Lets say two parties (A and B) use kerberos v5 and they happened to have varied clocks which is more than 10 mins window time of Kerberos. How does Kerberos still enable them to arrive consensus at a time? What messages are exchanged for this re-synchronization?

  • It's implementation dependent. – Michael Hampton Sep 18 '16 at 17:43
  • Can you point me to one logical way how you can achieve (say with sliding window of kerberos) – Prem Anand Sep 18 '16 at 23:51

Kerberos does not synchronize time between the KDC, Admin-server and clients. The administrators need to establish time-sync mechanisms such as NTP to ensure that system time between various entities involved in the Kerberos domain is kept synchronized.

Microsoft Windows domains specify a default tolerated time-offset of 5 minutes, although this setting can be changed by a Group security policy (GPO) configuration. A lower value is more secure than a higher value, but the trade-off is the risk of rejecting genuine remote clients which may have high time offsets.

See these references for more details:

  1. http://tldp.org/HOWTO/Kerberos-Infrastructure-HOWTO/time-sync.html
  2. https://technet.microsoft.com/en-us/library/jj852172%28v=ws.11%29.aspx

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.