1

Lets say two parties (A and B) use kerberos v5 and they happened to have varied clocks which is more than 10 mins window time of Kerberos. How does Kerberos still enable them to arrive consensus at a time? What messages are exchanged for this re-synchronization?

Improve this question
2
  • It's implementation dependent.
    – Michael Hampton
    Commented Sep 18, 2016 at 17:43
  • Can you point me to one logical way how you can achieve (say with sliding window of kerberos)
    – Prem Anand
    Commented Sep 18, 2016 at 23:51

1 Answer 1

Reset to default
1

Kerberos does not synchronize time between the KDC, Admin-server and clients. The administrators need to establish time-sync mechanisms such as NTP to ensure that system time between various entities involved in the Kerberos domain is kept synchronized.

Microsoft Windows domains specify a default tolerated time-offset of 5 minutes, although this setting can be changed by a Group security policy (GPO) configuration. A lower value is more secure than a higher value, but the trade-off is the risk of rejecting genuine remote clients which may have high time offsets.

See these references for more details:

  1. http://tldp.org/HOWTO/Kerberos-Infrastructure-HOWTO/time-sync.html
  2. https://technet.microsoft.com/en-us/library/jj852172%28v=ws.11%29.aspx
Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .