What is Kerberos?
The Kerberos network authentication protocol is a trusted-third-party, ticket-based system built primarily on symmetric cryptography. Within a realm, principals identify users or services, and a key distribution center (KDC) provides an Authentication Service and Ticket-Granting Service. After initial authentication, a client receives a ticket-granting ticket, then requests service tickets without repeatedly sending the user’s long-term secret. Tickets, authenticators, and time-limited session keys let clients and services establish authenticated sessions across an untrusted network. Kerberos V5 also supports cross-realm operation. It establishes identity and shared keying material; application authorization remains a separate Access Control decision and should follow The Principle of Least Privilege (PoLP).
What is Kerberos used for?
Kerberos enables enterprise single sign-on in directory-integrated Windows environments, Unix and Linux services, and cross-realm trust relationships. Reliable operation depends on highly available KDCs, synchronized clocks, accurate service principal names, strong service-account keys, appropriate ticket lifetimes, pre-authentication, and controlled cross-realm trust. Privileged Access Management (PAM), tier separation, constrained delegation, and audit telemetry reduce the impact of credential abuse. Defenders should monitor for pass-the-ticket activity, forged tickets, kerberoasting, abnormal delegation, weak encryption, and unusual ticket lifetimes. Because the KDC and its key material form a concentrated trust boundary, compromise can affect an entire realm. Multi Factor Authentication (MFA) around initial access can strengthen assurance but does not remove the need to secure tickets and services.
