TECH TIPS
Kerberos and network access security
William Boswell
05.22.2001
Rating: -2.25- (out of 5)
Kerberos and network access security
By William Boswell
Windows 2000 now has Kerberos security and this tip, excerpted from
InformIT, will tell you the basics for understanding this technology.
The material for this tip comes from the author's book, Inside
Windows 2000 Server.
Since its inception, classic NT has used a proprietary authentication
scheme called NT LAN Manager (NTLM) Challenge-Response. With Windows
2000, Microsoft adopted a public domain authentication scheme called
Kerberos. Kerberos was developed at MIT (Massachusetts Institute of
Technology) as part of Project Athena. It takes its name from the
mythological three-headed hound that guarded the gates of the
underworld in Roman mythology. (If you're a humanities scholar making
the transition to Information Technology, you may wonder why Project
Athena picked a Roman mythic creature rather than the Greek
counterpart, Cerberus. I can't help you. Computers and classics just
don't mix.)
Windows 2000 uses Version 5 of Kerberos as defined by RFC 1510, "The
Kerberos Network Authentication Service V5." Many Kerberos
implementations also use an API library described in RFC 1964, "The
Kerberos Version 5 Generic Security Service Application Programming
Interface (GSS-API) Mechanism." Windows 2000 does not use the GSS-API
directly. Instead, it uses a similar set of function calls exposed by
the Security Support Provider Interface (SSPI).
Because the authentication mechanism is designed to be as transparent
as possible, it isn't all that obvious that Kerberos is at work
rather than the classic NTLM Challenge-Response. Windows 2000 uses
Kerberos in the following circumstances:
* Authenticating users logging on to Windows 2000 domain controllers
* Authenticating users logging on to Windows 2000 servers and
workstations that are members of a Windows 2000 domain
* Authenticating users logging on to standalone Windows 2000 servers
and workstations
* Authenticating users accessing a Windows 2000 server or workstation
from a Windows 9x client configured with the Active Directory add-on
NTLM Challenge-Response authentication is used in the following
instances:
* Authenticating users logging on to Windows 2000 servers and
workstations that are members of a classic NT domain (or accessing a
classic NT domain from a Windows 2000 domain via a trust
relationship)
* Authenticating users accessing a Windows 2000 server or workstation
from a classic NT server or workstation
* Authenticating users accessing a Windows 2000 server from a
standard Windows 9x or 3.1x client
If you find yourself wondering how to verify this, you can enable
auditing and examine the logged transactions, because a user logs on
both at the console of a member workstation and the console of the
server.
To read all of this tip, visit InformIT. You have to
register there, but it's free.
Featured Book
Inside Windows 2000 Server
Author : William Boswell
Publisher : New Riders
ISBN/CODE : 1562059297
Cover Type : Soft Cover
Pages : 1512
Published : Jan. 2000
Summary:
Inside Windows 2000 Server has one purpose: to help anyone responsible for the operation of Windows 2000 servers or workstations build a stable, reliable, secure and high-performance system that meets or exceeds the needs of its users. This book doesn't show every single screen for every single menu item in every single operational mode. Such books tell you what is possible, but they don't help you solve real-world problems. Instead, this book tries to anticipate your situation and give you solutions or workarounds that won't leave your system unstable or sluggish. Whenever possible, the examples in this book come directly from production operations. It includes input from over a hundred Win2k public and private newsgroups and dozens of field testers to get a feel for common configuration and management difficulties. It includes information from Microsoft's KnowledgeBase and the accumulated answers on various public FAQs to give you solutions for common and not-so-common problems.
|
|
Rate this Tip
|
To rate tips, you must be a member of SearchSecurity.com.
Register now
to start rating these tips. Log in if you are already a member.
|
DISCLAIMER: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.
|
|
|
|
|
|
|
