{"id":2576,"date":"2020-03-24T02:42:18","date_gmt":"2020-03-24T02:42:18","guid":{"rendered":"http:\/\/wiki.thomasandsofia.com\/?p=2576"},"modified":"2020-03-24T16:30:13","modified_gmt":"2020-03-24T16:30:13","slug":"kerberos","status":"publish","type":"post","link":"https:\/\/wiki.thomasandsofia.com\/?p=2576","title":{"rendered":"Kerberos"},"content":{"rendered":"<h1>Video Links<\/h1>\n<p><a href=\"https:\/\/www.youtube.com\/user\/SASsoftware\/search?query=Kerberos\" target=\"_blank\" rel=\"noopener\">https:\/\/www.youtube.com\/user\/SASsoftware\/search?query=Kerberos<\/a><\/p>\n<p>&nbsp;<\/p>\n<h1>Kerberos Overview<\/h1>\n<h2>Components<\/h2>\n<p>KDC Key distribution center<\/p>\n<ul>\n<li>AS &#8211; Authentication Service<\/li>\n<li>TGS &#8211; Ticket Granting Service<\/li>\n<\/ul>\n<p>Client<\/p>\n<ul>\n<li>Could be a User&#8217;s PC<\/li>\n<li>Could be a service that wishes to access another<\/li>\n<\/ul>\n<p>Server<\/p>\n<ul>\n<li>What the client requires access to.<\/li>\n<\/ul>\n<h2>Keys<\/h2>\n<ul>\n<li>Long Term Keys\n<ul>\n<li>Synonymous with Passwords<\/li>\n<li>TGS ltk for the Ticket Granting Service<\/li>\n<li>Service ltk for the service to be connected to<\/li>\n<li>User ltk<\/li>\n<\/ul>\n<\/li>\n<li>Session Keys (Short-Term Keys)\n<ul>\n<li>Service Session key\n<ul>\n<li>Limited lifetime<\/li>\n<li>Unique for the Client&#8217;s connection to the service.<\/li>\n<\/ul>\n<\/li>\n<li>TGS Session key\n<ul>\n<li>Associated with the Client&#8217;s connection with the TGS.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h2>Protocol Overview<\/h2>\n<h3>Authentication Service Request<\/h3>\n<p><strong>Initial Authentication<\/strong> (Not sure about this part)<\/p>\n<p>Client to AS: This is my ID in clear text<\/p>\n<p>AS to Client: Preauth error &#8211; You need to authenticate!<\/p>\n<p><strong>KRB_AS REQ<\/strong>: Initial request from the Client (User) to the Authentication Service<\/p>\n<ul>\n<li>Authenticator encrypted with the User&#8217;s LTK\n<ul>\n<li>Information about who is requesting authenticating<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>KRB_AS_REP<\/strong>: Authenication Service to Client response<\/p>\n<ul>\n<li>TGS Session Key encrypted using the User LTK\n<ul>\n<li>Use this to talk to the TGS for a limited time.<\/li>\n<\/ul>\n<\/li>\n<li>TGT (Ticket Granting Ticket) encrypted with the TGS LTK\n<ul>\n<li>Client ID<\/li>\n<li>Client IP address<\/li>\n<li>Ticket validity period (sounds like a TTL)<\/li>\n<li>TGS Session Key (copy of same above)<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Ticket Granting Service Request<\/h3>\n<p><strong>KRB_TGS_REQ<\/strong>: Client to Ticket Granting Service request<\/p>\n<ul>\n<li>Authenticator encrypted with TGS Session Key\n<ul>\n<li>Can be decrypted with the Session key sent from the AS<\/li>\n<\/ul>\n<\/li>\n<li>TGT encrypted with the TGS LTK\n<ul>\n<li>This is decrypted first so the TGS can extract the data in the Authenticator.<\/li>\n<li>This allows the TGS to NOT need to keep copies of these keys.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>KRB_TGS_REP<\/strong>: TGS to Client response<\/p>\n<ul>\n<li>Service Session Key encrypted using the TGS Session Key (Client has this)<\/li>\n<li>Service Ticket encrypted with the Service&#8217;s LTK\n<ul>\n<li>Client ID, IP, TTL<\/li>\n<li>Service Session Key<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<h3>Client\/Service Authentication Request<\/h3>\n<p><strong>KRB_AP_REQ*<\/strong>: Client to Service request<\/p>\n<ul>\n<li>Authenticator encrypted with the Service Session Key<\/li>\n<li>Service Ticket encrypted with the Service&#8217;s LTK<\/li>\n<\/ul>\n<p><strong>KRB_AP_REP*<\/strong>: Service to Client response (optional?)<\/p>\n<ul>\n<li>Authenticator encrypted with the Service Session Key\n<ul>\n<li>Allows the client to know they&#8217;ve connected to the right service!<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p>* These services are unlikely to be viewed via WireShark directly because they are often wrapped\u00a0 within different protocols, such as GSSAPI.<\/p>\n<h1>Delegating \/ Forwarding Authentication<\/h1>\n<ul>\n<li>Delegating: Microsoft AD term<\/li>\n<li>Forwarding: MIT term<\/li>\n<\/ul>\n<p><a href=\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2581\" src=\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication.png\" alt=\"\" width=\"1350\" height=\"1023\" srcset=\"https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication.png 1350w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication-300x227.png 300w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication-768x582.png 768w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication-1024x776.png 1024w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Forwarding-Authentication-150x114.png 150w\" sizes=\"auto, (max-width: 1350px) 100vw, 1350px\" \/><\/a><\/p>\n<h2>Overview:<\/h2>\n<p>Use the authentication credentials obtained to access the first service to obtain a ticket to access a second service.\u00a0 (Propagate the end user credentials from the first service to the second service.)