Kerberos
Following adds this technology to your private workspace so related learning is easier to organise and revisit.
What is Kerberos?
Kerberos is a ticket-based network authentication protocol that lets users access services without repeatedly sending passwords. This profile connects the concept to KBY's practical engineering guidance.
A trusted Key Distribution Centre issues time-limited ticket-granting and service tickets protected with shared or public-key-derived secrets. Accurate time, service principal names, DNS and key management are critical to reliable operation.
Provide mutual, centralised authentication across an untrusted network.
- Enterprise single sign-on
- Active Directory authentication
- Secure network service access
6 resources for Kerberos
Browse by purpose, from definitions and learning through operations, diagnostics and controlled recovery.
Learn and operate with Kerberos
Ordered as a reader progression -- from core definitions through to operational reference -- using only the content already connected in the technology registry.
Lexicon Definitions(1)
Start here: understand the core vocabulary.
Systems Engineering(1)
Learn the architecture, concepts and engineering context.
Config Traps(2)
Recognise and avoid known failure modes.
- Kerberos Delegation Set to 'Kerberos Only' Blocks TransitionSelecting 'Use Kerberos only' for AD constrained delegation feels like the safer choice, but it quietly disables protocol transition and breaks non-Kerberos client authentication. Open
- msDS-SupportedEncryptionTypes: RC4 Still Wins KerberosWhen a service account's msDS-SupportedEncryptionTypes attribute is left unset or still includes RC4, any domain-authenticated user can request a TGS ticket for its SPN and crack the account's password offline. Domain-wide AES enforcement does not override this per-account gap, so the weakest cipher the KDC will negotiate still wins. Open
Incident Runbooks(2)
Stabilise, recover and validate during incidents.
- Active Directory krbtgt account password not rotated after suspected compromise, leaving golden tickets valid indefinitelyAfter a suspected DCSync or ntds.dit extraction, responders reset the krbtgt password only once. Because krbtgt retains two valid key versions for replication continuity, the compromised hash remains usable as the n-1 key, letting previously forged golden tickets continue authenticating across the domain until a second rotation is completed. Open
- Active Directory unconstrained Kerberos delegation enabled on domain controllers or service accounts, enabling golden ticket lateral movementA server or service account carries the TrustedForDelegation flag with no resource restriction, so its LSASS cache retains full TGTs from every account that authenticates to it. When that server is coerced into authenticating a domain controller's machine account, the captured DC ticket is replayed for DCSync, exposing the krbtgt hash and enabling forged golden tickets domain-wide. Open