kerberos explained
Post on 14-Aug-2015
102 Views
Preview:
TRANSCRIPT
Kerberos ExplainedDOTAN PATRICH
Who's on First? How can Abbot authenticate that Costello is talking?
How can Abbot make sure that Costello is on First?
Kerberos the three-headed dog Authentication protocol named after a mythical three-headed dog:
◦ Key Distribution Center (KDC)◦ The client user◦ The accessed server
Came out of MIT
Adopted by MS AD to replace NTLM (and failed to do so)
How does it work?
Active Directory
How does it work?
Active Directory
User login by entering username and password
How does it work?
Active Directory
Send authentication request to the KDC, containing:
• User principal name
• Account domain name
• Secret key derived from the user password
How does it work?
Active Directory
KDC contacts AD to authenticate the user and gather all groups he posses
How does it work?
Active DirectoryReply with Ticket Granting Ticket (TGT), containing:
• Session key encrypted by the KDC private key
• Authorization information for the user (i.e. groups)
How does it work?
Active DirectoryReply with Ticket Granting Ticket (TGT), containing:
• Session key encrypted by the KDC private key
• Authorization information for the user (i.e. groups)
Windows Security Event4768 event logged for the
user from source ip
How does it work?
Active Directory
Windows Security Event4768 event logged for the
user from source ip
Client machine caches the TGTThis is done once per session (until TGT expiration)
How does it work?
Active Directory
Now the user wants to access server B
How does it work?
Active DirectoryRequest for Service Ticket, containing:
• Name of target computer (server B)
• User’s TGT
• An authenticator, encrypted with user’s session key
How does it work?
Active Directory
KDC validate the request (check encryption validity)
How does it work?
Active DirectoryReturn a Service Ticket, containing:
• Session key to share with computer B, encrypted by User A key
• User A session ticket encrypted with Computer B key
How does it work?
Active DirectoryReturn a Service Ticket, containing:
• Session key to share with computer B, encrypted by User A key
• User A session ticket encrypted with Computer B key
Windows Security Event4769 event logged for the
user from source ip to computer B
How does it work?
Active Directory
Send the service ticket to computer B
How does it work?
Active Directory
Validate the ticket authenticity: decrypt the service ticket with computer B ticket
So what’s new? Scalable
◦ Servers do not need to contact KDC to authenticate users◦ Only users and machine account authenticate with the KDC, once per 10h of activity
Secure◦ Passwords are not sent over the wire◦ Ticket based authentication based on certificates trusts
Advanced Features◦ Single Sign-On◦ Delegation◦ Cross Domain Authentication
Wait, machines need to authenticate?
Yes!!◦ Need to ensure that a Service Ticket is addressed and used only by the destination computer◦ The Service Ticket is encrypted by the machine account session key (shared with the KDC)◦ Only the target machine can validate the Service Ticket◦ This is why we see 4768 events and 4769 events for the machine account!
4769 events with source=target When a user logins to a local computer, a session is created for him:
◦ It doesn’t matter if it is a remote session, or local interactive session◦ In both cases, the computer needs to know the user’s credentials (group membership and SID)◦ It uses a Service Ticket addressed to the local computer to do so◦ Works the same as if we contacted a remote servers◦ This is why we get a 4769 event with source equals to target after each login
4769 with target equals domain controller?
After each login, the computer needs to pull Group Policy from AD:◦ Need to access the AD domain controller and pull the policy◦ To do so, we need to authenticate with the domain controller ◦ Authentication is done using Kerberos, just like any server access◦ This is why we get a 4769 event with target equals to a domain controller after each login
So, what events are logged ?Event Type Account Source Destination
4768 Machine B Machine B
4768 Machine C Machine C
4768 User A Machine B
4769 User A Machine B Machine B
4769 User A Machine B Domain Controller
4769 User A Machine B Machine C
Tim
e
Delegation A mechanism to authenticate on behalf of the user to 3rd party resources
Machine and account doing the delegation need to be trusted by AD
Used by most Windows based web servers (i.e. SharePoint, Sites backed by SQL Server)
User authenticate with the web server
Service Ticket passed to the SQL serverSource ip is the web server!
4769 event logged, with delegated flag set to true
(ticket options field)
Cross Domain Authentication◦ The client first authenticate with the local domain, asking for a referral ticket◦ The referral ticket is encrypted by a inter-domain key◦ The client sends the referral ticket to the remote domain◦ The remote domain issues a Service Ticket granting access to the remote server
Interesting Windows Security Events
top related