Kerberos - Revision history

Mbaney at 17:18, 30 June 2025

2025-06-30T17:18:31Z

← Older revision		Revision as of 17:18, 30 June 2025
Line 1:		Line 1:
	===Introduction to Kerberos===		===Introduction to Kerberos===

	Kerberos provides a toolkit for reducing the risks associated with insecure networks. It provides a unified password space in which ~~we can manage~~ strong passwords easily and it can prevent your password from being sent across the network as cleartext.		Kerberos provides a toolkit for reducing the risks associated with insecure networks. It provides a unified password space in which strong passwords can be easily managed and it can prevent your password from being sent across the network as cleartext.

	===Working with Kerberos===		===Working with Kerberos===

Mbaney at 17:17, 30 June 2025

2025-06-30T17:17:26Z

← Older revision		Revision as of 17:17, 30 June 2025
Line 17:		Line 17:
	-bash-4.2$ klist		-bash-4.2$ klist
	Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg		Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg
	Default principal: username@~~AD.UMIACS.~~UMD.EDU		Default principal: username@UMD.EDU

	Valid starting Expires Service principal		Valid starting Expires Service principal
	05/28/18 11:39:36 05/28/18 18:19:36 krbtgt/~~AD.UMIACS.~~UMD.EDU@~~AD.UMIACS.~~UMD.EDU		05/28/18 11:39:36 05/28/18 18:19:36 krbtgt/UMD.EDU@UMD.EDU

	'Default principal' indicates the Kerberos identity of the current process. In this case, the Kerberos principal, 'username@~~AD.UMIACS.~~UMD.EDU' indicates that we are authenticated as the user 'username' to the realm '~~AD.UMIACS.~~UMD.EDU'.		'Default principal' indicates the Kerberos identity of the current process. In this case, the Kerberos principal, 'username@UMD.EDU' indicates that we are authenticated as the user 'username' to the realm 'UMD.EDU'.

	If your credentials have not been set up correctly, klist will report:		If your credentials have not been set up correctly, klist will report:

Jayid07: /* Listing your credentials */

2022-04-22T22:42:47Z

Listing your credentials

← Older revision		Revision as of 22:42, 22 April 2022
Line 15:		Line 15:
	It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct,		It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct,

	~~[username@opensub02 ~]~~$ klist		-bash-4.2$ klist
	Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg		Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg
	Default principal: username@AD.UMIACS.UMD.EDU		Default principal: username@AD.UMIACS.UMD.EDU
Line 26:		Line 26:
	If your credentials have not been set up correctly, klist will report:		If your credentials have not been set up correctly, klist will report:

	~~[username@opensub02 ~]~~$ klist		-bash-4.2$ klist
	klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)		klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)

Mbaney at 15:39, 7 May 2021

2021-05-07T15:39:25Z

← Older revision		Revision as of 15:39, 7 May 2021
Line 15:		Line 15:
	It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct,		It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct,

	[~~derek~~@~~opensub00~~ ~]$ klist		[username@opensub02 ~]$ klist
	Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg		Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg
	Default principal: ~~derek~~@AD.UMIACS.UMD.EDU		Default principal: username@AD.UMIACS.UMD.EDU

	Valid starting Expires Service principal		Valid starting Expires Service principal
	05/28/18 11:39:36 05/28/18 18:19:36 krbtgt/AD.UMIACS.UMD.EDU@AD.UMIACS.UMD.EDU		05/28/18 11:39:36 05/28/18 18:19:36 krbtgt/AD.UMIACS.UMD.EDU@AD.UMIACS.UMD.EDU

	'Default principal' indicates the Kerberos identity of the current process. In this case, the Kerberos principal, '~~derek~~@AD.UMIACS.UMD.EDU' indicates that ~~I am~~ authenticated as the user '~~derek~~' to the realm 'AD.UMIACS.UMD.EDU'.		'Default principal' indicates the Kerberos identity of the current process. In this case, the Kerberos principal, 'username@AD.UMIACS.UMD.EDU' indicates that we are authenticated as the user 'username' to the realm 'AD.UMIACS.UMD.EDU'.

