41

Why doesn't the system admin just create a user account for each user on each server, so that the users can use their username and password to access whatever resources they wish to access? Imagine you have 50 users and 50 servers. For the sake of simplicity, suppose that all 50 users are supposed to have access to all 50 servers, they all have the same ...


27

Simply put, that would be an administrative nightmare. Kerberos allows administrators to have any number of employees use the same credentials to log into resources throughout their domain. Let's say that this didn't exist in a simple network. User enters password to unlock their computer. User wants to map a network drive. They must now need to re-enter ...


24

Can anyone describe/outline the relative merits of using Kerberos or LDAP for authentication in a large heterogeneous environment? LDAP authentication is centralized authentication, meaning you have to login with every service, but if you change your password it changes everywhere. Kerberos is single sign-on (SSO), meaning you login once and get a token ...


23

Arguably the reason Kerberos isn't used over the public Internet doesn't have to do with the security of the protocol, or the exposure of the KDC, but rather that it's an authentication model that doesn't fit the needs of most "public Internet" applications. To quote Wikipedia, Kerberos "provides mutual authentication — both the user and the server verify ...


19

Where possible use Kerberos authentication above all else. It was built for providing authentication/authorization and is the most secure option. The whole premise is to exchange credentials in an environment that isn't trusted. LDAP can be easily misconfigured to send credentials in clear text over the network. An easy way to prevent this is always use ...


13

Kerberos has multiple mature, interoperable implementations on major platforms with active user communities and under continuous development (MIT Kerberos, Heimdal, Microsoft, Java), and through standard abstraction layers such as GSSAPI and SASL, it is easy to use Kerberos either directly or indirectly to secure many standard applications and protocols, ...


12

Kerberos isn't there as a convenience, it's an enhanced security measure. Convenience is a secondary benefit. A great explanation is Designing an Authentication System: A Dialog in Four Scenes Basically, instead of just passing a magic token around (ie. your password), you obtain a "ticket", which is signed by a trusted source of truth (ie. Kerberos KDC, ...


10

The short answer is: no. It knows a secret key that may be derived from the user password. The specification RFC 1510 says in the introduction of section 6: It is desirable for the string to key function to be one-way, and for the mapping to be different in different realms. This is important because users who are registered in more than one ...


10

Kerberos will take verify your credentials and give you a "ticket" that you can use to prove to other systems/services that you are you. The ticket will expire, and doesn't contain your credentials. You have to be on the network for this to work. More information on Kerberos can be found here: MIT - Kerberos RADIUS is a way to get on the network. You give ...


8

This is about real, reversible, symmetric encryption. It is not related to storing a one way hash of a password. encryptedData = encrypt(data, key) data = decrypt(encryptedData, key) The very simple implementation of encrypt("bar", "foo") could return "hpg". key is the shared secret known to both Charon and the mail service. The linked article calls this ...


8

SAML is used over the Internet. If you have a web application you would use SAML. SAML is just a standard data format for exchanging authentication data. You would typically use it for a web SSO (single sign on). Kerberos is used in an enterprise LAN typically. Kerberos requires that the user it is authenticating is in the kerberos domain. Not really a lot ...


7

Kerberos itself is generally safe to use over the Internet. It was, after all, designed to be secure over one of the world's most hostile public networks: the MIT campus network. A Kerberos whitepaper, "Why is Kerberos a credible security solution?" addresses all of the points you raised. To quote in part: A password that is never disclosed or sent over ...


7

Radius task/purpose is to authenticate you at the specific point, i.e. in a web interface or pptp dialup-like server. Every point that needs authentication does a query to a Radius server for your credentials like login and password. Kerberos task/purpose is to distribute a trust to your session to all points connected/registered : you're performing your ...


7

To prevent lateral escalation. The administrative complexity of password management can be reduced by using a centralised password database, such as LDAP. However, doing so creates the risk of lateral escalation. If an attacker takes control of one server, they can remain silently present, sniffing passwords. These passwords can then be used to compromise ...


6

No they are very different in the most basic sense. Kerberos uses tokens for authentication built using a symmetric cipher. SSL allows you to pass secret data between two machines and uses asymmetric cryptography for authentication. It is possible to use kerberos and ssl together, but it is less common.


