Overview

• What you will learn: The Kerberos authentication protocol and its components (KDC, TGT, service tickets, realms), how to install and configure a Kerberos Key Distribution Center on Ubuntu, configure krb5.conf for clients, administer principals with kadmin, obtain and manage tickets with kinit, klist, and kdestroy, and kerberize network services such as SSH.
• Prerequisites: Lesson 48 (AppArmor Mandatory Access Control), understanding of DNS and time synchronization
• Estimated reading time: 30 minutes

Introduction

Kerberos is a network authentication protocol that uses symmetric-key cryptography and a trusted third party — the Key Distribution Center (KDC) — to authenticate users and services without transmitting passwords over the network. Instead of sending credentials directly to each service, a user obtains a time-limited ticket from the KDC and presents that ticket to prove identity.

Developed at MIT in the 1980s and now standardized as RFC 4120, Kerberos is the default authentication mechanism in Microsoft Active Directory and is widely used in Linux environments for single sign-on (SSO) across SSH, NFS, LDAP, and web services.

In this lesson you will learn the theory behind Kerberos authentication, then set up a fully functional KDC on Ubuntu Server, create user and service principals, and configure a client to obtain and use Kerberos tickets.

Kerberos Protocol Theory

Core Components

• Key Distribution Center (KDC): The trusted server that issues tickets. It consists of two logical services: the Authentication Server (AS) and the Ticket Granting Server (TGS).
• Realm: A Kerberos administrative domain, written in uppercase by convention (e.g., EXAMPLE.COM). All principals belong to a realm.
• Principal: An identity known to Kerberos. User principals look like alice@EXAMPLE.COM; service principals look like HTTP/web.example.com@EXAMPLE.COM.
• Ticket Granting Ticket (TGT): The initial ticket obtained from the AS. The TGT proves the user authenticated successfully and is used to request service tickets without re-entering the password.
• Service Ticket: A ticket for a specific service, requested from the TGS by presenting the TGT.

Authentication Flow

The Kerberos exchange involves three steps:

1. AS Exchange: The client sends the user principal name to the AS. The AS responds with a TGT encrypted with the user’s secret key (derived from the password). The client decrypts this using the password entered by the user.
2. TGS Exchange: When the client needs to access a service, it presents the TGT to the TGS and requests a service ticket. The TGS returns a service ticket encrypted with the service’s secret key.
3. AP Exchange: The client presents the service ticket to the application server. The server decrypts it with its own key and verifies the client’s identity.

At no point does the user’s password travel over the network. Tickets are time-limited (typically 10 hours) and include encrypted session keys for secure communication.

Installing the KDC on Ubuntu

Prerequisites

Kerberos is extremely sensitive to time differences. All machines in the realm must have clocks synchronized within 5 minutes. Ensure NTP is running on every host. DNS must also resolve hostnames correctly — both forward and reverse lookups.

# Verify time sync
$ timedatectl status
$ chronyc tracking

# Verify DNS
$ host kdc.example.com
$ host -t PTR 10.0.1.5

Install KDC Packages

# Install the KDC and admin server
$ sudo apt install krb5-kdc krb5-admin-server krb5-config

# During installation, you will be prompted for:
#   Default Kerberos realm: EXAMPLE.COM
#   Kerberos servers: kdc.example.com
#   Administrative server: kdc.example.com

Configure krb5.conf

# /etc/krb5.conf — KDC and client configuration
[libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 10h
    renew_lifetime = 7d
    forwardable = true
    rdns = false

[realms]
    EXAMPLE.COM = {
        kdc = kdc.example.com
        admin_server = kdc.example.com
        default_domain = example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM

Create the Realm Database

# Initialize the KDC database (choose a strong master password)
$ sudo krb5_newrealm

# This creates the database in /var/lib/krb5kdc/
# and generates the stash file for the master key

Administering Principals with kadmin

Principals are managed using kadmin.local (on the KDC, no authentication needed) or kadmin (remote, requires an admin principal).

# Create an admin principal first
$ sudo kadmin.local
kadmin.local: addprinc admin/admin@EXAMPLE.COM
# Enter password for principal "admin/admin@EXAMPLE.COM":

# Configure ACL for the admin principal
# /etc/krb5kdc/kadm5.acl
*/admin@EXAMPLE.COM     *

# Restart the admin server
$ sudo systemctl restart krb5-admin-server

Managing User and Service Principals

# Connect with kadmin (remote or local)
$ sudo kadmin.local

# Add a user principal
kadmin.local: addprinc alice@EXAMPLE.COM

# Add a service principal for SSH on a host
kadmin.local: addprinc -randkey host/server1.example.com@EXAMPLE.COM

# Export the service keytab (for the application server)
kadmin.local: ktadd -k /tmp/server1.keytab host/server1.example.com@EXAMPLE.COM

# List all principals
kadmin.local: listprincs

# View principal details
kadmin.local: getprinc alice@EXAMPLE.COM

# Change a password
kadmin.local: cpw alice@EXAMPLE.COM

# Delete a principal
kadmin.local: delprinc bob@EXAMPLE.COM

Deploying Keytabs

# Copy the keytab to the target server securely
$ scp /tmp/server1.keytab admin@server1:/etc/krb5.keytab

# On the target server, verify the keytab
$ sudo klist -k /etc/krb5.keytab
Keytab name: FILE:/etc/krb5.keytab
KVNO Principal
---- ----------
   2 host/server1.example.com@EXAMPLE.COM

