The Stack Overflow podcast is back! Listen to an interview with our new CEO.

Questions tagged [kerberos]

Kerberos is a network authentication protocol designed to allow nodes, communicating over a non-secure network, to prove their identity to one another in a secure manner.

Filter by
Sorted by
Tagged with
2
votes
1answer
1k views

What does Microsoft mean by “Trusted Domain” in relation to Kerberos?

In the Microsoft documentation about using Kerberos, it is stated that: Both the server and the client computers must be members of the same Windows domain or members of trusted domains. If this ...
2
votes
1answer
156 views

Is a keytab sufficient for logon?

Is possession of a Kerberos .keytab file (as generated by e.g. ktpass) sufficient to 'pretend to be' that user on a windows machine? For example, create a process as, or access network resources (e.g. ...
2
votes
1answer
715 views

Smart lock protocol

I made an Arduino project to lock and unlock my door via my phone (with Bluetooth). It works well but it’s unsafe since I just send the lock and unlock command in cleartext, without authentication or ...
2
votes
1answer
96 views

Remote network security option

I'm a bit confused with some different network security techniques. Say we want a secure communication with a particular mail server in a remote company network. Reading and sending mails should be ...
2
votes
1answer
1k views

Public web server and AD- based Kerberos authentication

I would want to use SPNEGO/Kerberos protocol on a public internet webserver for specific remote ip addresses coming from corporate intranet. Other authentications methods are used for other addresses (...
2
votes
1answer
633 views

Kerberos ticket lifetime

I was just reading up on Kerberos and realized that the lifetime of a master ticket called the TGT(ticket granting ticket) is 25 hours. Is there any particular reason behind this choice of lifetime?
2
votes
0answers
34 views

How to update authorization information in a KDC dynamically?

I wish to add Kerberos authentication and authorization into a project that has a service server that interacts with a Hadoop cluster that has some users and permissions. As far as I know, the KDC ...
2
votes
0answers
643 views

Web API authentication with Kerberos

We are implementing a web application that uses Kerberos for authentication. In the browser there is no concerns, so it works perfect. Now we need to supply a subset of web application services via ...
2
votes
0answers
68 views

Kerberos Constrained Delegation

I have 4 machines, one machine with Domain Controller, one machine with Analysis Services, one machine with IIS Services, one machine with the Application The goal is to open the application and the ...
1
vote
2answers
148 views

What is the niche that Kerberos authentication fills called?

Keberos authentication is a bit of a top down concept. I'm working my way up to it from the bottom learning from the bottom up. It seems to me that Keberos authentication can be thought of as a glue ...
1
vote
1answer
813 views

How does resetting passwords twice increase security after a breach?

In regards to https://mva.microsoft.com/en-US/training-courses/how-to-avoid-golden-ticket-attacks-12134 They mention several times that resetting not only AD passwords twice but also local computer ...
1
vote
2answers
267 views

Kerberos authentication question

I was reading about kerberos authentication and how the password is not transferred on the wire but it exist in the kdc database to encrypt or decrypt messages, and only tickets are transferred after ...
1
vote
1answer
382 views

In Kerberos, how does a client authenticate the KDC?

How does a client know whether it is talking with a real or fake KDC? Is it based on the system configuration, similar to DNS?
1
vote
3answers
3k views

Need help understanding Windows Authentication mechanism

Even if I enforce HTTPS and use anti-forgery tokens, it seems like Windows Authentication could be inherently insecure because it does not require that the user explicitly passes credentials from the ...
1
vote
2answers
1k views

How to avoid DDOS against Kerberos Authentication Server

I have a school project where i am supposed to implement a Kerberos based infrastructure (AS, TGS and resource server). It is already done and working, but i started thinking about how to protect the ...
1
vote
1answer
865 views

Kerberos IIS Authentication over HTTP

I've reviewed the RFCs and am pretty familiar with Kerberos. It seems to me that over a non-encrypted link (HTTP), Kerberos doesn't leak the user's password (or hash based challenge/response like ...
1
vote
1answer
158 views

Linux authenticating against Active Directory, is one keytab for all Linux machines enough?

We have lots of Linux (RHEL) machines authenticating against Active Directory. Is one keytab for all Linux machines enough? Do we need one keytab for each machine? What are the PROS and CONS? What ...
1
vote
1answer
64 views

Is there any existing attempted implementation of GSS-API/SPNEGO/GSS-SPNEGO for anything other than Kerberos / NTLM?