6

The answer is both yes and no, depending on what you mean. In the basic Kerberos model, ordinarily each principal in a realm shares a secret with the Kerberos authentication servers (Key Distribution Centers, or KDCs). (I say “ordinarily” because principals which will act only as clients can avoid sharing a secret and instead use other methods to ...


4

The biggest reason I can think of as to why they might want to use RC4 is because of compatibility with Jira (and or this custom auth backend that we cannot vet.) AES128 support was introduced along with Server 2008 and Vista, and AES256 with 2008 R2 and Win7. However, the KDC will automatically negotiate down to (for instance) RC4 when talking to, say, a ...


4

Yes, with some caveats. As a prior answer described, Kerberos authentication also shares a session key between the client and server principals, which they can use for further communication. Another prior answer claimed that “Kerberos is not an encryption protocol,” but this is not true: the protocol includes messages specifically for sending arbitrary data ...


4

It is difficult to determine what the authoritative source is for SESAME, which is an indication. The best link, which I'm sure you have seen, is from COSIC. The first paragraph states: SESAME (a Secure European System for Applications in a Multi-vendor Environment) is a European research and development project, ... All information and links for ...


4

This is stopped by authenticators. Whenever you present a Kerberos ticket, it must be accompanied by an authenticator, which is encrypted using the session key and contains (among other info) a timestamp. The server checks that the timestamp is recent (in Kerberos 4, this means "within 5 minutes;" in 5, it is configurable, but 5 minutes is the default) and ...


4

So, a JWT is just a token. It's not a protocol. As such you really can't compare the SAML protocol to a JWT as that would be like comparing apples to ducks. A JWT is just a bunch of identifying information signed by a cryptographic key. What you actually put in it is up to the protocol. There are some formal requirements that distinguish a JWT from a JWS ...


4

If an OS effectively remembers the current password and also the previous password to force a true password reset, you will need to change the password twice to flush the old password hashes from the system. This usually is mentioned when giving instructions to change the KRBGT account password on a Windows Domain with the added caveat that some time needs ...


4

Kerberos is still used widely in Windows server and clients are included in all major OS's. I would have to speculate to answer this really. All I can say is that, for it to have survived so long, it can't be all bad. It is, of course, limited mainly to private networks since both the server and the clients all have to trust the Kerberos server. This makes ...


4

Kerberos uses an 'authenticator' during protocol exchanges that occur between the client and the server. It holds additional authentication data, such as the ticket lifetime, and most important, the client's timestamp. When Server-Side Kerberos validates an authentication message, it will check the authenticator's timestamp. If the timestamp is earlier ...


4

Kerberos is used as an authentication protocol, but it's fundamentally a key agreement/exchange protocol. When a user gets a ticket from Active Directory for an application server a session key is generated and stuffed into the request. The application server decrypts the ticket and now has a session key. The server may decide it doesn't trust that key and ...


3

In fact they are the same, and that is called the Key Distribution Center (KDC). The kerberos has three heads (like a cerberus): The KDC that consists in the auth and the ticket granting system. The Service. The user of the service. The issue here is that what is really happening is: Alice authenticates herself against only one machine. Alice gets a ...


3

While not commonly used for the purpose, it can. As a side effect of mutual authentication, Kerberos principals share a cryptographically strong session key, that can be used to achieve confidentiality. Kerberos contains primitives to exchange encrypted (and authenticated) data between principals. They are exposed to an application as krb5_mk_priv() and ...


3

Kerberos is designed to be a pure authentication protocol. It actually builds a session ticket to proof your identity to the the server, it's not an encryption protocol (like SSL for instance).


3

Kerberos is essentially just for authentication, not authorization; however the ticket data structure has a field for authorization info, in case an implementer wants to encode such information in a credential. Unix implementations of Kerberos have mostly just left this field unused, but Microsoft chose to use it, and embeds a “privilege attribute ...


3

Not to say that SESAME was ever widely prevalent but it did have valid use and was extended/modified with the advent of RFC 1510. For instance, SESAME was part of secure CORBA implementation. I can't comment on a large ORB system that I know was in place even within the last 7 years but it did exist - presumably at the later stages only superficially... For ...


Only top voted, non community-wiki answers of a minimum length are eligible