- [Instructor] The Kerberos access control system
is widely used to implement authentication
and authorization systems
on both UNIX and Windows platforms.
It is one of the core protocols
underlying Microsoft Active Directory.
Kerberos is a ticket-based authentication system
that allows users to authenticate to a centralized service
and then use tickets from that authentication process
to gain access to distributed systems
that support Kerberos authentication.
Here's how Kerberos works.
An end user wants to gain access
to a service that supports Kerberos.
We sometimes refer to this service as a Kerberized service.
First, the end user uses a Kerberos client
on his or her system to provide a user name and password.
The client then creates a clear-text authentication request
that it sends to an authentication server.
The authentication server then looks up the user
in its database and retrieves the user's password.
It sends two messages back to the client.
The first is a randomly generated session key
used for future communication between the client
and the ticket granting server.
This message is encrypted using the client's password.
The second is a ticket granting ticket
that includes information about the client
and a copy of the client ticket granting server session key.
This message is encrypted using a key known only
to the ticket granting server.
When the client receives these messages,
it decrypts the first message using the user's password.
This gives it access to the client TGS session key.
If the user didn't enter the correct password,
this step won't work.
Next, when the client wants to access a service,
it contacts the ticket granting server and sends two things.
It sends a copy of the ticket granting ticket
and the identity of the requested service,
and then it sends an authenticator,
containing the client's ID and the current time,
and encrypts that authenticator
using the client TGS session key
that the client obtained from the authentication server.
The ticket granting server, when it receives these messages,
first decrypts the ticket granting ticket
to retrieve the client TGS session key.
The ticket granting server can then use this key
to decrypt the authenticator
and retrieve the client ID and timestamp.
The ticket granting server then randomly generates
a client server session key that the client will use
to communicate with the desired service.
The ticket granting server then sends
two messages to the client.
The first is a client server ticket,
which is encrypted using the service's secret key
and contains the randomly generated
client server session key.
The second message is a copy
of the client server session key encrypted with the client
ticket granting server session key.
Once the client receives these two messages,
it is ready to complete the service authentication process.
The client sends two messages to the service.
The first is the client server ticket
that the client received from the ticket granting server.
The second is a new authenticator
encrypted with the client server session key.
The service receives these two messages
and decrypts the first
to retrieve the client server session key.
It then uses this key to decrypt the authenticator
and validate the client
granting access to the service.
The Lightweight Directory Access Protocol, or LDAP,
is an important protocol to access control.
It allows services on a network
to share information about users and their authorizations
in a standardized open format.
Active Directory uses LDAP in combination with Kerberos.
While Kerberos handles authentication,
LDAP provides the means to query information
stored in the directory service.
You'll want to remember the ports used
by each protocol when you prepare for the exam.
Kerberos uses port 88.
LDAP uses port 389 for unencrypted communications
and can also be run in an encrypted form,
secure LDAP, over port 636.
You also may come across questions on the exam
about an older technology that Microsoft used for many years
called NT LAN Manager, or NTLM.
NTLM authentication was the standard
for Microsoft authentication
before the widespread use of Kerberos.
It uses a hash-based
challenge-response authentication mechanism
similar to CHAP
but has two serious security issues.
First, older versions of NTLM use weak encryption
that does not live up to modern standards.
Second, even current versions of NTLM are vulnerable
to an attack known as a pass-the-hash attack,
where the attacker uses hashed credentials from one machine
to gain access to a second machine.
NTLM is still installed on many systems today
to provide backward compatibility,
but that's not a good idea or a safe practice.
Microsoft recommends disabling NTLM,
and you should follow this recommendation.