版权说明:本文档由用户提供并上传,收益归属内容提供方,若内容存在侵权,请进行举报或认领
文档简介
1、Active Directory and NT Kerberos,Rooster JD Glaser,Introduction to NT Kerberos v5,What is NT Kerberos? How is it different from NTLM NT Kerberos vs MIT Kerberos Delegation and Client Authentication What does NT Kerberos look like on the wire? KTNet - A native NT Kerberos telnet server,What is NT Ker
2、beros,NTs new authentication system MIT Kerberos v5 - an Open Standard Kerberos is the default authenticator in W2K domains NTLM still used for compatibility usually the weakest version,How is it different from NTLM,Doesnt use a password hash system Requires fewer authentication calls More sophistic
3、ated - Yes More secure? - Possibly in pure mode Backwards compatibility hinders it NTLM v2 is strong in pure mode as well,NT Kerberos,Integrated with platform Locates KDC via DNS - DNS server required for install No support for DCE style cross-realm trust No “raw” krb5 API Postdated tickets (not imp
4、lemented) Uses authdata field in ticket,Windows 2000 Kerberos standards,RFC-1510 Kerberos change password protocol Kerberos set password protocolRC4-HMAC Kerberos Encryption type PKINIT,Kerberos Interoperability Scenarios,Kerberos clients in a Win2000 domain Kerberos servers in a Win2000 domain Stan
5、dalone Win2000 systems in a Kerberos realm Using a Kerberos realm as a resource domain Using a Kerberos realm as an account domain,MIT Kerberos Differences,Win2000 Clients Just logon Just logoff Domain membership Example app: everything Servers Use computer account via SCM,MIT Clients User logon wit
6、h kinit User logoff with kdestroy Configured with /etc/krb5.conf Example app: telnet Servers Do not logon use saved keys from keytab,Using Kerberos clients,Customer wants to have its non-windows Kerberos users use their Win2000 accounts,Setup the /etc/krb5.conf Users kinit with their Win2000 account
7、,Windows 2000 Server,Unix workstation,Using Kerberos servers,Customer wants to user their Kerberos enabled database server in an n-tier application front-ended by IIS,/etc/krb5.conf on database server Create service account in domain Use ktpass to export a keytab Copy keytab to database server IIS s
8、erver is trusted for delegation,Windows 2000 IIS Server,Unix Database Server,Windows 2000 Wks,Kerberos realm as an account domain,User logon with Kerberos principal User has shadow account in an account domain (for applying authz) Mapping is used at logon for domain identity,UserMIT.REALM.COM,MIT.RE
9、ALM.COM,Domain trusts realm users,comp$, (userMIT.REALM.COM),Standalone Win2000 computers,An employee has a Win2000 computer that they want to use in a Kerberos realm,Configure system as standalone (no domain) Use Ksetup to configure the realm Use Ksetup to establish the local account mapping Logon
10、to Kerberos realm,Win2000,Linux/Unix,MIT.REALM.COM,Trusting a Kerberos realm,Win2000 users accessing services in Kerberos realms Kerberos users accessing services in domains,Domain,Domain,Domain,Domain,europe. microsoft. com,fareast. microsoft. com,Windows 2000 Domain Trusts,Cross-domain Authenticat
11、ion,Windows 2000 Professional,Windows 2000 Server,KDC,KDC,Using Unix KDCs withWindows 2000 Authorization,Win2000 Professional,Windows 2000 Server,COMPANY.REALM,MITKDC,Windows 2000KDC,Name Mapping to NT account,NT Kerberos vs MIT Kerberos,NT caches the password for ticket renewal Its not certain whether NT uses ticket caching tracking stolen replay tickets,Kerberos v5 Ticket Deta
温馨提示
- 1. 本站所有资源如无特殊说明,都需要本地电脑安装OFFICE2007和PDF阅读器。图纸软件为CAD,CAXA,PROE,UG,SolidWorks等.压缩文件请下载最新的WinRAR软件解压。
- 2. 本站的文档不包含任何第三方提供的附件图纸等,如果需要附件,请联系上传者。文件的所有权益归上传用户所有。
- 3. 本站RAR压缩包中若带图纸,网页内容里面会有图纸预览,若没有图纸预览就没有图纸。
- 4. 未经权益所有人同意不得将文件中的内容挪作商业或盈利用途。
- 5. 人人文库网仅提供信息存储空间,仅对用户上传内容的表现方式做保护处理,对用户上传分享的文档内容本身不做任何修改或编辑,并不能对任何下载内容负责。
- 6. 下载文件中如有侵权或不适当内容,请与我们联系,我们立即纠正。
- 7. 本站不保证下载资源的准确性、安全性和完整性, 同时也不承担用户因使用这些下载资源对自己和他人造成任何形式的伤害或损失。
最新文档
- 2024年硫代硫酸盐行业营销策略方案
- 一级造价工程师《造价管理》株洲市株洲县2024年临考冲刺试题含解析
- 中国叶绿素含量测定仪行业市场现状分析及竞争格局与投资发展研究报告2024-2029版
- 中国韩式多功能电热锅行业市场现状分析及竞争格局与投资发展研究报告2024-2029版
- 中国高精度电流互感器行业市场现状分析及竞争格局与投资发展研究报告2024-2029版
- 婴儿床市场发展现状分析及行业投资战略研究报告2024-2029版
- 汽车钢管市场发展现状分析及行业投资战略研究报告2024-2029版
- 2024年云安全服务项目合作计划书
- 2024年磁盘用微晶玻璃基板项目发展计划
- 2024年采泥器合作协议书
- Unit 6 Meet my family 单元整体教学说课(教学设计)-2024-2025学年人教PEP版英语四年级上册
- 2024年上海烟草集团限责任公司招聘24人高频考题难、易错点模拟试题(共500题)附带答案详解
- 2024年五年级英语上册 Unit 3 Do you want some rice教案 湘少版
- 2024-2025学年七年级道德与法治上册 第一单元 单元测试卷(人教陕西版)
- 智能农机可行性分析报告
- 商务数据分析与应用 课程标准
- 八年级语文上册 第一单元 单元测试卷(人教广东版 2024年秋)
- 2024年湖南省中考道德与法治试题卷(含答案)
- 《小初衔接讲座》课件
- 江苏省医务人员医德考评表
- 愚公移山英文 -中国故事英文版课件
评论
0/150
提交评论