I'm aware that SPNEGO is de-facto only used in the wild for Kerberos or NTLM. Is there any research / academic / educational example on how it can be also used for other mechanisms as well?
1
vote
1answer
82 views

Kerberos replay attack within allowed range - authenticator won't prevent it?

In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request. What if an attacker performs a replay attack within ...
1
vote
1answer
156 views

In the Kerberos protocol, what prevents clients from decrypting a service's secret key?

I'm studying the Kerberos protocol at a high level of abstraction. As I understand it- when a client wants to request a service, it first receives two messages from the TGS. A: encrypted with the TGS/...
1
vote
1answer
993 views

Monitoring Kerberos Authentication Traffic

I had developed an application that uses Windows Authentication in order to authenticate users in single hop. Then I developed this application in order to authenticate users again with Windows ...
1
vote
1answer
40 views

Clock consensus of parties in Kerberos v5

Lets say two parties (A and B) use kerberos v5 and they happened to have varied clocks which is more than 10 mins window time of Kerberos. How does Kerberos still enable them to arrive consensus at a ...
1
vote
1answer
4k views

Best way to deal with cross-domain authentication in intranet

Firstly, I'm not sure if this is valid board to ask this question - maybe it should be asked on StackOverflow? Overview on use-case, what we trying to achieve: Two servers, on two different domains; ...
1
vote
1answer
1k views

Cannot contact my realm for credentials [closed]

I have created a KERBEROS.TEST realm on my Ubuntu 14.10 virtual machine and after addprinc root/admin also I added my client machine as principal. I checked kinit and with sudo klist command I ...
1
vote
1answer
978 views

Hash Security of Windows 7 Password

I need to find some materials about how Security Accounts Manager(SAM) works in windows 7+. I am confused with the storage format of hashed value. Many materials (such as, 1) tells me that it uses ...
1
vote
1answer
54 views

Kerberos over http documentation

The NTLM over HTTP documentation can be found here https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-ntht/f09cf6e1-529e-403b-a8a5-7368ee096a6a Where is the Kerberos over HTTP official ...
1
vote
0answers
90 views

How to decode kerberos tickets on wireshark? [closed]

It has been two days in a row that I spend hours trying to decrypt kerberos traffic using wireshark. For learning purposes, I want to be able to read the encrypted parts of tickets and authenticators ...
1
vote
0answers
70 views

Does kerberos support a grace period in password changes?

The principles are programs instead of human. I want to rotate their password regularly, using random generated password, and then deliver the new password to the programs. I have a mechanism to make ...
1
vote
0answers
54 views

Bruteforcing via port 88 on MacOS

Macos has open port 88 by default. Is it possible to check validity of the password via this port from Linux and how? If the vncserver is active, it is possible to know also the username (by ...
1
vote
0answers
27 views

How much time is needed for bruteforce kerberos/ntlm?

My question is simply how much time an attacker needs for full bruteforce on typical complexity password policy given either kerberos ticket/ as req or Ntlm transaction. This depends on the ...
1
vote
0answers
39 views

How to retrieve Kerberos Service tickets?

I am learning Kerberoasting see below are my steps that I am following. Step:1. Attacker will find the SPN's Step:2. After identifying we will request for TGS for that SPN. This is the script for ...
1
vote
0answers
141 views

Use Kerberos Golden Ticket with Metasploit

Having compromised a domain controller during testing, I now wish to create persistent domain admin access. Also, operational security is important for me as I don't want to be logging into netowkr ...
1
vote
0answers
34 views

Questions regarding pass the ticket

In the blackhat talk by Gentikwiki on Mimikatz back in 2014, he mentioned that you can pass the service ticket also, but i am unable to replicate it in a lab. It throws an access denied. Passing the ...
1
vote
0answers
38 views

Kerberos Protocol Centralized Server

If a small company is expanding with various branches across the country, how would the kerberos centralized server be configured? Are the new users assigned new ticket granting servers or are they ...
1
vote
0answers
18 views

Why the need for user ID in ticket AND authenticator (Kerberos)?

I am currently learning about Kerberos. Why the following in Kerberos v4: Client -> Service : Ticket_Service || Authenticator_Client where Ticket_Service: E(K_S, [K_C,S || ID_C || ...]) and ...
1
vote
0answers
496 views

How do I lookup the UID of a domain user?

