>> Hello. Now we'll talk a little bit more about
how Kerberos is like the carnival I described earlier,
but this will be a little bit more technical.
You log into the server, your domain controller.
That domain controller is
actually running a service called
the authenticating service or the AS.
When I sit down and login,
my login credentials are sent
to the authenticating service.
In exchange for proving my authenticity,
the authenticating service gives me something
>> called the TGT or ticket granting ticket.
>> That's like my wrist strap at the carnival.
That's what I get for coming in the proper way.
That TGT stays with
me throughout my duration in the domain or the realm,
and it proves that I came in
the proper way. It's a token.
Now, let's say I want to print to server A.
In the background, what is happening is that I'm
basically going to something
called the ticket granting service or TGS.
>> I'm saying here's my TGT,
>> I want to print to server A.
The TGS sees that I have a TGT and gives me
a ticket to print to server A.
>> I get my ticket, I send my print job to the printer,
>> and all is well.
>> Now, let's say I want to access
something from the database service.
Do I have to go back through the authenticating
service and re-log in?
No. I have to go back to the ticket booth or the TGS.
Just like the carnival,
it's one-time through the admissions booth
or authenticating service,
and many times to the ticket booth or TGS.
That is Kerberos.
This is great because we don't have to keep
proving our credentials over and over.
Then ultimately what happens is that we keep
this token with us for the duration of our login,
and we just simply need to carry
the ticket granting service or
a ticket each time we want to go access new services.
The ticket granting service and
the authenticating service are
two rules that are running on the same system.
The system that houses the TGS and the AS is
called the KDC or key distribution center.
The TGS plus the AS equals the KDC.
That's really at the heart of Kerberos.
Kerberos isn't perfect. Nothing is.
It's very time sensitive,
which is actually a good thing.
It mitigates the risk of replay attacks,
but at the same time,
all of your clocks on the network have to be
synchronized within five minutes of each other.
Otherwise, you'll find that
certain clients can't log
in and you'll get a Kerberos error.
Also, the ticket granting ticket
is stored locally on your workstation.
If your workstation gets compromised,
then someone else could have access to
resources as if they were you.
Now, if your KDC is hacked,
that's a big deal because the key distribution center
is your ultimate list of passwords and all credentials.
So all security is lost.
That's a single point of failure.
It can also be a performance bottleneck.
Finally, it is still
vulnerable to password guessing attacks.
Kerberos doesn't do anything to prevent that,
but it is still considered worth those
risks that way you can have single sign-on.
To review, Kerberos is
a network authentication protocol and operates on
port 88 and it uses symmetric cryptography.
That's something you might see on the test.
You can expect to see several questions
on the exam about Kerberos in
general because it's
a very important protocol and service.