Stack Exchange Network

Stack Exchange network consists of 174 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange
Make your voice heard. Take the 2019 Developer Survey now

Questions tagged [kerberos]

Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

2
votes
1answer
72 views

Can Kerberos encrypt network traffic between servers?

Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can ...
4
votes
0answers
62 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
-1
votes
1answer
53 views

What are the flaws in this security protocol between client and server? [closed]

Here is my security protocol for the use of a service provided by server. It utilises a symmetric key: Client requests to use a service Server sends back nonce Client sends back nonce encrypted with ...
1
vote
0answers
27 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
1
vote
0answers
35 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
17 views

Why the need for user ID in ticket AND authenticator (Kerberos)?

I am currently learning about Kerberos. Why the following in Kerberos v4: Client -> Service : Ticket_Service || Authenticator_Client where Ticket_Service: E(K_S, [K_C,S || ID_C || ...]) and ...
2
votes
2answers
87 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
0
votes
1answer
289 views

A replay attack was detected (4649) & Exchange Healthmailbox

We received alarms for this in our SIEM today. I believe it is expected and just "noise". The alarm was triggered immediately after Exchange cleared the ThrottlingConfig.log. I know Exchange Server ...
0
votes
0answers
46 views

Mimikatz /rc4 argument for pass-the-ticket?

I'm studying how pass-the-ticket works using Mimikatz, i.e., forged Silver and Golden Kerberos tickets. The command usually takes the form (Golden tickets): kerberos::golden /sid:SID /domain:DOMAIN /...
2
votes
1answer
150 views

Kerberos three transactions — why not just use two?

I have read the description of Kerberos at sites like this very informative one: http://www.roguelynn.com/words/explain-like-im-5-kerberos/ I think I understand generally how it works: User ...
0
votes
1answer
222 views

Reasons to transition Kerberos secured web applications to OAuth2/OpenId

We have five internal web applications written in Java / AngularJs that are secured via Kerberos/ Spnego ( Spring Security implementation) . We are looking to transition these apps to AWS ( EBS) . ...
0
votes
0answers
25 views

Is principal type supported in Linux Kerberos utilities?

In the Windows ktpass command, the –ptype option can be used to specify a principal type. Is there a similar option in ktutil, kinit or any of the Linux Kerberos utilities?
0
votes
1answer
85 views

Risks for implementing single sign on

I'm working with an organization that's integrating a lot of apps with LDAP in a Windows environment. They are doing a good job of implementing least privilege, so there aren't a lot of scenarios ...
1
vote
0answers
204 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
1
vote
0answers
40 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
0
votes
0answers
28 views

Can klist be used to detect expiry dates for forged kerberos tickets?

I have observed that klist is used to list locally cached kerberos tickets. For golden tickets with indefinite expiry dates (say ~10 years), is it possible to list all the tickets submitted to a ...
2
votes
0answers
25 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
1
vote
0answers
39 views

Kerberos - Forcing a successful TGT request

We have these devices that are trying to connect to a long dead Kerberos server from a long dead company, thus we don't have access to the credentials. I was trying to find a way for them to take a ...
0
votes
1answer
59 views

Does Windows Authentication Use Secured Connection

I am writing a .NET Web API that will be used in an enterprise environment where users authentication themselves using their active directory credentials, so I am using "Windows Authentication" in IIS ...
1
vote
0answers
491 views

Kerberos and brute-force attacks

Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
1
vote
0answers
458 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
0
votes
1answer
427 views

Password reset for AD RODC-specific krbtgt_xxxxx accounts

While there's a lot of information [1], [2], [3] about resetting the password for the regular krbtgt account, but I haven't yet found a clear suggestion about RODC-specific krbtgt_xxxxx accounts. ...
0
votes
0answers
111 views

Malware and Kerberos Authentication

Could malware use the active Kerberos ticket on the system to authenticate with AD and then proceed to successfully call the CnC server through the HTTP proxy on the same environment?
1
vote
1answer
2k views

Kerberos: kadmin.local: No such file or directory while initializing kadmin.local interface (cloudera quickstart) [closed]

I am running (as sudo) a script for setting up Kerberos (which I will paste below) on a CentOS machine (in a Cloudera Quickstart Docker container). The strange thing is that I have successfully ran ...
0
votes
2answers
474 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
0
votes
2answers
264 views

Would it be possible to store Kerberos tickets on a YubiKey?

