Jason Garman - Kerberos : the definitive guide ; [cross-platform authentication & single-sign-on ; covers Unix and Windows]

Dedicated in loving memory to my grandfather, Harry Stumpff.

Jason Garman

Copyright 2003 O'Reilly & Associates, Inc.

Printed in the United States of America.

Published by O'Reilly & Associates, Inc., 1005 GravensteinHighway North, Sebastopol, CA 95472.

O'Reilly & Associates books may be purchased for educational,business, or sales promotional use. Online editions are also availablefor most titles (.

Nutshell Handbook, the Nutshell Handbook logo, and the O'Reillylogo are registered trademarks of O'Reilly & Associates, Inc. Many ofthe designations used by manufacturers and sellers to distinguishtheir products are claimed as trademarks. Where those designationsappear in this book, and O'Reilly & Associates, Inc. was aware of atrademark claim, the designations have been printed in caps or initialcaps. The association between the image of a barred owl and the topic of Kerberos isa trademark of O'Reilly & Associates, Inc.

While every precaution has been taken in the preparation of thisbook, the publisher and author assume no responsibility for errors oromissions, or for damages resulting from the use of the informationcontained herein.

Kerberos is asophisticated network authentication systemone that has beenpublicly available since 1989 and provides that eternal holy grail ofnetwork administrators, single-sign-on. Yet, in that interveningdecade, documentation on Kerberos has been notably lacking. Whilemany large organizations and academic institutions have enjoyed thebenefits of using Kerberos in their networks, the deployment ofKerberos in smaller networks has been severely hampered by a lack ofdocumentation.

I decided to write this book precisely because of this lack of usefuldocumentation. My own experiences with Kerberos are those of extremefrustration as I attempted to decipher the documentation. I foundthat I had to keep copious notes to keep everything straight. Thosenotes eventually became the outline of this book.

Today, Microsoft, through its adoption of the latest Kerberosprotocol as the preferred authentication mechanism in its ActiveDirectory, has single-handedly driven the use of Kerberos into themajority of the operating-system market that it controls. Thanks tothe openness of Kerberos, organizations now can establishcross-platform, single sign-on network environments, giving anend-user one set of credentials that will provide him access to allnetwork resources, regardless of platform or operating system. Yetthe workings and benefits of Kerberos remain a mystery to mostnetwork administrators. This book aims to pull away the curtain andreveal the magician working behind the scenes.

This book is geared toward the system administrator who wants toestablish a single sign-on network using Kerberos. This book is alsouseful for anyone interested in how Kerberos performs its magic: thefirst three chapters will be most helpful to these people.

Here's a breakdown of how this book is organized:

Provides a gentle introduction to Kerberos, and provides an overviewof its history and features. It provides a gentle prologue bybringing you from the reasons for the development of Kerberos at MITthrough to the latest versions of the protocol.

Continues where left off, presenting anintroduction to the concepts and terminology that permeate the useand administration of Kerberos. The knowledge of these concepts isessential to the understanding of how Kerberos works as well as howto use and administer it.

Speaking of how Kerberos works, provides a detailed yet easy-to-followdescription of how the Kerberos protocol works and describes thenumerous encrypted messages that are sent back and forth.

Takes you from the realm of the theoretical and conceptual into thepractical aspects involved in administering a Kerberos system. Here,the Kerberos implementations that will be discussed throughout thebook are introduced, and the basics of the installation andadministration of a Kerberos authentication system are described.

When things go wrong with your Kerberos implementation, provides a methodology for diagnosingKerberos-related problems and demonstrates some of the more commonerrors that can occur.

Provides a detailed look at the practical security concerns relatedto running Kerberos.

Reviews some common software that can be configured to use Kerberosauthentication.

Provides information about more advanced topics in running a Kerberosauthentication system, including how to interoperate between Unix andWindows Kerberos implementations. This chapter also reviews howmultiple Kerberos realms can cooperate and share resources throughcross-realm authentication.

Presents a sample case study that demonstrates the implementationtasks presented earlier in a practical example.

Finishes off the book with a description of the future directionsKerberos is taking. We'll examine new protocolenhancements that will enable Kerberos to take advantage of newsecurity and encryption technologies.

Provides an in-depth reference on the various commands avialable toKerberos administrators.

The following conventions are used in this book.

Used for file and directory names and for URLs. It is also used toemphasize new terms and concepts when they are introduced.

Used for code examples, commands, options, variables, and parameters.

Indicates a replaceable term in code.

Indicates a tip, suggestion, or general note.

Indicates a warning.

We have tested and verified all of the information in this book tothe best of our ability, but you may find that features have changed,that typos have crept in, or that we have made a mistake. Please letus know about what you find, as well as your suggestions for futureeditions, by contacting: