In http://www.freebsd.org/doc/handbook/kerberos5.html section 126.96.36.199 “The KDC is a Single Point of Failure” you can read:
By design, the KDC must be as secure as the master password database is contained on it. The KDC should have absolutely no other services running on it and should be physically secured. The danger is high because Kerberos stores all passwords encrypted with the same key (the “master” key), which in turn is stored as a file on the KDC.
Doesn't that mean that this is an Achilles' heel of Kerberos since if the KDC is compromised, the attacker will know all users' plaintext passwords (as opposed to getting /etc/shadow of a Linux system which will only provide the attacker with the hashed and salted passwords)?