Questions tagged [kerberos]

Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
36
votes
5answers
14k views

Why do I need Kerberos when I could just use a username and password to access services?

I have read that Kerberos is used for authenticating users who wish to access services on various servers in an enterprise network, but I still do not understand the purpose of Kerberos. Why doesn't ...
21
votes
2answers
38k views

Kerberos vs. LDAP for authentication — which one is more secure

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? And Can we switch between them transparently?
16
votes
2answers
14k views

Kerberos authentication over the public internet

What are the threats to having the KDC accessible via the internet for remote clients? It's my understanding that the authentication is a challenge/response protocol and that the password is never ...
11
votes
1answer
23k views

SAML and kerberos what to use where [closed]

I came across SAML and kerberos, both are used to establish identity using assertions (tickets) so is there an overlap in their use ? Can somebody highlight their differences and point which ...
10
votes
2answers
8k views

Does the Kerberos KDC know the users' plaintext passwords?

In http://www.freebsd.org/doc/handbook/kerberos5.html section 15.7.8.3 “The KDC is a Single Point of Failure” you can read: By design, the KDC must be as secure as the master password database is ...
9
votes
2answers
8k views

Preventing LSASS from storing clear-text passwords in Kerberos environment

It is a well known security risk that LSASS stores clear-text passwords if a user has performed a keyboard-interactive logon on a machine - be it local login to his/her workstation or using RDP to a ...
7
votes
2answers
1k views

Implications of having a service account in AD use RC4 rather than AES for Kerberos?

Bear with me, I know this is sloppy, but here is the back story: We have a partner that uses Jira and is using spnego with a custom auth back-end that expects certain group membership in the token. ...
7
votes
1answer
1k views

Connecting via SPNEGO/Kerberos out from domain

Is it possible to authenticate to SPNEGO/Kerberos server in domain A with an account from the same domain (obviously) when the client is connecting from computer in one of the following (quite similar)...
7
votes
2answers
4k views

Kerberos - what can an attacker achieve from a replay attack?

On the last step of Kerberos, the client sends the target server a ticket and an authenticator. One of the authenticator's parts is a timestamp. The timestamp is said to prevent replay attacks, as the ...
6
votes
2answers
17k views

What's the difference between Radius and Kerberos?

Is Radius just a better version of Kerberos? I can't find anything about this. If you set up a Radius server in a modern network do you need Kerberos at all?
6
votes
3answers
1k views

Is SESAME really used in Europe?

I am looking at a text that mentions that the Secure European System for Applications in a Multi-vendor Environment (SESAME) was designed to address some of Kerberos weakness, with enhancements such ...
6
votes
2answers
1k views

How secure is Kerberos?

I recently got interested about Kerberos and Radius, and I already found some information about their difference. But, I got curious about how secure Kerberos actually is. I see from the official ...
6
votes
1answer
2k views

Relative merits of Heimdal and MIT Kerberos?

What are the relative advantages of Heimdal and MIT Kerberos now MIT is freely exportable? Ones I've come across so far that might be relevant to my particular project is that it seems MIT supports ...
5
votes
2answers
1k views

Continued Use of Kerberos

I posted this question over on Crypto.SE, but didn't get any takers and thought it might be more suited for this site as it were, so I'm cross posting it here. I was recently looking through the Mac ...
5
votes
3answers
313 views

Kerberos for sending secrets

I understand that Kerberos is used as an authentication protocol. However, would it be possible to achieve a similar effect as Diffie-Hellman with Kerberos i.e. establish a session key which can be ...
5
votes
1answer
3k views

Why should I trust a JSON Web Token (JWT)?

In the SAML and Kerberos authentication models, there is an explicit understanding of what authority has authenticated the user and issued the credential to be trusted by downstream systems. For ...
5
votes
0answers
2k views

krb5 and pam_mount [closed]

I successfully installed and configured krb5 on a Red Hat 6.4 server, now I can authenticate against an active directory with kerberos. pam_mount is installed and configured, but it only mounts a ...
4
votes
1answer
199 views

Are the SSL Digital Security Certificates based on Kerberos Network Security Protocol

I just want to know if digital certificates use the kerberos session key algorithm.
4
votes
1answer
4k views

Kerberos replay attack

Suppose I want to send a command to a print server on a netwerk that has been secured with Kerberos. To do so, I authenticate myself to the KDC and get a TGT, and then another ticket from the TGS for ...
4
votes
1answer
199 views

Kerberos Protocol

I've read a number of articles about Kerberos and most of them mention that the final step of the server responding to the client is optional: Kerberos application server response (optional) (...
4
votes
1answer
2k views

SAML Assertion to Windows Identity (Kerberos token?) transformation

This is the scenario I need to cover: A WebService that trusts on an IdP using Ws-Trust or any thing like that, receives a SAML token to authenticate the user, and we need to call some SQL Server or ...
4
votes
1answer
220 views

Do public keys make Kerberos more secure (RFC4556)?

