Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

learn more… | top users | synonyms

3
votes
1answer
34 views

How secure is GSSAPI single-signon over SSH?

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords. However, I have been unable to find ...
0
votes
1answer
62 views

How does resetting passwords twice increase security after a breach?

In regards to https://mva.microsoft.com/en-US/training-courses/how-to-avoid-golden-ticket-attacks-12134 They mention several times that resetting not only AD passwords twice but also local computer ...
4
votes
2answers
134 views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
2
votes
0answers
53 views

Is a keytab sufficient for logon?

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. ...
2
votes
0answers
31 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc )

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
0
votes
0answers
18 views

Kerberos Replay Attack- Scenario which server is not aware there is a replay attack

I'm researching about Kerberos protocol, I understand the logic of Kerberos but, I cannot solve that assumption. The case will given below: Servers check that the time stamps on authenticators are ...
5
votes
1answer
76 views

Connecting via SPNEGO/Kerberos out from domain

Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite ...
0
votes
1answer
167 views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
1
vote
3answers
177 views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
0
votes
1answer
622 views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
0
votes
2answers
87 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
4
votes
1answer
98 views

Kerberos Authentication

I am trying to understand Kerberos Authentication. So far my understanding is: Supposing 'Alice' (A) wants to talk to 'Bob' (B). Step 1: A -> S: {A, B, None} K(A, S) Where S is the ...
2
votes
1answer
222 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
3
votes
1answer
524 views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
0
votes
1answer
79 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
1
vote
0answers
36 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
3
votes
1answer
421 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
1
vote
0answers
36 views

Cannot contact my realm for credentials

I have created a KERBEROS.TEST realm on my ubuntu 14.10 virtual machine and after addprinc root/admin also I added mu client machine as principal, I checked kinit and with sudo klist command I ...
2
votes
1answer
104 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for ...
5
votes
2answers
407 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
1
vote
0answers
88 views

Kerberos v4 replay attack vs. sliding time window

Just wondering about a replay attack against Kerberos v4. So v5 has a replay cache that takes note of tickets to prevent replay attacks. Kerberos v4 does not have a replay cache, though. Say, I ...
1
vote
1answer
597 views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
3
votes
2answers
101 views

Can I pass a cryptographic hash of a user's password to Kerberos while creating principals?

I am running MIT Kerberos V and I would like to automate the creation of principals. The page here explains how to do this by providing principal names and passwords on the command line like so: awk ...
6
votes
3answers
434 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
1
vote
2answers
418 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
1answer
544 views

Hash Security of Windows 7 Password

I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value. Many materials (such as, 1) tells me that it uses ...
1
vote
0answers
44 views

is this optional keyword redundant? [closed]

KDC-REQ ::= SEQUENCE { -- NOTE: first tag is [1], not [0] pvno [1] INTEGER (5) , msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), padata [3] SEQUENCE OF PA-DATA ...
1
vote
1answer
216 views

What good does the Kerberos Authentication Server

I currently try to understand the Kerberos protocol. And I think I understand the parts of it. How Alice gets a ticket from the Authentication Server to authenticate herself to the ticket granting ...
1
vote
1answer
6k views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...
1
vote
1answer
46 views

What security mechanisms enable a user to change their password under a Kerberos environment?

During client authentication, neither the secret key nor the password is sent to the KDC. If a user changes their password on the client, how is the password updated in the password database in the ...
0
votes
1answer
679 views

With a 'man in the middle' attack, can the attacker find out Client/Server session keys with a compromised AS/TGS secret key?

Assuming that an AS/TGS secret key has been compromised by a 'man in the middle' attack who in turn can monitor the network traffic, is an attacker able to find out the Client/Server session keys ...
1
vote
0answers
25 views

Get Service_key in the course of kerberos authentication [closed]

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication ...
1
vote
0answers
62 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
10
votes
2answers
5k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
6
votes
1answer
1k views

Relative merits of Heimdal and MIT Kerberos?

What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports ...
7
votes
2answers
2k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
-6
votes
1answer
141 views

Kerberos v4 compromised TGS [closed]

What would happen under the Kerberos v4 protocol if an attacker has compromised TGS and identified the Ktgs key? What would be the outcomes of such an attack?
2
votes
1answer
80 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
1
vote
2answers
914 views

What is inside a Kerberos TGT ticket?

I would like to know what makes up a TGT ticket? The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear ...
5
votes
0answers
1k views

krb5 and pam_mount [closed]

I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos. pam_mount is installed and configured, but it only mounts a ...
5
votes
3answers
239 views

Kerberos for sending secrets

I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be ...
6
votes
2answers
555 views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
3
votes
1answer
463 views

Kerberos realm understanding

Could someone summarise why realms are necessary in Kerberos and the advantages of the concept. I'm struggling to isolate everything I know / beginning to understand into some well defined points for ...
1
vote
1answer
816 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
1
vote
1answer
318 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
3
votes
1answer
180 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
3
votes
0answers
104 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
7
votes
2answers
2k views

Does the Kerberos KDC know the users' plaintext passwords?

In http://www.freebsd.org/doc/handbook/kerberos5.html section 15.7.8.3 “The KDC is a Single Point of Failure” you can read: By design, the KDC must be as secure as the master password database is ...
2
votes
1answer
505 views

secret key compromise in SSL vs in Kerberos

Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...
3
votes
2answers
171 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...