Kerberos#
The Kerberos KDC/Kadmin components are implemented using the MIT Kerberos software. It provides authentication services for the entire FreeIPA realm, it’s users services and other components. Kerberos server is one of the base stones of a FreeIPA server.
How it works#
When you run kinit command you invoke a client that connects to the
Kerberos server, called KDC. As a result of the authentication the
client receives a ticket. This ticket is a temporary pass or better say
a pass-book. The best example from the real life will a be pass to a
movie festival. A pass to such festival would allow someone to attend
different movies at their discretion. Kerberos is very similar. When
user tries to access some kind of resource protected by Kerberos the
resource requires the user to present a valid ticket – same as with the
movies.
To get such a ticket the user needs to prove that he is who he is.
Asking user to authenticate with his password all the time might be too
annoying and hard to manage. This is why there is a multi tier process.
First user authenticates and gets so called TGT (ticket granting
ticket). This ticket can be presented to Kerberos server at any moment
and a new ticket specific to the resource the user wants to access can
be acquired. All the tickets have a configurable expiration time (run
ipa help krbtpolicy to get more information) so user needs to
re-authenticate from time to time but it is much less of a burden.
When SSSD project is used, the ticket is get for a user automatically as he authenticates to client machine.
Data#
MIT Kerberos KDC server reads all the user and service identity information from a Directory Server. FreeIPA implements an own ipa-kdb KDC data backend implementation reading and writing all the required information to LDAP tree. The provides both basic identity retrieval function, but also more advanced features, like verifying, signing and producing Kerberos ticket MS-PAC extension when Trusts are in place.
Kerberos-Specific Terminology#
authentication server (AS) : A server that issues tickets for a desired service which are in turn given to users for access to the service. The AS responds to requests from clients who do not have or do not send credentials with a request. It is usually used to gain access to the ticket-granting server (TGS) service by issuing a ticket-granting ticket (TGT). The AS usually runs on the same host as the key distribution center (KDC).
ciphertext : Encrypted data.
client : An entity on the network (a user, a host, or an application) that can receive a ticket from Kerberos.
credentials : A temporary set of electronic credentials that verify the identity of a client for a particular service. Also called a ticket.
credential cache or ticket file : A file which contains the keys for encrypting communications between a user and various network services. Kerberos 5 supports a framework for using other cache types, such as shared memory, but files are more thoroughly supported.
crypt hash : A one-way hash used to authenticate users. These are more secure than using unencrypted data, but they are still relatively easy to decrypt for an experienced cracker.
GSS-API : The Generic Security Service Application Program Interface (defined in RFC-2743 published by The Internet Engineering Task Force) is a set of functions which provide security services. This API is used by clients and services to authenticate to each other without either program having specific knowledge of the underlying mechanism. If a network service (such as cyrus-IMAP) uses GSS-API, it can authenticate using Kerberos.
hash : Also known as a hash value. A value generated by passing a string through a hash function. These values are typically used to ensure that transmitted data has not been tampered with.
hash function : A way of generating a digital “fingerprint” from input data. These functions rearrange, transpose or otherwise alter data to produce a hash value.
key : Data used when encrypting or decrypting other data. Encrypted data cannot be decrypted without the proper key or extremely good fortune on the part of the cracker.
key distribution center (KDC) : A service that issues Kerberos tickets, and which usually runs on the same host as the ticket-granting server (TGS).
keytab (or key table) : A file that includes an unencrypted list of
principals and their keys. Servers retrieve the keys they need from
keytab files instead of using kinit. The default keytab file is
/etc/krb5.keytab. The KDC administration server,
/usr/kerberos/sbin/kadmind, is the only service that uses any other
file (it uses /var/kerberos/krb5kdc/kadm5.keytab).
kinit : The kinit command allows a principal who has already logged in to obtain and cache the initial ticket-granting ticket (TGT). Refer to the kinit man page for more information.
principal (or principal name) : The principal is the unique name of a user or service allowed to authenticate using Kerberos. A principal follows the form root[/instance]@REALM. For a typical user, the root is the same as their login ID. The instance is optional. If the principal has an instance, it is separated from the root with a forward slash (“/”). An empty string (“”) is considered a valid instance (which differs from the default NULL instance), but using it can be confusing. All principals in a realm have their own key, which for users is derived from a password or is randomly set for services.
realm : A network that uses Kerberos, composed of one or more servers called KDCs and a potentially large number of clients.
service : A program accessed over the network.
ticket : A temporary set of electronic credentials that verify the identity of a client for a particular service. Also called credentials.
ticket-granting server (TGS) : A server that issues tickets for a desired service which are in turn given to users for access to the service. The TGS usually runs on the same host as the KDC.
ticket-granting ticket (TGT) : A special ticket that allows the client to obtain additional tickets without applying for them from the KDC.
unencrypted password : A plain text, human-readable password.