We're using IPA to centralize our authentication and I found an option to add a public key for each user. After doing a little research I found this to be an extension to Kerberos 5, RFC4556. From my ...
4
votes
1answer
171 views

Kerberos: What is the structure for preauthentication with certificate (RFC 4556)

I'm struggling to understand what the structure of a preauthentication request in kerberos should look like. After reading RFC 4556 and the referenced RFCs I'm still confused because of all the ...
4
votes
1answer
330 views

Kerberos Authentication

I am trying to understand Kerberos Authentication. So far my understanding is: Supposing 'Alice' (A) wants to talk to 'Bob' (B). Step 1: A -> S: {A, B, None} K(A, S) Where S is the Kerberos ...
4
votes
0answers
137 views

Kerberos Attacks Questions

It's amazing how many "Attacks on Kerberos" articles exist out there and almost none really explains the small details. My guess is that usually they assume it's basic knowledge and sometimes, they ...
4
votes
1answer
587 views

cracking krb5 passwords (des3-hmac-sha1 and des-cbc-crc ) [closed]

I'm trying to audit kerberos passwords. The available formats are des3-hmac-sha1 and des-cbc-crc but I cannot find a possibility/a tool to crack them. For other hash-types I used John the Ripper, but ...
3
votes
2answers
186 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
3
votes
2answers
318 views

Can I pass a cryptographic hash of a user's password to Kerberos while creating principals?

I am running MIT Kerberos V and I would like to automate the creation of principals. The page here explains how to do this by providing principal names and passwords on the command line like so: awk '...
3
votes
2answers
86 views

Is SQL auth over windows auth a red flag?

I'm working on something where using windows authentication to SQL server is difficult if not impossible. My team member is adamant that using SQL auth is much more difficult to manage and is a major ...
3
votes
1answer
1k views

Is a Kerberos ticket valid with only one-way external trust between domains?

The situation is that I have two domains (Domain A and Domain B) that live on separate networks. I need to allow users in B to be authenticated with integrated windows authentication (IWA) when they ...
3
votes
1answer
460 views

Kerberos Authorization host/service by host/service basis

I understand that Kerberos is for Authentication not Authorization, but Is it possible to get Kerberos to refuse to Authenticate certain users on specific hosts? I am currently using LDAP for /etc/...
3
votes
1answer
975 views

Kerberos realm understanding

Could someone summarise why realms are necessary in Kerberos and the advantages of the concept. I'm struggling to isolate everything I know / beginning to understand into some well defined points for ...
3
votes
1answer
1k views

How secure is GSSAPI single-signon over SSH?

I know it is possible to integrate Linux/SSH logins with a Windows AD by using GSSAPI (Kerberos) authentication instead of the classic ssh keys and/or passwords. However, I have been unable to find ...
3
votes
0answers
187 views

Detect Kerberoasting activity

I am working to detect kerberoasting activity and I am referring this link. It states that an account cannot be requesting several different service names within a second or two of each other. What is ...
3
votes
0answers
118 views

Distinct databases with the same Kerberos Authentication server [closed]

Should two deployed applications within a private network requiring distinct databases (for storing their own users credentials) require distinct Authentication servers (implementing Kerberos)? Or is ...
2
votes
1answer
259 views

How do we encrypt a password using another password?

An article on Kerberos goes like this: The problem is, Charon cannot give you the password directly, because then you would know it. [....] So instead of giving you the mail server's password, ...
2
votes
1answer
209 views

Can Kerberos encrypt network traffic between servers?

Working in a coporate environment, which uses Active Directory, I overheard someone making a comment stated the Kerberos protcol can be used to encrypt network traffic between Windows servers. Can ...
2
votes
2answers
4k views

What is inside a Kerberos TGT ticket?

I would like to know what makes up a TGT ticket? The reason is that we've noticed the more Windows AD groups the account is in, the larger the size of the ticket. We've also noticed that when we clear ...
2
votes
1answer
3k views

How does Kerberos protect against replay attacks?

I have been reading about Kerberos, and I understand the messages exchanged, and that it uses symmetric encryption in order to protect some of the messages. But, how does it protect against replay ...
2
votes
1answer
420 views

What good does the Kerberos Authentication Server

I currently try to understand the Kerberos protocol. And I think I understand the parts of it. How Alice gets a ticket from the Authentication Server to authenticate herself to the ticket granting ...
2
votes
1answer
78 views

Certificates for autoscaling internal networks?

A public website with an SSL certificate makes use of a certificate and CA in order to establish trust between the server and client. How is the same thing typically implemented on private networks, ...
2
votes
1answer
269 views

Secure Authentication options for NFS

Are there any Secure Authentication for NFS other than Kerberos?
2
votes
1answer
4k views

How to test ldap that authenticates with kerberos

I want to test an ldap directory with ldapsearch. No passwords are stored in the LDAP directory. Account passwords are stored in Kerberos and LDAP contains a pointer to the Kerberos principal. The ...
2
votes
1answer
892 views

secret key compromise in SSL vs in Kerberos

Consider the consequences of compromise of a secret key in the Kerberos system vs. in SSL. For example, suppose your individual shared secret key (for your user account) becomes compromised (i.e. it ...
2
votes
2answers
242 views

Kerberos unconstrained delegation for user

I've noticed that there is an option to set "Trust this user for delegation to any service" that can be set for service users. I've read a lot about unconstrained delegation with regards to computers ...
2
votes
1answer
81 views

Does Kerberos support vendor specific attributes?

As the question title says: Does Kerberos support vendor specific attributes allowing access segmentation within a given client device?
2
votes
1answer
355 views

On NFSv4 with kerberos security

When NFSv4 is configured to use kerberos authentication is mandatory to have a keytab installed on every client with is own principal. To access files a user still needs to be authenticated with his ...
2
votes
1answer
966 views

What does Microsoft mean by “Trusted Domain” in relation to Kerberos?

In the Microsoft documentation about using Kerberos, it is stated that: Both the server and the client computers must be members of the same Windows domain or members of trusted domains. If this ...
2
votes
1answer
155 views

Is a keytab sufficient for logon?

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. ...
2
votes
1answer
708 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...