Introduction
Kerberos V5 is an authentication system developed at MIT.
Kerberos is named for the three-headed watchdog from Greek mythology,
who guarded the entrance to the underworld.
Under Kerberos, a client (generally either a user or a service) sends a
request for a ticket to the Key Distribution Center (KDC). The KDC
creates a ticket-granting ticket (TGT) for the client, encrypts it
using the client's password as the key, and sends the encrypted TGT back
to the client. The client then attempts to decrypt the TGT, using its
password. If the client successfully decrypts the TGT (i.e., if the
client gave the correct password), it keeps the decrypted TGT, which
indicates proof of the client's identity.
The TGT, which expires at a specified time, permits the client to obtain
additional tickets, which give permission for specific services. The
requesting and granting of these additional tickets is user-transparent.
Since Kerberos negotiates authenticated, and optionally encrypted,
communications between two points anywhere on the internet, it provides
a layer of security that is not dependent on which side of a firewall
either client is on. Since studies have shown that half of the computer
security breaches in industry happen from inside firewalls,
MIT's Kerberos V5 plays a vital role in maintaining your
network security.
The Kerberos V5 package is designed to be easy to use. Most of the
commands are nearly identical to UNIX network programs you already
use. Kerberos V5 is a single-sign-on system, which means
that you have to type your password only once per session, and Kerberos
does the authenticating and encrypting transparently.
