Kerberos

• Ticket-based authentication system
• Every service will not have a password
• If you have a ticket for service X, you will only be able to access service X and not Y

TGT - Ticket Granting Ticket - first ticket obtained on the kerberos system - Permits client to get tickets (TGS) for authorized services TGS - Ticket Granting Service - requested by client to use a service - allow services to verify identity and provide response

• While requesting for a TGT, client must authenticate with the domain controller
• Client sends the current timestamp encrypted with its password hash
• DC has clients password hash and if able to decrypt the timestamp, server will send the TGT to the client

• After this, client does not have to prove who they are with their password

• EG: if client wants to access the MySQL server

  • Client will request a TGS from the KDC (Key distribution center) presenting its TGT
  • KDC will then provide the TGS to access MySQL