Let's talk about Kerberos Now what's with the name.
Kerberos is Greek for servers.
The three headed dog which guards the gates of Hades.
Why three headed Kerberos is a standard specified in RAFC 15:10 an RAFC 1964.
Unlike LAN Manager and Antolin manager it's based on three types of principles a principle is an identity
that can be authenticated to a Kerberos domain principles include users or user principle has a user
principal name or services a service has a service principal and then a principal can also be a key
distributor or any entity that manages keys.
What's this Kerberos apart from other protocols.
The protocol is based on tickets.
We'll talk about this soon.
An indirect impact of tickets is the ability to delegate credentials.
This is an interesting functionality that wasn't available in LAN Manager or any land manager the delegating
feature is often used in web applications
Kerberos can be used to establish a trust relationship between networks between two domains a domain
does not have to be a Windows domain but it has to be a Kerberos version 5 domain.
You can also prove your identity to a service for example to print documents on a network printer in
a way that doesn't require forwarding your encrypted password to the service
each principal needs to have their own secret in Active Directory domains Kerberos domains for authentication
to work.
The secret is known as a long term key.
The standard defines a long term key as a key extracted from a user's password you submit your password
and the long term key is generated from it in Windows it can also be a private key issued by a certification
center.
This is an expansion of the standard.
How does Kerberos user authentication work.
The first step is to establish your identity.
Your long term key is used for this purpose.
One of the strengths of Kerberos is that it doesn't over use a user's password.
It's forwarded to other nodes only when necessary.
Land manager and anti-landmine sure send out passwords to all systems that request them.
Also without a user's knowledge Kerberos doesn't do that.
Your long term key is sent only once to obtain a ticket granting ticket TGT
Kerberos for your password only to its trusted center.
Naturally the password is not in clear text what is sent is a time stamp encrypted with using the user's
long term key
stamp string is composed of date hour minute second and Zulu tag.
When does Kerberos domains always use Greenwich Mean Time will also describe later potential credentials
harvesting attack
an alternative method for authentication is using a smart card insert a card into a card reader in a
local computer and enter your PIN code
the Kerberos protocol which operates on a different computer will authenticate the user against the
data stored on the card.
This is a strikingly different arrangement from web applications deployed in banking where an identifier
is generated using for example a key generator a small gadget that creates random strings of digits.
You can use this mechanism also for authenticating to Windows but this generator is not linked in any
way to a domain controller.
A password generator authenticates users locally and other protocol is used later.
The two authentication methods operate on two completely different security levels
Kerberos makes use of a key distribution center a domain controller all controllers have a key distribution
center log on server functionality.
What's interesting is that a server that lets us access a printer is called a print server.
A server for storing files as a file server with a server that issues keys is called a key distribution
center and not a log on server.
The term can only be found in one error message if a user tries to log on when the KDC is unavailable.
You will see a prompted window.
There are no log on servers available to service a log on request a KDC has two tasks to do.
Its role is to generate manager T.G. TGT and service tickets.
A key distribution center is a machine that generates a number of random keys and manages them in some
way TGT tickets are used for authentication.
They serve as a temporary password a TGT last fall up to 10 hours when it's valid.
All services in a domain will uniquely identify a user based on that ticket.
If you would like to use a specific service you need to present a service ticket to that service.
We'll show you the exact mechanism in the moment a domain can have more than one key distribution center.
Note that the Kaytee sees have to share a secret.
If they don't it could happen that when one controller issues a TGT and it's deactivated a user wouldn't
be able to use a network because the second controller doesn't recognize the user
to make all controllers able to share secrets all controllers in a realm work in the KRIV TGT account.
This is defined and they are F.C. standard
this account seems inactive looking in its properties but you shouldn't delete it.
It is internally used by all domain controllers
since this account is the same within the domain.
It has the same password the same long term key all controllers can exchange secrets cross realm a key
distribution center has a secret to encrypt the TGT is it issues
or TGT ticket can be reused multiple times unless it expires or is revoked
let's look into the Kerberos domain authentication process.
A user is not yet logged onto a computer.
To be able to log on the user has to have a service ticket log on is a service a user has to authenticate
with a TGT ticket to obtain a service ticket and to obtain a TGT the user needs to first communicate
with a domain controller.
A user forwards an authentication request at this time a time stamp is encrypted using the user or Bob's
long term key and sent to the KDC KDC Senos all long term keys of a systems user's.
That's why it's able to decode the forwarded message and check the current time against the sending
time the default tolerance is five minutes this means that changing the system time has a direct bearing
on overall Windows security and requires administrator permissions.
If a user changes the clock by more than five minutes Kerberos authentication will fail.
Our local system doesn't give up yet it doesn't pop up an authentication failed message it tries another
authentication method anti LAN Manager if authentication succeeds a user will obtain a TGT ticket to
be able to use a server service.
You need to get a service ticket that is issued by a KDC or user presents a generated TGT ticket if
the user is authorized to connect to a specific service.
The KDC will issue a service ticket.
Now you can forward the service ticket to an applicable server and use the service provided that the
ticket is valid
a server that hosts a given service can verify it by contacting the KDC this robust solution eliminates
a number of security threats including the man in the middle attack even the four would be attacker
gains control of user service server interchanges.
It doesn't amount to much the attacker would have to take over user KDC interchanges.
It's easier to protect one or two key distribution centers than many service servers.
We've mentioned Kerberos credential delegation.
If you launch for example notepad the editor will run the credentials of the user who launched it.
This is obvious but what if the user runs a program that connects to another program running on a different
computer.
How is that user authenticated on a remote machine.
Kerberos is the only protocol that enables delegating credentials.
This functionality involves a service forwarding a user's ticket to another service on behalf of that
user.
It's useful for logging into Web sites that connect to a database server were visible in the server
as a user who is not connected to the computer Kerberos has only one security vulnerability and we'll
discuss it during a presentation that will show overall protocols threats
during this module.
We've talked about authentication and authentication methods LAN Manager and the land manager and Kerberos.
Version two protocols de-stressed the necessity to secure system passwords.
Thank you.