I'm playing with golden ticket (mimikatz) kerberos::golden /domain:vln2012.local /sid:S-1-5-21-3871786346-2057636518-1625323419 /rc4:8ad36fef31e071eac7ab9d54a093cb54 /user:user1 /id:1109 /groups:500,...
1
vote
0answers
109 views

LDAPS needed when using Kerberos?

In the past two years i built up a small office with more needs every day. At some point i needed a DC with Kerberos. All Server (CentOS besides the DCs) communicate over Kerberos with the DC. Since ...
1
vote
0answers
710 views

Kerberos and brute-force attacks

Suppose that I am the administrator of a system that uses Kerberos and password authentication. How can I make brute-force attacks on user’s passwords by an attacker who can capture network traffic ...
1
vote
1answer
2k views

Kerberos: kadmin.local: No such file or directory while initializing kadmin.local interface (cloudera quickstart) [closed]

I am running (as sudo) a script for setting up Kerberos (which I will paste below) on a CentOS machine (in a Cloudera Quickstart Docker container). The strange thing is that I have successfully ran ...
1
vote
0answers
2k views

Exception: krb_error 0 Do not have keys of types listed in default_tkt_enctypes

I am looking for your help with one Exception we are getting while setting up our Kerberos SSO. I will briefly give an overview of our setup and things we tried till now and exception we are getting: ...
1
vote
1answer
191 views

Kerberos composite authentication that reflects user's origin

I'm experimenting with Kerberos and was wondering if some sort of composite authentication that identifies both a user and the origin of the users request was a) possible and b) implemented anywhere....
1
vote
0answers
135 views

In kerberos will a key for a host prinicpal work if the keytab containing the key is stored somewhere inaccessible to that host?

I'm following the instructions here: https://www.freeipa.org/page/Windows_authentication_against_FreeIPA to try to allow a Windows machine to authenticate logins against a FreeIPA server on RHEL. I'...
1
vote
0answers
71 views

What are some scenarios I would use MSFT Certificate Enrollment Web Services?

The Certificate Enrollment Policy Web Service and the Certificate Enrollment Web Service are made for non domain connected machines to retrieve certificates of various kinds. When setting this up, I ...
1
vote
0answers
50 views

is this optional keyword redundant? [closed]

KDC-REQ ::= SEQUENCE { -- NOTE: first tag is [1], not [0] pvno [1] INTEGER (5) , msg-type [2] INTEGER (10 -- AS -- | 12 -- TGS --), padata [3] SEQUENCE OF PA-DATA ...
1
vote
0answers
84 views

How to get Service_key and the corresponding function call interface from the Samba source TGS_REP part

1, My existing configuration environment are as follows: (1), Server_side, Redhat5.5 Enterprise with samba4.0.0 installed, Ip Address: 5.5.5.149; domain name: EXAMPLE.COM; (2), Client_side: windows ...
0
votes
2answers
822 views

2FA using Kerberos and SSO within CDE

I was wondering if anyone is using Kerberos for their 2FA solution into their CDE for PCI DSS compliance. Also, what does PCI DSS say about SSO once 2FA has occurred through a Radius Server?
0
votes
2answers
592 views

Windows Active Directory: How do endpoints authenticate the Domain Controller?

Windows Active Directory is based on Kerberos and LDAP. When authenticating via the Domain Controller, how does my endpoint know that it's really speaking to the DC? Likewise, AD can be used to ...
0
votes
1answer
225 views

Is MIT Kerberos supposed to ask for a password when authenticating to SSH?

According to my understanding of Kerberos, a client is supposed to only enter its password once for obtaining the TGT from the Kerberos server and the authentication against the web services (f.e. SSH,...
0
votes
1answer
40 views

SSO DNS SRV lookup

I'm pen testing the page (IdpInitiatedSignOn.aspx) of a web app which uses an SSO mechanism (Active Directoy Federated Services). The username field requires a domain (e.g. company) to preface the ...
0
votes
2answers
168 views

Windows / Sensitive Data / Prevent access by various process

It's my understanding if you're logged into your Windows PC as DOMAIN\DUDE.NAME and you have access to \DOMAINFILES\SECRET STUFF\SUPER SECRETS.xlsx any process you run can also access that file - ...