How Kerberos works
A user authenticates once to the key distribution centre and receives a ticket-granting ticket. When they want to reach a service, they present it and receive a service ticket, which the service validates. Tickets are time-limited and encrypted with keys known only to the parties involved.
Because the scheme depends on shared secrets and synchronized clocks, accurate time is required. Single sign-on works because the ticket can be reused for multiple services during its lifetime without re-entering a password. Authentication involves three parties: the client, the service and the key distribution centre, which typically runs on domain controllers in Windows environments.
Why it matters for Canadian organizations
Kerberos underpins authentication in many Canadian organizations that use Active Directory, which makes it a prime target. Attacks such as Kerberoasting, pass-the-ticket and golden ticket forgery let intruders escalate privileges and move laterally.
Compromise of the domain's key material can give an attacker broad access, with consequences for personal information held across the network. Monitoring ticket activity is therefore part of detecting intrusions in Windows environments. Time skew greater than a few minutes causes authentication failures, so reliable time synchronization is an operational requirement as well as a security one.
How to defend against it
Use long, random passwords for service accounts or managed service accounts, and enforce strong encryption types while disabling legacy ones. Protect and rotate the krbtgt account's credentials after any suspected domain compromise.
Limit privileged accounts, apply tiered administration, and monitor for unusual ticket requests and encryption downgrades. Keep domain controllers patched and restrict who can log on to them. Detection ideas include alerting on unusual ticket request volumes, tickets with abnormal lifetimes, and sudden use of weaker encryption types for service tickets.
Frequently asked questions
Is Kerberos the same as Active Directory?
No. Active Directory is Microsoft's directory service, while Kerberos is the authentication protocol it uses by default. Kerberos can also be used independently in other environments, for example with MIT Kerberos on Unix and Linux systems.
What is Kerberoasting?
Kerberoasting is an attack in which a user requests service tickets for accounts with service principal names and cracks them offline to recover the service account password. Long, random passwords and managed service accounts make it impractical.
Does Kerberos send passwords over the network?
No. Authentication relies on encrypted tickets derived from secrets rather than transmitting the password. This protects against simple eavesdropping, although attackers who obtain tickets or key material can still abuse them.
Related service: Identity and access management