Red Hat ENTERPRISE LINUX 5 - VIRTUAL SERVER ADMINISTRATION, Руководство по развертыванию

Страница: 696 / 848

Chapter 43. Securing Your Network
670
principal (or principal name)
The principal is the unique name of a user or service allowed to authenticate using Kerberos. A
principal follows the form
root[/instance]@REALM
. For a typical user, the root is the same as
their login ID. The
instance
is optional. If the principal has an instance, it is separated from the
root with a forward slash ("/"). An empty string ("") is considered a valid instance (which differs
from the default
NULL
instance), but using it can be confusing. All principals in a realm have their
own key, which for users is derived from a password or is randomly set for services.
realm
A network that uses Kerberos, composed of one or more servers called KDCs and a potentially
large number of clients.
service
A program accessed over the network.
ticket
A temporary set of electronic credentials that verify the identity of a client for a particular service.
Also called credentials.
ticket-granting server (TGS)
A server that issues tickets for a desired service which are in turn given to users for access to the
service. The TGS usually runs on the same host as the KDC.
ticket-granting ticket (TGT)
A special ticket that allows the client to obtain additional tickets without applying for them from the
KDC.
unencrypted password
A plain text, human-readable password.
43.6.3. How Kerberos Works
Kerberos differs from username/password authentication methods. Instead of authenticating each
user to each network service, Kerberos uses symmetric encryption and a trusted third party (a KDC),
to authenticate users to a suite of network services. When a user authenticates to the KDC, the
KDC sends a ticket specific to that session back to the user's machine, and any Kerberos-aware
services look for the ticket on the user's machine rather than requiring the user to authenticate using a
password.
When a user on a Kerberos-aware network logs in to their workstation, their principal is sent to the
KDC as part of a request for a TGT from the Authentication Server. This request can be sent by the
log-in program so that it is transparent to the user, or can be sent by the
kinit
program after the user
logs in.
The KDC then checks for the principal in its database. If the principal is found, the KDC creates a
TGT, which is encrypted using the user's key and returned to that user.
The login or
kinit
program on the client then decrypts the TGT using the user's key, which it
computes from the user's password. The user's key is used only on the client machine and is
not
transmitted over the network.
The TGT is set to expire after a certain period of time (usually ten to twenty-four hours) and is stored in
the client machine's credentials cache. An expiration time is set so that a compromised TGT is of use