Kerberos Terminology - Red Hat LINUX 7.2 Reference Manual

140
• For an application to use Kerberos, its source must be modified to make the appropriate calls into
the Kerberos libraries. For some applications, this may require too much programming effort. For
other applications, changes must be made to the protocol used between network servers and their
clients. Again, this may require extensive programming. Furthermore, it may be impossible to
make certain closed-source applications work with Kerberos.
• Kerberos assumes that you are using trusted hosts on an untrusted network. Its primary goal is to
prevent plaintext passwords from being sent across that network. However, if anyone other than
the proper user has physical access to any of the hosts, especially the one that issues tickets used
for authentication, the entire Kerberos authentication system is at risk of being compromised.
• Finally, if you decide to use Kerberos on your network, you must realize that it is an all-or-nothing
proposition. If any services that transmit plaintext passwords remain in use, passwords can still
be compromised, and your network gains no net benefit from the use of Kerberos. To secure your
network with Kerberos, you must either kerberize (make it work with Kerberos) all applications
that send plaintext passwords or stop using those insecure applications on your network.

8.3 Kerberos Terminology

Like any other system, Kerberos has its own terminology. Before we talk about how it works, here is
a list of terms that you will need to know:
ciphertext
Encrypted data.
client
An entity on the network (a user, a host, or an application) that can get a ticket from Kerberos.
credential cache or ticket file
A file which contains the keys for encrypting communications between a user and various net-
work services. Kerberos 5 provides a framework for using other cache types (such as shared
memory), but files are better supported.
key
Data used when encrypting or decrypting other data. Encrypted data cannot be decrypted with-
out the proper key or extremely good guessing.
Key Distribution Center (KDC)
A service that issues Kerberos tickets, usually run on the same host as the Ticket Granting Server.
key table or keytab
Chapter 8:Using Kerberos 5 on Red Hat Linux