| Red Hat Linux 7.2: The Official Red Hat Linux Reference Guide | ||
|---|---|---|
| Prev | Chapter 8. Using Kerberos 5 on Red Hat Linux | Next |
Like any other system, Kerberos has its own terminology. Before we talk about how it works, here is a list of terms that you will need to know:
Encrypted data.
An entity on the network (a user, a host, or an application) that can get a ticket from Kerberos.
A file which contains the keys for encrypting communications between a user and various network services. Kerberos 5 provides a framework for using other cache types (such as shared memory), but files are better supported.
Data used when encrypting or decrypting other data. Encrypted data cannot be decrypted without the proper key or extremely good guessing.
A service that issues Kerberos tickets, usually run on the same host as the Ticket Granting Server.
A file that includes an unencrypted list of principals and their keys. Servers retrieve the keys they need from keytab files instead of using kinit. The default keytab file is /etc/krb5.keytab. The kadmind command is the only service that uses any other file (it uses /var/kerberos/krb5kdc/kadm5.keytab).
Unencrypted data.
A user or service that can authenticate using Kerberos. A principal's name is in the form "root[/instance]@REALM". For a typical user, the root is the same as their login ID. The instance is optional. If the principal has an instance, it is separated from the root with a forward slash ("/"). An empty string ("") is actually a valid instance (which differs from the default, NULL instance), but using it can be confusing. All principals in a realm have their own key, which is derived from their password (for users) or randomly set (for services).
A network that uses Kerberos, composed of one or a few servers (also known as KDCs) and a potentially very large number of clients.
A program or computer accessed over the network.
A temporary set of electronic credentials that verify the identity of a client for a particular service.
Issues tickets for a desired service that are used by the user to actually gain access to the service. The TGS usually runs on the same host as the KDC.
A special ticket which allows the client to obtain additional tickets without applying for them from the KDC.