<\/p>\n<p><strong>Initial Authentication has already taken place.<\/strong><\/p>\n<p>TGT has been obtained.<\/p>\n<p><strong>(1) KRB_TGS_REQ<\/strong> sent by client for Service #1<\/p>\n<ul>\n<li><strong>A<\/strong> Authenticator (Client\/TGS Session Key)<\/li>\n<li><strong>B<\/strong> TGT (TGS key)\n<ul>\n<li>Contains the Client\/TGS Session Key<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>(4) KRB_TGS_RES<\/strong> sent by TGS for the first service.<\/p>\n<ul>\n<li><strong>C<\/strong> Service #1 Session Key (TGS Session Key)<\/li>\n<li><strong>D<\/strong> Service Ticket (Service #1&#8217;s LTK)<\/li>\n<\/ul>\n<p><strong>(6) KRB_TGS_REQ<\/strong> sent by client for a Forwardable TGT for Service #2<\/p>\n<ul>\n<li><strong>A<\/strong> Authenticator (Client\/TGS Session Key)<\/li>\n<li><strong>B<\/strong> TGT (TGS key)\n<ul>\n<li>Contains the Client\/TGS Session Key<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><strong>(9) KRB_TGS REP<\/strong> sent by TGS for Service #2<\/p>\n<ul>\n<li><strong>E<\/strong> Service #2 Session Key (Client\/Service #1 Session Key)<\/li>\n<li><strong>F<\/strong> Forwarded TGT (Service #2 Session Key)<\/li>\n<li>Client will have access to both keys.<\/li>\n<\/ul>\n<p><strong>(11) KRB_AP_REQ<\/strong> sent from Client to Service #1 (Wrapped inside connection protocol)<\/p>\n<ul>\n<li><strong>D<\/strong> Service #1 Service Ticket (Service #1 LTK)<\/li>\n<li><strong>G<\/strong> Authenticator (Client\/Service #1 Session Key)<\/li>\n<\/ul>\n<p><strong>(14)KRB_AP_RES<\/strong> Sent from Service #1 to Client (Optional)<\/p>\n<ul>\n<li><strong>H<\/strong> Service #1 Authenticator (Client\/Service #1 Session Key)<\/li>\n<\/ul>\n<p><strong>(16) KRB_CRED<\/strong>\u00a0 sent from Client to Service #1<\/p>\n<ul>\n<li><strong>F<\/strong> Forwarded TGT (<\/li>\n<li><strong>I<\/strong> Second copy of TGS Session Key (Client\/Service #1 Session Key)<\/li>\n<\/ul>\n<p><strong>(18) KRB_TGS_REQ<\/strong> sent from Service #1 to TGS<\/p>\n<ul>\n<li><strong>F<\/strong> Forwarded TGT (TGS LTK)\n<ul>\n<li>2nd TGS Session Key<\/li>\n<\/ul>\n<\/li>\n<li><strong>J<\/strong> Authenticator for Service #1 (<\/li>\n<\/ul>\n<p><strong>(21) KRB_TGS_RES<\/strong> sent from TGS to Service #1<\/p>\n<ul>\n<li><strong>K<\/strong> 2nd Service Session Key (2nd TGS Session Key from F)<\/li>\n<li><strong>L<\/strong> Service Ticket for Service #2<\/li>\n<\/ul>\n<p><strong>(23) KRB_AP_REQ<\/strong> or Protocol used for Service 2 sent from Service #1 to Service #2<\/p>\n<ul>\n<li><strong>L<\/strong> Service Ticket for Service #2<\/li>\n<li><strong>M<\/strong> Authenticator for Service #1 (Service #2 Session Key)<\/li>\n<\/ul>\n<p><strong>(26) KRB_AP_RES<\/strong> sent from Service #2 to Service #1 (Optional)<\/p>\n<p>&nbsp;<\/p>\n<h1>Cross Realm Authentication<\/h1>\n<p>12:35<\/p>\n<p>Client and Server are in different Kerberos Realms<\/p>\n<p>A cross-realm trust must be correctly configured prior to performing this successfully<\/p>\n<p><a href=\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication.png\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2584\" src=\"http:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication.png\" alt=\"\" width=\"1175\" height=\"1010\" srcset=\"https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication.png 1175w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication-300x258.png 300w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication-768x660.png 768w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication-1024x880.png 1024w, https:\/\/wiki.thomasandsofia.com\/wp-content\/uploads\/2020\/03\/Kerberos-Cross-Realm-Authentication-150x129.png 150w\" sizes=\"auto, (max-width: 1175px) 100vw, 1175px\" \/><\/a><\/p>\n<p>&nbsp;<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Video Links https:\/\/www.youtube.com\/user\/SASsoftware\/search?query=Kerberos &nbsp; Kerberos Overview Components KDC Key distribution center AS &#8211; Authentication Service TGS &#8211; Ticket Granting Service Client Could be a User&#8217;s PC Could be a service that wishes to access another Server What the client requires access to. Keys Long Term Keys Synonymous with Passwords TGS ltk for the Ticket Granting ..<\/p>\n<div class=\"clear-fix\"><\/div>\n<p><a href=\"https:\/\/wiki.thomasandsofia.com\/?p=2576\" title=\"read more...\">Read more<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2576","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/posts\/2576","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2576"}],"version-history":[{"count":7,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/posts\/2576\/revisions"}],"predecessor-version":[{"id":2585,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=\/wp\/v2\/posts\/2576\/revisions\/2585"}],"wp:attachment":[{"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2576"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2576"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/wiki.thomasandsofia.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2576"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}