One way to think of using Kerberos is to think of going to an amusement park. When you arrive at the park, you go to the main gate. You then proceed to the main ticket booth (the authentication server in the key distribution center) and purchase an all-day pass to the park (a ticket-granting ticket). You receive a purple wristband (because purple is the color for Wednesday) that indicates that you have paid your fee for that day and you have full access to the park. The colored wristband is good for all day. While in the park, you must purchase additional tickets for the rides. You walk up to a ticket booth (ticket-granting server) and the attendant notices that you have a purple wristband. You tell her you are wanting to ride the roller coaster. She issues you a ticket (session ticket) for the roller coaster. When you get to the roller coaster, the roller coaster attendant sees your purple wristband and accepts the ticket issued to you by the ticket seller. The roller coaster attendant does not need to check with the ticket seller because that is the only place you could have obtained that ticket. At the end of the day, when the park closes, the purple wristband for Wednesday no longer authenticates you. The wristband color for Thursday is orange. You also noticed that you did all the work. None of the ticket sellers or ride operators communicated with each other. It was up to you to procure tickets and walk around and distribute them. This is exactly the model as designed by MIT for Kerberos.

@anibaldk

4 жыл бұрын

Your explanation is clearer than the entire video

@masoomanaqvi5107

4 жыл бұрын

would love for u 2 come up with similar analogy for SAML

@samirul223

4 жыл бұрын

You are the best

@denizbolat19

4 жыл бұрын

great explanation in layman's terms

@TacticalSommelier

4 жыл бұрын

Thank you!

I was trying to understand the flow of the tickets and the keys for kerberos authentication process. This is the easiest explanation I found. It is clear now how it works, in my case for an SMB File share resource sharing. Thanks

@devcentral

Жыл бұрын

Great to hear and thanks for the comment!

Thanks for a great video. Very clear.

Super helpful ...Thank you for clearing the concept !!

@devcentral

2 жыл бұрын

You are welcome and we appreciate the comment!!

The best explanasion how kerberos is works! Thank you!

@devcentral

Жыл бұрын

Thanks for the comment! Glad you enjoyed the video!

amazing explanation

nice backwards writing skills

@treibsandbohrer

4 жыл бұрын

guess what, they probably mirrored the whole thing

@joepelletier6694

4 жыл бұрын

@@charlyGnarly187 its mirrored irl

@clayandro

3 жыл бұрын

@@joepelletier6694 wahahaha xD

@randomlegend631

3 жыл бұрын

Lol

8:34 double encrypted with service key and client key, but the session key is stored inside this double encryption, right? How will the client know that session key? I am assuming that "session key" is the key used to later encrypt all communication between client and server. If not, what happens when somebody intercepts the server ticket, when it is being sent to the server by the client, and then uses it for himself.

This is one of the best detailed explanations for KCD in KZread.

@devcentral

Жыл бұрын

Glad you liked it and thanks for the comment!

After SPNs were explained in a nutshell the rest of the video's req/rep mentions nothing about SPNs. Would be nice if it did.

Good video, will be waiting for the f5 APM part

@devcentral

5 жыл бұрын

Dec 17th

Thanks I like the video, but I have a little question: At 7:53, the session key meant to be used between the client and the service provider (principal) is encrypted using the secret key shared between the TGS and the Service Provider, but how does the client know the session key? If it is encrypted with a key only the principal and the TGS know, the client cannot decrypt it. Which part did I miss? How does the client learn about the session key? Is it just added and "one-time-encrypted" using the shared key between the client and the TGS? Thanks!

@lindsayhefton1582

4 жыл бұрын

I'd watch this first. kzread.info/dash/bejne/kWhopap9Y7neXZM.html

I would be happy to know when you think you will publish the parts 2 & 3

@devcentral

5 жыл бұрын

part 2 will drop Dec 3rd, part 3 Dec 17th.

How do the private keys get distributed to the different places in the first place? thx

@devcentral

5 жыл бұрын

The KDC holds all the secrets, but those secrets if compromised don't equate to having a user's password, just a set of keys derived from the user's password. Section 3.1 of the RFC should help: tools.ietf.org/html/rfc4120#section-3.1

What about Java JAAS and thousands of threads requests? Nobody talks about Java but TGS are always lost in subject. How to workaround?

Waiting for other 2 videos

Thanks!

Best explanation on all of KZread. Kudos.

Good explanation i can see a little better what data transfer protocols are most about.. Cryptography

Dear can i know the mathematical function/ algorithms for kerberos v5 .

@devcentral

5 жыл бұрын

There is a solid list of resources here: medium.com/@robert.broeckelmann/kerberos-v5-related-specs-and-rfcs-281c7b088025.

Are you writing backwards?

@devcentral

3 жыл бұрын

This is how we produce the Lightboards: kzread.info/dash/bejne/h2t5wa5tp6a2hMY.html

Do you make your shirt with backwards logos or is he actually writing backwards?

@devcentral

Жыл бұрын

Partially corrrect! We do have reverse logo shirts and this is how we produce these: kzread.info/dash/bejne/h2t5wa5tp6a2hMY.html

@EdenResolve

Жыл бұрын

@@devcentral thats some fine attention to detail. Quite a few channels out there that don't put that much effort in.

My system is sending user as domain\UserID format using Kerberos but need to send only user as UserID format to grant access. How to remove this domain name from user using Kerberos configuration? Anyone having any idea on this? Thanks for helping

@JasonRahm

Жыл бұрын

should be able to modify the value of that session variable in the APM visual policy editor.

Nice!

Great video! But I don't believe the "Kerberos Tray" is a commonly recognized term in the context of the Kerberos authentication protocol.

Informative

@devcentral

Жыл бұрын

thanks for the comment and glad you liked the video!

What is AS in AS Req? And What is AP in AP Req? Someone kindly elaborate please..

@danife

5 жыл бұрын

Request and Response to and from the KDC Authz Service

Do you know any live working example of KERBEROS?

@HarryYese

3 жыл бұрын

Basically every windows domain and a lot of other stuff uses Kerberos

nice

Waiting for Part2,3

@devcentral

5 жыл бұрын

Dec 3rd, Dec 17th

Could you please explain why ticket is getting large when users are memer of multiple groups?

@devcentral

5 жыл бұрын

the auth token built for a user includes the user SID as well as the SID of every group the user belongs to, which can lead to a very large ticket.

Hi, can you please make a video on ssl vpn via apm module please ?

@devcentral

5 жыл бұрын

Are you thinking a general ssl vpn technology overview with APM specifics?

@abhijithks7419

5 жыл бұрын

F5 DevCentral yes

Is he writing backwards so we can read it forwards?

@l-eon

5 жыл бұрын

Asking the real questions

@alexanderastardjiev9728

5 жыл бұрын

No. He is just writing on the other side of the board. After that the video is flipped vertically.

@l-eon

5 жыл бұрын

@@alexanderastardjiev9728 How come the text on his shirt is readable then?

@in2survive

5 жыл бұрын

Leon Heess s done via software. Notice that he is writing with his “left” hand. Yes, he could be lefty, but that is how it is done.

@l-eon

5 жыл бұрын

@@in2survive No way they are tracking this logo so perfectly behind the glass. Either it is printed on mirrored or there is something else going on.

squeak squeak squeak

sound too difficult to hear.

Not to be nick-picky here, but I think it would help to mention the role of NTP servers being used to avoid running beyond MaxClockSkew

Poorly explained...!!! incoherent!!! !!!!

@patcoder1287

3 жыл бұрын

Bullshit , very well explained. First sort your basics then come and watch the video. Directly u won't understand shit