Kerberos and network access security

Kerberos and network access security

Kerberos and network access security
William Boswell

Windows 2000 now has Kerberos security, and this tip, excerpted from InformIT, will tell you the basics in understanding

    Requires Free Membership to View

    Login

    When you register, my team of editors will also send you the latest expert resources covering pertinent IT topics such as Windows server backup and recovery, server administration, storage management, infrastructure security, virtualization, Hyper-V, Active Directory and Group Policy.

    Cathleen A. Gagne, Senior Editorial Director

    By submitting your registration information to SearchWindowsServer.com you agree to receive email communications from TechTarget and TechTarget partners. We encourage you to read our Privacy Policy which contains important disclosures about how we collect and use your registration and other information. If you reside outside of the United States, by submitting this registration information you consent to having your personal data transferred to and processed in the United States. Your use of SearchWindowsServer.com is governed by our Terms of Use. You may contact us at webmaster@TechTarget.com.

this technology. The material for this tip comes from the author's book, Inside Windows 2000 Server.

Since its inception, classic NT has used a proprietary authentication scheme called NT LAN Manager (NTLM) Challenge-Response. With Windows 2000, Microsoft adopted a public domain authentication scheme called Kerberos. Kerberos was developed at MIT as part of Project Athena. It takes its name from the mythological three-headed hound that guarded the gates of the underworld in Roman mythology. (If you're a humanities scholar making the transition to Information Technology, you may wonder why Project Athena picked a Roman mythic creature rather than the Greek counterpart, Cerberus. I can't help you. Computers and classics just don't mix.)

Windows 2000 uses version 5 of Kerberos as defined by RFC 1510, "The Kerberos Network Authentication Service V5." Many Kerberos implementations also use an API library described in RFC 1964, "The Kerberos Version 5 Generic Security Service Application Programming Interface (GSS-API) Mechanism." Windows 2000 does not use the GSS-API directly. Instead, it uses a similar set of function calls exposed by the Security Support Provider Interface (SSPI).

Because the authentication mechanism is designed to be as transparent as possible, it isn't all that obvious that Kerberos is at work rather than the classic NTLM Challenge-Response. Windows 2000 uses Kerberos in the following circumstances:

  • Authenticating users logging on to Windows 2000 domain controllers
  • Authenticating users logging on to Windows 2000 servers and workstations that are members of a Windows 2000 domain
  • Authenticating users logging on to standalone Windows 2000 servers and workstations
  • Authenticating users accessing a Windows 2000 server or workstation from a Windows 9x client configured with the Active Directory add-on

NTLM Challenge-Response authentication is used in the following instances:

  • Authenticating users logging on to Windows 2000 servers and workstations that are members of a classic NT domain (or accessing a classic NT domain from a Windows 2000 domain via a trust relationship)
  • Authenticating users accessing a Windows 2000 server or workstation from a classic NT server or workstation
  • Authenticating users accessing a Windows 2000 server from a standard Windows 9x or 3.1x client

If you find yourself wondering how to verify this, you can enable auditing and examine the logged transactions, because a user logs on both at the console of a member workstation and the console of the server.

To learn more about Inside Windows 2000 Server, or to buy this book, click here.

To read all of this tip, click over to InformIT. You have to register there, but it's free.

Did you like this tip? If so (or if not) why not let us know? Email to sound off.


This was first published in May 2001

Disclaimer: Our Tips Exchange is a forum for you to share technical advice and expertise with your peers and to learn from other enterprise IT professionals. TechTarget provides the infrastructure to facilitate this sharing of information. However, we cannot guarantee the accuracy or validity of the material submitted. You agree that your use of the Ask The Expert services and your reliance on any questions, answers, information or other materials received through this Web site is at your own risk.

Back to top