The first key between the client and the AS is based on the client’s password.Ģ. The Kerberos authentication process uses three different secret keys.ġ. Now the client can use the targeted server for a limited time (which is set by the token). The targeted server will decrypt the token with the TGS shared key. This third key is shared between the TGS and the targeted server.įinally, the client sends the token to the client-server. The TGS issues a token for the client, that it encrypts with another key. When the TGS receives the TGT, it decrypts it with a secret key that he shares with the AS. The TGT is encrypted with a different secret key.Īfter the client gets the TGT, he sends it to the TGS along with his request to access the target server. This is how the AS verifies the user.Īfter verifying the client, the AS sends the client a Ticket Granting Ticket (TGT). The AS uses the client’s password to decrypt his request. This request is partially encrypted with his password’s secret key (so that a plain password won’t be sent over an insecure network). He presents to the AS his User ID, and requests a ticket to the targeted server. When a client wants to verify himself to the KDC, he first connects with the AS. He first must verify himself to a trusted third party- Key Distribution Center (KDC). Suppose a client wants to connect a server. Kerberos requires both the server and the client to verify themselves. This blog post will discuss the basics of Kerberos protocol: By automating the hardening process you won’t be risking production outages. The best approach for this task is using automation. This is a critical hardening task, to ensure your attack surface is as small as possible. The main challenge is finding where you can shift to Kerberos. Since some operations still need to use NTLM, Microsoft hasn’t yet disabled it. It is important to make sure you use Kerberos protocol when possible. Kerberos messages are resilient against eavsdropping and replay attacks. The user database in this case is on the Domain Controller (DC).Īctive Directory (AD) is a component running on the DC that implements the Kerberos account database (containing users and passwords). Kerberos is the default protocol used when logging into a Windows machine that is part of a domain. It is designed for client-server applications and requires mutual verification.

Active directory kerberos