Presentation is loading. Please wait.

Presentation is loading. Please wait.

Active Directory and NT Kerberos Rooster JD Glaser.

Similar presentations


Presentation on theme: "Active Directory and NT Kerberos Rooster JD Glaser."— Presentation transcript:

1 Active Directory and NT Kerberos Rooster JD Glaser

2 Introduction to NT Kerberos v5 What is NT Kerberos? How is it different from NTLM NT Kerberos vs MIT Kerberos Delegation and Client Authentication What does NT Kerberos look like on the wire? KTNet - A native NT Kerberos telnet server

3 What is NT Kerberos NTs new authentication system MIT Kerberos v5 - an Open Standard Kerberos is the default authenticator in W2K domains NTLM still used for compatibility –usually the weakest version

4 How is it different from NTLM Doesnt use a password hash system Requires fewer authentication calls More sophisticated - Yes More secure? - Possibly in pure mode –Backwards compatibility hinders it –NTLM v2 is strong in pure mode as well

5 NT Kerberos Integrated with platform Locates KDC via DNS - DNS server required for install No support for DCE style cross-realm trust No raw krb5 API Postdated tickets (not implemented) Uses authdata field in ticket

6 Windows 2000 Kerberos standards RFC-1510 Kerberos change password protocol Kerberos set password protocol RC4-HMAC Kerberos Encryption type PKINIT

7 Kerberos Interoperability Scenarios Kerberos clients in a Win2000 domain Kerberos servers in a Win2000 domain Standalone Win2000 systems in a Kerberos realm Using a Kerberos realm as a resource domain Using a Kerberos realm as an account domain

8 MIT Kerberos Differences Win2000 Clients –Just logon –Just logoff –Domain membership –Example app: everything Servers –Use computer account via SCMMIT Clients Clients User logon with kinit User logon with kinit User logoff with kdestroy User logoff with kdestroy Configured with /etc/krb5.conf Configured with /etc/krb5.conf Example app: telnet Example app: telnet Servers Servers Do not logon – use saved keys from keytab Do not logon – use saved keys from keytab

9 Using Kerberos clients Customer wants to have its non-windows Kerberos users use their Win2000 accounts Setup the /etc/krb5.conf Setup the /etc/krb5.conf Users kinit with their Win2000 account Users kinit with their Win2000 account Windows 2000 Server nt.company.com Unix workstation

10 Using Kerberos servers Customer wants to user their Kerberos enabled database server in an n-tier application front- ended by IIS /etc/krb5.conf on database server /etc/krb5.conf on database server Create service account in domain Create service account in domain Use ktpass to export a keytab Use ktpass to export a keytab Copy keytab to database server Copy keytab to database server IIS server is trusted for delegation IIS server is trusted for delegation nt.company.com Windows 2000 IIS Server Unix Database Server Windows 2000 Wks

11 Kerberos realm as an account domain User logon with Kerberos principal User has shadow account in an account domain (for applying authz) Mapping is used at logon for domain identity MIT.REALM.COM win2k.domain.com Domain trusts realm users

12 Standalone Win2000 computers An employee has a Win2000 computer that they want to use in a Kerberos realm Configure system as standalone (no domain) Configure system as standalone (no domain) Use Ksetup to configure the realm Use Ksetup to configure the realm Use Ksetup to establish the local account mapping Use Ksetup to establish the local account mapping Logon to Kerberos realm Logon to Kerberos realm Win2000 Linux/Unix MIT.REALM.COM

13 Trusting a Kerberos realm Win2000 users accessing services in Kerberos realms Kerberos users accessing services in domains

14 Domain Domain Domain Domain Explicit Windows NT 4.0-style trust Domain microsoft.com europe. microsoft. com Kerberos trust fareast. microsoft. com Windows 2000 Domain Trusts Kerberos realm Explicit Kerberos trust Shortcut trust

15 Cross-domain Authentication Windows 2000 ProfessionalWindows 2000 Server west.company.comeast.company.com company.com KDC 1 TGT 2 TGT 3TGT 4TICKET srv1.east.company.com

16 Using Unix KDCs with Windows 2000 Authorization Win2000 Professional Windows 2000 Server COMPANY.REALMnt.company.com MIT KDC Windows 2000 KDC 1 TGT 2TGT Name Mapping to NT account 3 TICKET 4 TICKET With NT Auth Data

17 NT Kerberos vs MIT Kerberos NT caches the password for ticket renewal Its not certain whether NT uses ticket caching tracking stolen replay tickets

18 Kerberos v5 Ticket Details

19 Delegation and Client Authentication

20 NT Kerberos On The Wire

21 Thank you Rooster, JD Glaser,

22 Appendix John Brezak, PM - Microsoft –Kerberos Talk - MTB 99


Download ppt "Active Directory and NT Kerberos Rooster JD Glaser."

Similar presentations


Ads by Google