Cyclades AlterPath ACS, Справочник по командам

Страница: 80 / 420

64
Authentication
3.2 Kerberos Authentication
Kerberos is a computer network authentication protocol designed for use on insecure
networks, based on the key distribution model. It allows individuals communicating
over a network to prove their identity to each other while also preventing eavesdropping
or replay attacks, and provides for detection of modification and the prevention of
unauthorized reading
Kerberos Server Authentication with Tickets support
The ACS has support to interact on a kerberized network. You can find in the next lines
a brief explanation about how kerberos works. Later in this section, a practical a step by
step example will be presented.
How Kerberos Works
On a kerberized network, the Kerberos database contains principals and their keys (for
users, their keys are derived from their passwords). The Kerberos database also contains
keys for all of the network services.
When a user on a kerberized network logs in to their workstation, their principal is sent
to the Key Distribution Center ( KDC ) as a request for a Ticket Granting Ticket ( TGT ).
This request can be sent by the login program (so that it is transparent to the user) or can
be sent by the kinit program after the user logs in.
The KDC checks for the principal in its database. If the principal is found, the KDC
creates a TGT, encrypts it using the user's key, and sends it back to the user.
The login program or kinit decrypts the TGT using the user's key (which it computes
from the user's password). The TGT , which is set to expire after a certain period of time,
is stored in your credentials cache. An expiration time is set so that a compromised TGT
can only be used for a certain period of time, usually eight hours (unlike a compromised
password, which could be used until changed). The user will not have to re-enter their
password until the
TGT expires or they logout and login again.
When the user needs access to a network service, the client uses the TGT to request a
ticket for the service from the Ticket Granting Service ( TGS ), which runs on the KDC .
The TGS issues a ticket for the desired service, which is used to authenticate the user.
Configuring ACS to use Kerberos Tickets authentication
For this example we will consider that a kerberos server with ticket support is properly
configured in the network. The manual will only approach the ACS configuration.
Here we will assume that the kerberos server has the following configuration: