MiB so a hostile KDC can't force a huge allocation).
UDP KDCs are refused with a clear message. Tested against a fake KDC
(round trip, oversized reply, UDP); not against a real realm.

Smart-card logon is not implemented: it needs PC/SC hardware and a card
to build and test against.
This commit is contained in:
Andy Dixon
2026-10-12 18:30:30 +01:00
parent ae2b07db4b
commit 455d8fa6da
6 changed files with 75 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/overview.md
+1 -1
View File
@@ -147,7 +147,7 @@ Use Nexus Terminal when you need to:
- Direct, SOCKS5, HTTP CONNECT, SSH-tunnelled or (experimental) RD Gateway connections.
- Scale-to-fit or 1:1, a fixed resolution or one that follows the tab (Display Control).
- Keyboard (scancodes for keys and shortcuts, Unicode for text), mouse and wheel; Ctrl+Alt+Del; text clipboard sharing in both directions.
- Password storage modes and domain logon.
- Password storage modes, domain logon, and Kerberos through a configured KDC.
- Remote audio playback, a printer whose jobs are saved as PostScript files, and a shared folder redirected as a drive (Linux and macOS), confined to that folder.
### VNC capabilities