# Set correct permissions
$ sudo chmod 600 /etc/krb5.keytab
$ sudo chown root:root /etc/krb5.keytab

Client Operations: kinit, klist, kdestroy

# Install the client utilities
$ sudo apt install krb5-user

# Obtain a TGT (prompts for password)
$ kinit alice@EXAMPLE.COM
Password for alice@EXAMPLE.COM:

# List current tickets
$ klist
Ticket cache: FILE:/tmp/krb5cc_1000
Default principal: alice@EXAMPLE.COM

Valid starting       Expires              Service principal
01/15/2026 09:00:00  01/15/2026 19:00:00  krbtgt/EXAMPLE.COM@EXAMPLE.COM
    renew until 01/22/2026 09:00:00

# Renew a ticket before it expires
$ kinit -R

# Destroy all tickets (log out)
$ kdestroy

# Verify tickets are gone
$ klist
klist: No credentials cache found

Kerberizing SSH

Once Kerberos is configured, SSH can use GSSAPI authentication so users with valid TGTs can log in without passwords or SSH keys.

# On the SSH server — /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
GSSAPIStrictAcceptorCheck yes

# Restart sshd
$ sudo systemctl restart sshd

# On the SSH client — /etc/ssh/ssh_config or ~/.ssh/config
Host *.example.com
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

# Usage: obtain a TGT, then SSH without a password
$ kinit alice@EXAMPLE.COM
$ ssh server1.example.com
# No password prompt — Kerberos ticket is used

Key Takeaways

• Kerberos provides network-wide single sign-on through ticket-based authentication — passwords never cross the network.
• The Key Distribution Center (KDC) issues Ticket Granting Tickets (TGTs) and service tickets; all machines must have synchronized clocks and correct DNS.
• Principals represent users (alice@REALM) and services (host/server@REALM); manage them with kadmin or kadmin.local.
• Use kinit to obtain tickets, klist to view them, and kdestroy to remove them; keytabs allow services to authenticate without human interaction.
• SSH, NFS, LDAP, and many other services support GSSAPI/Kerberos authentication for passwordless, ticket-based access.

What’s Next

In the next lesson you will learn about OpenLDAP Directory Service — how to build a centralized directory for user accounts, groups, and organizational data using the LDAP protocol.

# 安裝 KDC 和管理伺服器
$ sudo apt install krb5-kdc krb5-admin-server krb5-config

# 初始化 KDC 資料庫
$ sudo krb5_newrealm

# /etc/krb5.conf
[libdefaults]
    default_realm = EXAMPLE.COM
    ticket_lifetime = 10h
    renew_lifetime = 7d
    forwardable = true

[realms]
    EXAMPLE.COM = {
        kdc = kdc.example.com
        admin_server = kdc.example.com
    }

# 建立管理主體
$ sudo kadmin.local
kadmin.local: addprinc admin/admin@EXAMPLE.COM

# 建立使用者主體
kadmin.local: addprinc alice@EXAMPLE.COM

# 建立服務主體
kadmin.local: addprinc -randkey host/server1.example.com@EXAMPLE.COM

# 匯出 keytab
kadmin.local: ktadd -k /tmp/server1.keytab host/server1.example.com@EXAMPLE.COM

# 列出所有主體
kadmin.local: listprincs

# 獲取 TGT
$ kinit alice@EXAMPLE.COM

# 列出當前票證
$ klist

# 更新票證
$ kinit -R

# 銷毀所有票證
$ kdestroy

# SSH 伺服器 — /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

# SSH 客戶端 — ~/.ssh/config
Host *.example.com
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

# 使用：獲取 TGT 後無密碼 SSH
$ kinit alice@EXAMPLE.COM
$ ssh server1.example.com

# KDC と管理サーバーのインストール
$ sudo apt install krb5-kdc krb5-admin-server krb5-config

# KDC データベースの初期化
$ sudo krb5_newrealm

# /etc/krb5.conf
[libdefaults]
    default_realm = EXAMPLE.COM
    ticket_lifetime = 10h
    renew_lifetime = 7d
    forwardable = true

[realms]
    EXAMPLE.COM = {
        kdc = kdc.example.com
        admin_server = kdc.example.com
    }

# 管理プリンシパルの作成
$ sudo kadmin.local
kadmin.local: addprinc admin/admin@EXAMPLE.COM

# ユーザープリンシパルの追加
kadmin.local: addprinc alice@EXAMPLE.COM

# サービスプリンシパルの追加
kadmin.local: addprinc -randkey host/server1.example.com@EXAMPLE.COM

# keytab のエクスポート
kadmin.local: ktadd -k /tmp/server1.keytab host/server1.example.com@EXAMPLE.COM

# すべてのプリンシパルの一覧
kadmin.local: listprincs

# TGT の取得
$ kinit alice@EXAMPLE.COM

# 現在のチケットの一覧
$ klist

# チケットの更新
$ kinit -R

# すべてのチケットの破棄
$ kdestroy

# SSH サーバー — /etc/ssh/sshd_config
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes

# SSH クライアント — ~/.ssh/config
Host *.example.com
    GSSAPIAuthentication yes
    GSSAPIDelegateCredentials yes

# 使用方法：TGT を取得してからパスワードなしで SSH
$ kinit alice@EXAMPLE.COM
$ ssh server1.example.com