{"id":6621,"date":"2012-11-08T09:56:32","date_gmt":"2012-11-08T14:56:32","guid":{"rendered":"http:\/\/jianmingli.com\/wp\/?p=6621"},"modified":"2023-07-12T10:09:31","modified_gmt":"2023-07-12T15:09:31","slug":"kerberos-2","status":"publish","type":"post","link":"https:\/\/jianmingli.com\/wp\/?p=6621","title":{"rendered":"Windows 2000 Kerberos Authentication"},"content":{"rendered":"
\n

Contents<\/h2>\n
    \n\t
  1. \n\t\tOverview<\/a>\n\t\t
      \n\t\t\t
    1. \n\t\t\t\tBenefits of Kerberos<\/a>\n\t\t\t<\/li>\n\t\t\t
    2. \n\t\t\t\tThree Heads of Kerberos<\/a>\n\t\t\t<\/li>\n\t\t\t
    3. \n\t\t\t\tKey Distribution Center: KDC<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
    4. \n\t\tKey Exchanges<\/a>\n\t\t
        \n\t\t\t
      1. \n\t\t\t\tAS Exchange<\/a>\n\t\t\t<\/li>\n\t\t\t
      2. \n\t\t\t\tTGS Exchange<\/a>\n\t\t\t<\/li>\n\t\t\t
      3. \n\t\t\t\tCS Exchange<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
      4. \n\t\tKerberos in Active Directory<\/a>\n\t\t
          \n\t\t\t
        1. \n\t\t\t\tTGT<\/a>\n\t\t\t<\/li>\n\t\t<\/ol>\n\t
        2. \n\t\tReferences<\/a>\n\t<\/li>\n<\/ol>\n<\/ol>\n<\/div>\n
           <\/div>\n

          Overview<\/h2><\/span>\n

          * Kerberos provides authentication and<\/em> crypto over the network<\/strong>.<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          Benefits of Kerberos<\/h3><\/span>\n

          * Faster connections:
          \n– server does not need to contact domain controller (DC) in order to authenticate clients.
          \n– clients carries with them session tickets for target servers.
          \n* Mutual authentication:
          \n– two way authentication between server and client
          \n* Delegated authentication:
          \n– proxy mechanism that allows a Windows service to impersonate its client when connecting to other services
          \n* Simplified trust management
          \n– trusts are mutual and transitive
          \n* Interop with non Windows 2000 network resources via on Kerveros 5<\/p>\n

          Three Heads of Kerberos<\/h3><\/span>\n

          * Key Distribution Center (KDC)
          \n* User Client
          \n* Server resource<\/p>\n

          Key Distribution Center: KDC<\/h3><\/span>\n

          * KDC runs on a physically secure server.
          \n* KDC maintains a database with account info for all security principals in its realm aka domain.
          \n* KDC stores a cryptographic key known only to the security principal and the KDC.
          \n– aka long-term key<\/strong> which is usually derived from user password, e.g. hash value.<\/p>\n

          Key Exchanges<\/h2><\/span>\n

          AS Exchange<\/h3><\/span>\n

          * AS: Authentication Service<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          TGS Exchange<\/h3><\/span>\n

          * TGS: Ticket Granting Service<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          CS Exchange<\/h3><\/span>\n

          * CS: Client Server<\/p>\n

          \"\"<\/a><\/h6><\/span>\n

          Kerberos in Active Directory<\/h2><\/span>\n

          * Integral part of AD 2000 (NTLM only before it)
          \n* Uses Kerberos verion 5
          \n* KDC is part of domain controller and servers as:
          \n– the Authentication Service (AS)
          \n– the Ticket Granting Service (TGS)<\/p>\n

          TGT<\/h3><\/span>\n

          * TGT is
          \n– valid for the local domain
          \n– cached on local machine in volatile memory space
          \n– used to request sessions with services throughout the network
          \n* TGT contains two sections:
          \n– a TGT ticket encrypted with a key that only<\/strong> KDC(TGS) can decrypt
          \n– a session key<\/strong> encrypted with user’s password hash to handle future communications
          \n* TGT includes:
          \n– TTL which defaults to 8 hrs
          \n– authorization data
          \n– session key<\/p>\n

          References<\/h2><\/span>\n

          * Windows 2000 Kerberos Authentication<\/a>
          \n*           Kerberos: The Network Authentication Protocol<\/a>
          \n*           http:\/\/www.mcmcse.com\/microsoft\/guides\/kerberos.shtml<\/a>
          \n*           Kerberos Explained<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

          Overview * Kerberos provides authentication and crypto over the network. Benefits of Kerberos * Faster connections: – server does not need to contact domain controller (DC) in order to authenticate clients. – clients carries with them session tickets for target … Continue reading →<\/span><\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_exactmetrics_skip_tracking":false,"_exactmetrics_sitenote_active":false,"_exactmetrics_sitenote_note":"","_exactmetrics_sitenote_category":0,"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[287],"tags":[275,628],"class_list":["post-6621","post","type-post","status-publish","format-standard","hentry","category-kerberos","tag-ad","tag-kerberos"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"jetpack_shortlink":"https:\/\/wp.me\/p8cRUO-1IN","_links":{"self":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/6621","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6621"}],"version-history":[{"count":5,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/6621\/revisions"}],"predecessor-version":[{"id":12936,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=\/wp\/v2\/posts\/6621\/revisions\/12936"}],"wp:attachment":[{"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6621"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6621"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jianmingli.com\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6621"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}