Kerberos White Paper

ManualsBrandsHP ManualsSoftwareHP-UX Kerberos Data Security Software

Executive Summary .............................................................................................................................. 2

Problem Statement ............................................................................................................................... 2

Historical Evolution of Kerberos ............................................................................................................. 3

Why Kerberos? ................................................................................................................................... 3

Kerberos Basics................................................................................................................................... 3

How Kerberos Works........................................................................................................................... 4

Authentication Process.......................................................................................................................... 4

Kerberos Products on HP-UX.................................................................................................................. 6

PAM Kerberos (PAM-Kerberos) .......................................................................................................... 6

Kerberos Client (KRB5-Client) Software ............................................................................................... 7

HP Kerberos Server Version 3.1......................................................................................................... 7

Introduction to LDAP ..................................................................................................................... 8

Kerberos Server on HP-UX with Native Back End.............................................................................. 8

Kerberos Server on HP-UX with LDAP Back End................................................................................ 8

Benefits of an LDAP Back End ........................................................................................................ 8

Integrating the Kerberos Principal into the LDAP Directory ................................................................. 8

Generic Security Service Application Programming Interface (GSS-API) .................................................. 9

Secure Internet Services (SIS) ........................................................................................................... 10

ftp ............................................................................................................................................ 10

rcp ........................................................................................................................................... 10

rlogin/rsh.................................................................................................................................. 10

telnet......................................................................................................................................... 10

Common Internet File System (CIFS).................................................................................................. 10

Secure Shell .................................................................................................................................. 10

Compatibility/Interoperability ............................................................................................................. 11

Summary .......................................................................................................................................... 11

References ........................................................................................................................................ 11

Glossary........................................................................................................................................... 12

Summary of content (13 pages)

PAGE 1
Kerberos White Paper Executive Summary .............................................................................................................................. 2 Problem Statement ............................................................................................................................... 2 Historical Evolution of Kerberos ............................................................................................................. 3 Why Kerberos? ....................................
PAGE 2
Executive Summary This white paper provides a high-level description of the Kerberos protocol. The paper includes detailed information about important concepts and features of Kerberos authentication. The first section provides basic information about Kerberos authentication. Following this introduction to the protocol are several sections with details of how HP has implemented the Kerberos authentication protocol. HP-UX supports the following Kerberos suite of products on the on the HP-UX 11.
PAGE 3
demonstrating possession of secret information. In this manner, Kerberos solves traditional problems involved with authentication. Historical Evolution of Kerberos The name Kerberos comes from Greek mythology; Cerberos was the three-headed dog that guarded the entrance to Hades.
PAGE 4
How Kerberos Works The Kerberos credential scheme embodies the SSO concept. Secure authentication is based on previously established initial credentials, which eliminates the need to re-key a password on multiple occasions. A Kerberos server consists of the following elements: • Realm - a user-defined administrative boundary. • Key Distribution Center (KDC) - the heart of the Kerberos realm. It provides Kerberos authentication services by issuing encrypted tickets that require secret keys to decode.
PAGE 5
Figure 1: The Kerberos Authentication Protocol Step 1. The user begins to use a Kerberized application by entering the user name and password. Optionally, the user can request for specific ticket flags and specify the key type to be used for constructing the secret key. The user can also accept the default, configured for the client.
PAGE 6
Step 4. To obtain access to a secured network service such as rlogin, rsh, rcp, ftp, or telnet, the requesting client application uses the previously obtained TGT in a dialogue with the TGS to obtain a service ticket. The protocol is the same as used while obtaining the TGT, except that the messages contain the name of the server and a copy of the previously obtained TGT. Step 5. The TGS returns a new service ticket that the application client can use to authenticate the service. Step 6.
PAGE 7
Figure 2: The PAM Library Figure 2 shows the relationship between the PAM Kerberos library and various authentication modules that HP-UX provides. The PAM Kerberos library is one of the many authentication modules that PAM can invoke based on what is defined under the PAM configuration file: /etc/pam.conf. If PAM's authentication-management points to the shared, dynamically loadable PAM Kerberos library, PAM Kerberos is invoked for user authentication.
PAGE 8
Kerberos Server is based on distributed client-server architecture. It ensures secure communication in a networked environment by leveraging individual trust relationships. It then distributes that trust across enterprise-wide, distributed client-server networks. It contains a GUI for configuration purposes. Users can choose to configure the Kerberos Server v3.1 with a native (C-Tree) backend database or with an LDAP backend database.
PAGE 9
Directory Root O=bambi.com ou=Sales ou=Accounts DN:cn = Alex, ou=Sales, o=bambi.com sn (surname): Mathew FirstName: Alex TelephoneNumber: 1907 uid (userID): mathew userPassword: ****** email: mathew@bambi.com Shell: /usr/bin/ksh Home Directory: /home/mathew.. Account Expires: 12th Dec 2004 krbprincipalName: mathew@bambi.
PAGE 10
different authentication technologies, including Kerberos. HP recommends using GSS-API in application programs wherever possible. Secure Internet Services (SIS) HP-UX provides built-in support in a secure environment for Secure Kerberized Internet services such as ftp, rcp, rlogin, telnet, and remsh. Kerberized applications can have their behavior modified in the /etc/krb5.conf file. These applications use the Kerberos ticket instead of a password to authenticate the user to the remote machine.
PAGE 11
client/server architecture supports the SSH-1 and SSH-2 protocols and provides secured remote login, file transfer, and remote command execution. HP-UX Secure Shell uses hashing to ensure data integrity and provides secure tunneling features, port forwarding, and an SSH agent to maintain private keys on the client.
PAGE 12
Glossary Following is a list of terms used throughout this document: Name Definition Authentication Verification of the claimed identity of a principal. Authenticator A record containing information that can be shown to have been recently generated using the session key known only by the client and server. Authorization The process of determining whether a client can use a service, which objects the client is allowed to access, and the type of access allowed for each.
PAGE 13
Principal A unique name for a user or service stored in a KDC Secret key An encryption key shared by a principal and the KDC, distributed outside the bounds of the system, with a long lifetime. In the case of a user's principal, the secret key is derived from a password. Service A resource provided to network clients; often provided by more than one server (for example, remote file service).