Kerberos Network Design Manual By Dan Backman   Kerberos, a network security protocol developed MIT for its Athena computing environment is now a well-known, yet not well-understood technology. Named after the guardian of the underworld in Ancient Greek mythology, Kerberos (a.k.a.: Cerberus) uses strong encryption and a complex ticket-granting algorithm to authenticate users on a network. Also of interest to many of users, Kerberos has the ability to distribute "session keys" to allow encrypted data streams over an IP network. Used to secure particularly vulnerable network communications like FTP, telnet and other Internet protocols, which often transmit user IDs and passwords in clear text, Kerberos provides the backbone for secured communications in many large networks. Kerberos is available in many forms. However, for many organizations, it is an attractive choice as its reference platform (published and maintained by MIT), which includes full source code. Most Kerberos distributions also include APIs for developing new Kerberos-enabled (Kerberized) applications. While Kerberized services are best supported under Unix, clients are available for most major desktop operating systems like DOS, Windows95, Windows NT and MacOS. In addition to its pure form, Kerberos provides the core authentication services for computing environments such as the Open Group's (formerly, the Open Software Foundation) DCE (Distributed Computing Environment) as well as Microsoft Corp.'s forthcoming ADS (Active Directory Service). In this Network Design Manual, we relate our ongoing experiences with the Kerberos protocol in our Syracuse University labs. Although some organizations still rely on Kerberos 4, all examples and notation in this manual refer to Kerberos 5. This version includes several modifications, such as cross-realm authentication, forwardable tickets, and internal security enhancements, that make it the best choice for new installations. Some references to Kerberos' implementation in DCE are included, but this Network Design Manual is not intended to cover DCE. Network Security: The Basics The concepts behind network security break nicely into four categories: Authentication, Authorization (a.k.a. Access Control), Accounting, and Secure Communications. Authentication: This is simple verification of a user's identity. Always based on some form of trust, authentication relies on something that the user has, which can be compared to a known constant (the trusted value). This can occur either in an interaction with the user (a user ID and password are entered), or can range up to complex biometrics systems like fingerprint identification, face recognition or retinal scans. Authentication also can occur by proxy, such as a stored authentication token (kept in a workstation's memory while the user remains logged in, o r on a token such as a smartcard). Authorization: Also known as access control, this form of security decides who is allowed where. File permissions are a good example of access controls. Usually stored in resource-level ACLs (access control lists), these are simply lists of authenticated users (or groups of users) who are allowed to access or are barred from accessing a given resource. This is usually the most complex aspect of network security since it requires the secure, centralized storage and access of these ACLs. Authorization can occur only once a user is authenticated, as authorization systems rely on lists of authenticated users. Accounting: The basic task of recording who accessed what resource. Most network operating systems and services include some form of logging. This can either be performed independently at each service, or through a centralized accounting server. However, if performed centrally, all accounting information must be transferred securely, and can be affected by denial of service attacks (for instance, a hacker wishing to cover his tracks could prevent logging messages from reaching the accounting server). Secure communications: The ability to protect network transmissions from both interception (where private information can be compromised) as well as unauthorized transmission, where a hacker can masquerade as a secure host, or can insert data into an established connection. Kerberos is not a complete network security solution. While it does provide powerful tools to enable networkwide user authentication and secure communications, it has no provisions for access control or accounting. The designers of Kerberos felt that it should function as part of a larger network environment, where access control is best left up to individual applications or a dedicated access control manager. Although the Kerberos server itself includes a minimal ACL to specify users authorized to change the Kerberos database, no other authorization system is pr ovided. Likewise, as the actual authentication process occurs on the workstation, the Kerberos server doesn't concern itself with who is successfully authenticated. While the KDC (Kerberos server) does keep track of which tickets were issued, it provides more of a debugging function than an audit trail. Print This Page E-mail this URL