Red Hat ENTERPRISE LINUX 5 - DEPLOYMENT Deployment Manual page 695

ciphertext
Encrypted data.
client
An entity on the network (a user, a host, or an application) that can receive a ticket from Kerberos.
credentials
A temporary set of electronic credentials that verify the identity of a client for a particular service.
Also called a ticket.
credential cache or ticket file
A file which contains the keys for encrypting communications between a user and various network
services. Kerberos 5 supports a framework for using other cache types, such as shared memory,
but files are more thoroughly supported.
crypt hash
A one-way hash used to authenticate users. These are more secure than using unencrypted data,
but they are still relatively easy to decrypt for an experienced cracker.
GSS-API
The Generic Security Service Application Program Interface (defined in RFC-2743 published by
The Internet Engineering Task Force) is a set of functions which provide security services. This
API is used by clients and services to authenticate to each other without either program having
specific knowledge of the underlying mechanism. If a network service (such as cyrus-IMAP) uses
GSS-API, it can authenticate using Kerberos.
hash
Also known as a hash value. A value generated by passing a string through a hash function.
These values are typically used to ensure that transmitted data has not been tampered with.
hash function
A way of generating a digital "fingerprint" from input data. These functions rearrange, transpose or
otherwise alter data to produce a hash value.
key
Data used when encrypting or decrypting other data. Encrypted data cannot be decrypted without
the proper key or extremely good fortune on the part of the cracker.
key distribution center (KDC)
A service that issues Kerberos tickets, and which usually run on the same host as the ticket-
granting server (TGS).
keytab (or key table)
A file that includes an unencrypted list of principals and their keys. Servers retrieve the keys they
need from keytab files instead of using kinit. The default keytab file is /etc/krb5.keytab.
The KDC administration server, /usr/kerberos/sbin/kadmind, is the only service that uses
any other file (it uses /var/kerberos/krb5kdc/kadm5.keytab).
kinit
The kinit command allows a principal who has already logged in to obtain and cache the initial
ticket-granting ticket (TGT). Refer to the kinit man page for more information.
Kerberos Terminology
669