Since I had already explained in the past on the mechanism about kerberos, I would try to keep this as much simple as I can.
Go through the below scanned pic, in short have written few notes ..
Principal Name and key are specified to the client, so clients sends principal name and request for TGT to KDC.
KDC generates session key(SK) and TGT containing copy of session key, uses TGS to encrypt TGT. Principal key used to encrypt [ Encrypted GT and copy of session key], Client Decrypts using its principal key to extract session key and encrypted TGT.
When client wants to use any service(SSH/NFS..etc) to obtain access for local or remote system( hereafter referred as service provider), it will use session key to encrypt TGT, clients IP addr, time stamp, and SR and sends to KDC
KDC uses its session keys and TGS keys to extract IP addr, time stamp allowing itself to validate client, on successful generates service session key(SSK) and SR containing IP addr+time stamp+copy of SSK and encrypts using service key for SR.
SK to encrypt both E(SR) and copy of SSK.
Client uses its copy of SK to extract E(E(SR)+SSK)
Client sends the E(SR) to service provider along with E[ Principal name + Time stamp] with E(SSK)
Service provider uses SK to extract SR which it retrieves SSK to decrypt clients E( Time stamp + Principal Name)
Once its successful, service provider grants access to its host system.
How to implement kerberos:
Thanks.
No comments:
Post a Comment