Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

learn more… | top users | synonyms

2
votes
1answer
120 views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
1
vote
1answer
3k views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...
0
votes
2answers
36 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...
2
votes
0answers
42 views

Kerberos Authentication

I am trying to understand Kerberos Authentication. So far my understanding is: Supposing 'Alice' (A) wants to talk to 'Bob' (B). Step 1: A -> S: {A, B, None} K(A, S) Where S is the ...
0
votes
1answer
450 views

With a 'man in the middle' attack, can the attacker find out Client/Server session keys with a compromised AS/TGS secret key?

Assuming that an AS/TGS secret key has been compromised by a 'man in the middle' attack who in turn can monitor the network traffic, is an attacker able to find out the Client/Server session keys ...
3
votes
1answer
110 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
3
votes
1answer
90 views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
0
votes
1answer
71 views

Why first kerberos message is not ciphered

When analysing Kerberos exchange (and other similars as Needham, Denning, etc.) I wonder why the first message where the identities of the client and remote are not encrypted. In case not encrypted I ...
1
vote
0answers
23 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
1answer
252 views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
1
vote
0answers
31 views

Cannot contact my realm for credentials

I have created a KERBEROS.TEST realm on my ubuntu 14.10 virtual machine and after addprinc root/admin also I added mu client machine as principal, I checked kinit and with sudo klist command I ...
2
votes
1answer
47 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for ...
5
votes
2answers
314 views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
5
votes
2answers
2k views

Does the Kerberos KDC know the users' plaintext passwords?

In http://www.freebsd.org/doc/handbook/kerberos5.html section 15.7.8.3 “The KDC is a Single Point of Failure” you can read: By design, the KDC must be as secure as the master password database is ...
3
votes
2answers
75 views

Can I pass a cryptographic hash of a user's password to Kerberos while creating principals?

I am running MIT Kerberos V and I would like to automate the creation of principals. The page here explains how to do this by providing principal names and passwords on the command line like so: awk ...
1
vote
0answers
65 views

Kerberos v4 replay attack vs. sliding time window

Just wondering about a replay attack against Kerberos v4. So v5 has a replay cache that takes note of tickets to prevent replay attacks. Kerberos v4 does not have a replay cache, though. Say, I ...
6
votes
3answers
245 views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
0
votes
0answers
135 views

Authentication for an enterprise application via a reverse proxy in the cloud

I am trying to understand conventional deployments for users accessing HTTP enterprise app from the internet detail: Let's say we have a HTTP reverse proxy in the cloud (amazon) and an enterprise ...
4
votes
1answer
137 views
1
vote
2answers
296 views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
2answers
568 views

What is inside a Kerberos TGT ticket?

I would like to know what makes up a TGT ticket? The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear ...
4
votes
3answers
219 views

Kerberos for sending secrets

I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be ...
1
vote
1answer
362 views

Hash Security of Windows 7 Password

I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value. Many materials (such as, 1) tells me that it uses ...
1
vote
0answers
33 views

is this optional keyword redundant? [closed]

KDC-REQ ::= SEQUENCE { -- NOTE: first tag is [1], not [0] pvno [1] INTEGER (5) , msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), padata [3] SEQUENCE OF PA-DATA ...
1
vote
1answer
177 views

What good does the Kerberos Authentication Server

I currently try to understand the Kerberos protocol. And I think I understand the parts of it. How Alice gets a ticket from the Authentication Server to authenticate herself to the ticket granting ...
6
votes
1answer
740 views

Relative merits of Heimdal and MIT Kerberos?

What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports ...
9
votes
2answers
4k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
1
vote
1answer
43 views

What security mechanisms enable a user to change their password under a Kerberos environment?

During client authentication, neither the secret key nor the password is sent to the KDC. If a user changes their password on the client, how is the password updated in the password database in the ...
1
vote
0answers
22 views

Get Service_key in the course of kerberos authentication [closed]

Built environment 1) Exchange server: The operator system of Exchange server is Windows Server2008R2, We configured it as Active Directory (primary domain controller) used for client authentication ...
1
vote
0answers
54 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
5
votes
2answers
3k views

Kerberos - what can an attacker achieve from a replay attack?

On the last step of Kerberos, the client sends the target server a ticket and an authenticator. One of the authenticator's parts is a timestamp. The timestamp is said to prevent replay attacks, as the ...
3
votes
2answers
167 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
4
votes
1answer
1k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
-7
votes
1answer
117 views

Kerberos v4 compromised TGS [closed]

What would happen under the Kerberos v4 protocol if an attacker has compromised TGS and identified the Ktgs key? What would be the outcomes of such an attack?
2
votes
1answer
72 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
5
votes
0answers
851 views

krb5 and pam_mount [closed]

I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos. pam_mount is installed and configured, but it only mounts a ...
3
votes
1answer
329 views

Kerberos realm understanding

Could someone summarise why realms are necessary in Kerberos and the advantages of the concept. I'm struggling to isolate everything I know / beginning to understand into some well defined points for ...
6
votes
2answers
483 views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
1
vote
1answer
656 views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses ...
1
vote
1answer
223 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
3
votes
1answer
164 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
2
votes
0answers
95 views

Distinct databases with the same Kerberos Authentication server

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
2
votes
1answer
391 views

secret key compromise in SSL vs in Kerberos

Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...
2
votes
1answer
202 views

How do we encrypt a password using another password?

Heys all I've got a nub question, I was wondering What does it mean to encrypt a password using another password? For example I want to encrypt a password foo using a password bar, does it mean that ...