	If your credentials have not been set up correctly, klist will report:		If your credentials have not been set up correctly, klist will report:

	[~~derek~~@~~opensub00~~ ~]$ klist		[username@opensub02 ~]$ klist
	klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)		klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)

Mbaney at 16:55, 5 September 2018

2018-09-05T16:55:48Z

← Older revision		Revision as of 16:55, 5 September 2018
Line 5:		Line 5:
	===Working with Kerberos===		===Working with Kerberos===

	When you successfully log into any of our ~~kerberos~~ authenticated systems, you will be granted a set of credentials which will identify you to other network resources. Most users can take advantage of Kerberos without any detailed ~~knowlege~~ about the system.		When you successfully log into any of our Kerberos authenticated systems, you will be granted a set of credentials which will identify you to other network resources. Most users can take advantage of Kerberos without any detailed knowledge about the system.

	The only significant complication for some users is that credentials expire after one week at UMIACS. In some environments, the lack of credentials can cause the user environment to behave erratically as network resources become unavailable.		The only significant complication for some users is that credentials expire after one week at UMIACS. In some environments, the lack of credentials can cause the user environment to behave erratically as network resources become unavailable.

	Whenever possible, we strongly suggest that users log out of their environments nightly.		Whenever possible, we strongly suggest that users log out of their environments nightly.

	~~===Password Policies===~~

	~~We have the following policies in regards to our passwords,~~

	* Maximum Ticket Lifetime : 21days
	~~<tt>This is the longest you can get a Kerberos Ticket for, after that you have to renew your tickets or re-authenticate.</tt>~~
	* Minimum Password Length : 8 Characters
	~~<tt>This requires that your password is a minimum of 8 characters (it can have more just not less)</tt>~~
	* Minimum Character Classes : 3 Character Classes
	~~<tt>Requires that a password have more than 3 character classes they include: lower-case letters, upper-case letters, digits and punctuation.</tt>~~
	* Number of Previous Passwords Kept: 5
	~~<tt>Kerberos will store your last 5 passwords and will not let you set a new password to them, please choose a new password.</tt>~~

	===Listing your credentials===		===Listing your credentials===

	It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct ,		It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct,

	[derek@~~kiwi~~ ~]$ klist		[derek@opensub00 ~]$ klist
	Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg		Ticket cache: FILE:/tmp/krb5cc_2174_dcDWCg
	Default principal: derek@UMIACS.UMD.EDU		Default principal: derek@AD.UMIACS.UMD.EDU

	Valid starting Expires Service principal		Valid starting Expires Service principal
	05/28/08 11:39:36 05/29/~~08 11~~:39:36 krbtgt/UMIACS.UMD.EDU@UMIACS.UMD.EDU		05/28/18 11:39:36 05/28/18 18:19:36 krbtgt/AD.UMIACS.UMD.EDU@AD.UMIACS.UMD.EDU


	~~Kerberos 4 ticket cache: /tmp/tkt2174~~
	~~klist: You have no tickets cached~~

	'Default principal' indicates the ~~kerberos~~ identity of the current process. In this case, the ~~kerberos pricipal~~, 'derek@UMIACS.UMD.EDU' indicates that I am authenticated as the user 'derek' to the realm 'UMIACS.UMD.EDU'.		'Default principal' indicates the Kerberos identity of the current process. In this case, the Kerberos principal, 'derek@AD.UMIACS.UMD.EDU' indicates that I am authenticated as the user 'derek' to the realm 'AD.UMIACS.UMD.EDU'.

	If my credentials have not been set up correctly, klist will report:		If your credentials have not been set up correctly, klist will report:

	[derek@~~kiwi~~ ~]$ klist		[derek@opensub00 ~]$ klist
	klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)		klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_2174_dcDWCg)


	~~Kerberos 4 ticket cache: /tmp/tkt2174~~
	~~klist: You have no tickets cached~~

	~~===Reinitialize your Credentials===~~

	~~When available, use <tt>kinit -R</tt> to refresh your current credentials.~~

	===Single Sign On Services===		===Single Sign On Services===

	Kerberos authenticated IMAP and SMTP provide secure and convenient methods sending and reading mail. Unlike traditional IMAP and SMTP services, your password is never sent over the network as cleartext and your password is not cached on a client.		Kerberos authenticated IMAP and SMTP provide secure and convenient methods for sending and reading mail. Unlike traditional IMAP and SMTP services, your password is never sent over the network as cleartext and your password is not cached on a client.

