Using Kerberized Login Procedure; Using A Non-Kerberized Login Procedure - Cisco WS-C4003 - Catalyst 4000 Chassis Switch Software Configuration Manual

Understanding How Authentication Works

Using Kerberized Login Procedure

You can use a Kerberized Telnet session if you are logging in through the in-band management port.
After the Telnet client and services have been Kerberized, the following process takes place when a user
attempts to Telnet to the switch:
1.
2.
3.
4.
5.
6.
Figure 27-1
Figure 27-1 Kerberized Telnet Connection
(Telnet client)

Using a Non-Kerberized Login Procedure

If a non-Kerberized login procedure is used to log in to the switch, the switch takes care of authentication
to the KDC on behalf of the login client. However, the user password is now transferred in clear text
from the login client to the switch.
Software Configuration Guide—Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4
27-6
The Telnet client asks the user for the username and issues a request for a TGT to the KDC on the
Kerberos server.
The KDC creates the TGT, which contains the user's identity, the KDC's identity, and the TGT's
expiration time. The KDC then encrypts the TGT with the user's password and sends the TGT to the
client.
When the Telnet client receives the encrypted TGT, it prompts the user for the password. If the
Telnet client can decrypt the TGT with the entered password, the user is successfully authenticated
to the KDC. The client then builds a service credential request and sends this to the KDC. This
request contains the user's identity and a message saying that it wants to Telnet to the switch. This
request is encrypted using the TGT.
When the KDC successfully decrypts the service credential request with the TGT that it issued to
the client, it builds a service to the switch. The service credential has the client's identity and the
identity of the desired Telnet server. The KDC then encrypts the credential with the password that
it shares with the switch's Telnet server and encrypts the resulting packet with the Telnet client's
TGT and sends this packet to the client.
The Telnet client decrypts the packet first with its TGT. If encryption is successful, the client then
sends the resulting packet to the switch's Telnet server. At this point, the packet is still encrypted
with the password that the switch's Telnet server and the KDC share.
If the Telnet client has been instructed to do so, it forwards the TGT to the switch. This ensures that
the user does not need to get another TGT in order to use another network service from the switch.
illustrates the Kerberos Telnet connection process.
Host
5
6
Catalyst 4000
Kerberos server
(contains KDC)
1
2
3
4
4000
switch
Chapter 27 Configuring Switch Access Using AAA
78-12647-02