Preface
Kerberos is a sophisticated network authentication systemone that has been publicly available since 1989 and provides that eternal holy grail of network administrators, single-sign-on. Yet, in that intervening decade, documentation on Kerberos has been notably lacking. While many large organizations and academic institutions have enjoyed the benefits of using Kerberos in their networks, the deployment of Kerberos in smaller networks has been severely hampered by a lack of documentation.
I decided to write this book precisely because of this lack of useful documentation. My own experiences with Kerberos are those of extreme frustration as I attempted to decipher the documentation. I found that I had to keep copious notes to keep everything straight. Those notes eventually became the outline of this book.
Today, Microsoft, through its adoption of the latest Kerberos protocol as the preferred authentication mechanism in its Active Directory, has single-handedly driven the use of Kerberos into the majority of the operating-system market that it controls. Thanks to the openness of Kerberos, organizations now can establish cross-platform, single sign-on network environments, giving an end-user one set of credentials that will provide him access to all network resources, regardless of platform or operating system. Yet the workings and benefits of Kerberos remain a mystery to most network administrators. This book aims to pull away the curtain and reveal the magician working behind the scenes.
This book is geared toward the system administrator who wants to establish a single sign-on network using Kerberos. This book is also useful for anyone interested in how Kerberos performs its magic: the first three chapters will be most helpful to these people.
Organization of This Book
Heres a breakdown of how this book is organized:
Provides a gentle introduction to Kerberos, and provides an overview of its history and features. It provides a gentle prologue by bringing you from the reasons for the development of Kerberos at MIT through to the latest versions of the protocol.
Continues where left off, presenting an introduction to the concepts and terminology that permeate the use and administration of Kerberos. The knowledge of these concepts is essential to the understanding of how Kerberos works as well as how to use and administer it.
Speaking of how Kerberos works, provides a detailed yet easy-to-follow description of how the Kerberos protocol works and describes the numerous encrypted messages that are sent back and forth.
Takes you from the realm of the theoretical and conceptual into the practical aspects involved in administering a Kerberos system. Here, the Kerberos implementations that will be discussed throughout the book are introduced, and the basics of the installation and administration of a Kerberos authentication system are described.
When things go wrong with your Kerberos implementation, provides a methodology for diagnosing Kerberos-related problems and demonstrates some of the more common errors that can occur.
Provides a detailed look at the practical security concerns related to running Kerberos.
Reviews some common software that can be configured to use Kerberos authentication.
Provides information about more advanced topics in running a Kerberos authentication system, including how to interoperate between Unix and Windows Kerberos implementations. This chapter also reviews how multiple Kerberos realms can cooperate and share resources through cross-realm authentication.
Presents a sample case study that demonstrates the implementation tasks presented earlier in a practical example.
Finishes off the book with a description of the future directions Kerberos is taking. Well examine new protocol enhancements that will enable Kerberos to take advantage of new security and encryption technologies.
Provides an in-depth reference on the various commands avialable to Kerberos administrators.
Conventions Used in This Book
The following conventions are used in this book.
ItalicUsed for file and directory names and for URLs. It is also used to emphasize new terms and concepts when they are introduced.
Constant Width
Used for code examples, commands, options, variables, and parameters.
Constant
Width
Italic
Indicates a replaceable term in code.
Tip
Indicates a tip, suggestion, or general note.
Warning
Indicates a warning.
Comments and Questions
We have tested and verified all of the information in this book to the best of our ability, but you may find that features have changed, that typos have crept in, or that we have made a mistake. Please let us know about what you find, as well as your suggestions for future editions, by contacting:
OReilly & Associates, Inc. |
1005 Gravenstein Highway North |
Sebastopol, CA 95472 |
(800)998-9938 (in the U.S. or Canada) |
(707)829-0515 (international/local) |
(707)829-0104 (fax) |
You can also send us messages electronically. To be put on the mailing list or request a catalog, send email to:
To ask technical questions or comment on the book, send email to:
We have a web site for the book, where well list examples, errata, and any plans for future editions. You can access this page at:
http://www.oreilly.com/catalog/kerberos/ |
For more information about this book and others, see the OReilly web site:
Thanks...
First, Id like to thank my editor at OReilly, Michael Loukides, without whom this book would not exist. His encouragement and direction (along with his seemingly infinite patience) allowed me to finish this book while sustaining only minor injuries.
There were many people who took the time to review this text and suggest valuable changes. These people, in no particular order, include Mike Lonergan, Ken Hornstein, Frank Balluffi, Robbie Allen, Mohammad Haque, and Marcus Miller. Their constructive criticism of my early drafts helped to make this book as complete and technically accurate as possible.
Id also like to thank the friends and co-workers who have provided support and entertainment during this process. Brian Dykstra, Brad Johnson, Mark Yu, Nan Ting, Keith Jones, and many others helped me finish this project through their encouragement over this past year.
And last but not least, Id like to thank my parents, Arthur and Mary Garman, who encouraged me to explore my interest in computers and provided me with the Commodore 64 that sparked my imagination.
Chapter 1. Introduction
Who are you? Its a question with an obvious response, at least for people. Humans have the ability to distinguish one another through several senses; most commonly, we use our sense of vision to recognize people we have met before. We also can tell one another apart through other means, such as body language, speech patterns and accents, and shared secrets between people. It has even been shown that newborn babies can discern between their mother and other females solely through their scent. Our ability to recognize patterns in our surroundings provides us with this ability to determine the identity of, or