	===Password Security===		===Password Security===

	Kerberos security depends on the security of your password. Although Kerberos can make secure access to services convenient, it is still your responsibility to secure your password. Please try to choose a strong password and use secure protocols.		Kerberos security depends on the security of your password. Although Kerberos can make secure access to services convenient, it is still your responsibility to secure your password. Please try to choose a strong password and use secure protocols.

Mbaney at 16:43, 5 September 2018

2018-09-05T16:43:21Z

@@ Line 23: / Line 23: @@
 * Number of Previous Passwords Kept:  5
 <tt>Kerberos will store your last 5 passwords and will not let you set a new password to them, please choose a new password.</tt>
 ===Listing your credentials===

Liam at 18:10, 8 April 2014

2014-04-08T18:10:34Z

← Older revision		Revision as of 18:10, 8 April 2014
Line 26:		Line 26:
	===Managing your Kerberos Account===		===Managing your Kerberos Account===

	You can change your password via ~~visting~~ this link,		You can change your password via this link,

	https://intranet.umiacs.umd.edu/~~cgi-bin~~/~~changepass~~		https://intranet.umiacs.umd.edu/password/krb5

	Administrative information associated with your account by this link,		Administrative information associated with your account by this link,

	https://intranet.umiacs.umd.edu/~~chinfo~~		https://intranet.umiacs.umd.edu/directory/info

	===Listing your credentials===		===Listing your credentials===

Derek: /* Password Policies */

2009-10-20T17:46:05Z

Password Policies

← Older revision		Revision as of 17:46, 20 October 2009
Line 19:		Line 19:
	* Minimum Password Length : 8 Characters		* Minimum Password Length : 8 Characters
	<tt>This requires that your password is a minimum of 8 characters (it can have more just not less)</tt>		<tt>This requires that your password is a minimum of 8 characters (it can have more just not less)</tt>
	* Minimum Character Classes : 2 Character Classes		* Minimum Character Classes : 3 Character Classes
	<tt>Requires that a password have more than 2 character classes they include: lower-case letters, upper-case letters, digits and punctuation.</tt>		<tt>Requires that a password have more than 3 character classes they include: lower-case letters, upper-case letters, digits and punctuation.</tt>
	* Number of Previous Passwords Kept: 5		* Number of Previous Passwords Kept: 5
	<tt>Kerberos will store your last 5 passwords and will not let you set a new password to them, please choose a new password.</tt>		<tt>Kerberos will store your last 5 passwords and will not let you set a new password to them, please choose a new password.</tt>

Derek: /* Single Sign On Services */

2009-08-19T17:09:05Z

Single Sign On Services

← Older revision		Revision as of 17:09, 19 August 2009
Line 66:		Line 66:
	===Single Sign On Services===		===Single Sign On Services===

	Kerberos authenticated ~~Pop~~ and ~~IMAP~~ provide secure and convenient methods reading mail. Unlike traditional ~~POP3~~ and ~~IMAP~~ services, your password is never sent over the network as cleartext and your password is not cached on a client.		Kerberos authenticated IMAP and SMTP provide secure and convenient methods sending and reading mail. Unlike traditional IMAP and SMTP services, your password is never sent over the network as cleartext and your password is not cached on a client.

	We are actively working to use kerberos authentication with the OpenSSH package to provide single sign-on services for SSH, SCP, SFTP, and FTP so that users can login to remote systems, execute remote commands, and transfer files without typing your password or managing authentication tokens like .shosts files or key pairs.

	===Password Security===		===Password Security===

	Kerberos security depends on the security of your password. Although Kerberos can make secure access to services convenient, it is still your responsibility to secure your password. Please try to choose a strong password and use secure protocols.		Kerberos security depends on the security of your password. Although Kerberos can make secure access to services convenient, it is still your responsibility to secure your password. Please try to choose a strong password and use secure protocols.

Derek: /* Listing your credentials */

2008-09-05T21:00:32Z

Listing your credentials

← Older revision		Revision as of 21:00, 5 September 2008
Line 36:		Line 36:
	===Listing your credentials===		===Listing your credentials===

	It is often useful to examine your current credentials. Using `klist`, you can verify that your login is correct ,		It is often useful to examine your current credentials. Using <tt>klist</tt>, you can verify that your login is correct ,

	[derek@kiwi ~]$ klist		[derek@kiwi ~]$ klist