Kerberos is a network authentication protocol designed to provide secure authentication for client-server applications. It was developed by MIT in the 1980s and is named after Cerberus, the three-headed dog of Greek myth.
How Kerberos Works:
-
Key Distribution Center (KDC): This is the heart of Kerberos and consists of:
- Authentication Server (AS): Authenticates users initially.
- Ticket Granting Server (TGS): Issues tickets that allow users to access services.
- Kerberos Database: Stores user credentials.
-
Authentication Process:
- Initial Authentication: The user sends their credentials to the AS, which verifies them and issues a Ticket Granting Ticket (TGT).
- Service Request: The user presents the TGT to the TGS to get a service ticket for the desired service.
- Service Access: The user presents the service ticket to the service server to gain access.
Troubleshooting Kerberos Authentication Issues
When troubleshooting Kerberos issues, consider the following steps:
-
Check Time Synchronization: Ensure all devices in the network have synchronized clocks. Kerberos relies heavily on timestamps, and by default it rejects authentication once clock skew between the client and the domain controller exceeds five minutes.
-
Verify DNS Settings: Incorrect DNS settings can cause Kerberos authentication failures. Ensure DNS servers are accessible and correctly configured.
-
Inspect Kerberos Tickets:
- Use the
klistcommand to view and purge expired tickets. - Ensure the Service Principal Names (SPNs) are correctly set using the
setspncommand.
- Use the
-
Analyze Logs:
- Check the System event log for errors related to Kerberos, KDC, LsaSrv, or Netlogon.
- Look for failure audits in the Security event log on the target server.
Related ENow checks
- AD Core Thresholds — where the AD Time threshold that catches clock skew is configured.
Comments
0 comments
Article is closed for comments.