I was reading about kerberos authentication and how the password is not transferred on the wire but it exist in the kdc database to encrypt or decrypt messages, and only tickets are transferred after validation. I wonder when the user changes his password at the client how will it update the new password in the kdc database?
2 Answers
In simple terms Kerberos is a protocol used for authenticating users on a network.
In this example the client may change their password on the client machine, which in turn is saved into the network passwords database - commonly used is Active Directory.
Kerberos protocol requires the user to authenticate first against an authentication server, in this example it would be the sever holding the active directory, commonly called a domain controller.
Once authenticated then Kerberos assigns a ticket that is used instead of the password while wishin the protocol - such as requesting service tickets.
-
When the user change password and saved to the network password db how it's being transmitted to the db is it hashed by the old password so it's not in clear?– AbbasMay 26, 2017 at 21:08
-
1Have a read of this. technet.microsoft.com/en-us/library/hh994558(v=ws.10).aspx– ISMSDEVMay 26, 2017 at 21:11
When authenticating the user encrypts a shared item(a timestamp) with his hash, if the kdc manages to decrypt the timestamp with the same hash it will return a TGT. This is signed with the kdc's secret password hash. (in a Microsoft environment this is krbtgt's password)
When replacing the password you need to provide a valid TGT, the original password and the new password encrypted. (and not hashed) this is done using the kadmin protocol which uses kerberos as a transport protocol. See http://web.mit.edu/krb5/old-build/sandbox/doc/kadmin/kpasswd.protocol