Kerberos supports different ways (ccache types) of storing tickets, such as: FILE MEMORY KEYRING I was wondering whether it would technically be possible to also store the Ticket-granting-ticket and ...
1
vote
0answers
1k views

Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes

I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting: ...
0
votes
1answer
125 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...
0
votes
2answers
202 views

Kerberos authentication question

I was reading about kerberos authentication and how the password is not transferred on the wire but it exist in the kdc database to encrypt or decrypt messages, and only tickets are transferred after ...
1
vote
1answer
569 views

Kerberos IIS Authentication over HTTP

I've reviewed the RFCs and am pretty familiar with Kerberos. It seems to me that over a non-encrypted link (HTTP), Kerberos doesn't leak the user's password (or hash based challenge/response like ...
1
vote
1answer
138 views

In the Kerberos protocol, what prevents clients from decrypting a service's secret key?

I'm studying the Kerberos protocol at a high level of abstraction. As I understand it- when a client wants to request a service, it first receives two messages from the TGS. A: encrypted with the TGS/...
0
votes
0answers
358 views

Securing infrastructure with IMAP, SMTP, GSSAPI, OTP, FreeIPA

I am looking to finish a relatively secure infrastructure using only OSS tools. On the Linux side, I have the very capable RedHat IPA that provides Kerberos and manages host and service registrations. ...
3
votes
0answers
173 views

Detect Kerberoasting activity

I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
2
votes
1answer
78 views

Does Kerberos support vendor specific attributes?

As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?
1
vote
1answer
262 views

In Kerberos, how does a client authenticate the KDC?

How does a client know whether it is talking with a real or fake KDC? Is it based on the system configuration, similar to DNS?
2
votes
0answers
59 views

Kerberos Constrained Delegation

I have 4 machines, one machine with Domain Controller, one machine with Analysis Services, one machine with IIS Services, one machine with the Application The goal is to open the application and the ...
0
votes
0answers
493 views

Single Sign On : Get user name pc before authentication on Identity Provider

Well, I am new in security (SSO, SAML, etc). The scenario We have a Web Application , we want to catch user name (for example windows user) before it has been sent to be authenticated with the ...
2
votes
1answer
258 views

Secure Authentication options for NFS

Are there any Secure Authentication for NFS other than Kerberos?
0
votes
1answer
100 views

Why does the first authentication process does Not need a Authenticator in KERBROS(v4)

Well first this is a general protocol Kerberos v4 (1) C -> AS: IDc||IDtgs (2) AS -> C: Ekc[Kc,tgs||TGT] (3) C -> TGS: TGT||Authenticator (4) TGS -> C: Ekc,tgs[Kc,v||Ticketv] (5) C -> V: Ticketv||...
1
vote
1answer
803 views

Monitoring Kerberos Authentication Traffic

I had developed an application that uses Windows Authentication in order to authenticate users in single hop. Then I developed this application in order to authenticate users again with Windows ...
2
votes
1answer
311 views

On NFSv4 with kerberos security

When NFSv4 is configured to use kerberos authentication is mandatory to have a keytab installed on every client with is own principal. To access files a user still needs to be authenticated with his ...
1
vote
1answer
170 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
5
votes
1answer
151 views

Kerberos: What is the structure for preauthentication with certificate (RFC 4556)

I'm struggling to understand what the structure of a preauthentication request in kerberos should look like. After reading RFC 4556 and the referenced RFCs I'm still confused because of all the ...
0
votes
1answer
35 views

SSO DNS SRV lookup

I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the ...
2
votes
1answer
2k views

How does Kerberos protect against replay attacks?

I have been reading about Kerberos, and I understand the messages exchanged, and that it uses symmetric encryption in order to protect some of the messages. But, how does it protect against replay ...
4
votes
1answer
173 views

Kerberos Protocol

I've read a number of articles about Kerberos and most of them mention that the final step of the server responding to the client is optional: Kerberos application server response (optional) (...
1
vote
1answer
131 views

Linux authenticating against Active Directory, is one keytab for all Linux machines enough?

We have lots of Linux (RHEL) machines authenticating against Active Directory. Is one keytab for all Linux machines enough? Do we need one keytab for each machine? What are the PROS and CONS? What ...
0
votes
1answer
158 views

Kerberos: How could an attacker exploit insider access to invalidate tickets for a service?

Assume: the attacker has legitimate insider access to a Kerberos system. Background: The attacker is looking to invalidate all tickets for a service (maybe he really dislikes a service). To do so, ...
5
votes
1answer
786 views

How secure is Kerberos?

I recently got interested about Kerberos and Radius, and I already found some information about their difference. But, I got curious about how secure Kerberos actually is. I see from the official ...
1
vote
1answer
36 views

Clock consensus of parties in Kerberos v5

Lets say two parties (A and B) use kerberos v5 and they happened to have varied clocks which is more than 10 mins window time of Kerberos. How does Kerberos still enable them to arrive consensus at a ...