In my last authentication post we spent the length of the discussion gaining a better understanding for NTLM and NTLMv2 based authentication. In that same discussion, we concluded that like NT LAN Manager authentication, steps should be taken to disable NTLM.
For today’s post, I’m going to review Kerberos. As I mentioned before, NTLM not only suffers from a number of short comings, but is also getting a little bit old. That is why, starting in Windows 2000 (almost 8 years ago), Microsoft included support in its operating systems for a mutual authentication protocol called Kerberos.
In short, Kerberos is an authentication protocol which allows entities to communicate over a non-secure network by proving their identities to each using a secure method. Originally, developed by the Massachusetts Institute of Technology (MIT) as part of their Project Athena in the 1980s, the protocol was published freely to everyone in October 1988 and was quickly adopted within many flavors of UNIX. Today, the current version is Kerberos Version 5 and the protocol itself is managed by the Internet Engineering Task Force (IETF).
MIT designed Kerberos as a client-server protocol which enforced mutual authentication between the two entities (both the client and server verify each other’s identity). To facilitate this, Kerberos is based on symmetric key cryptography and requires a trusted third party, also known as the key distribution center (KDC). The KDC is used to maintain a central database of secret keys for each known entity. When one of these entities needs to access services on another entity it proves its identity by sharing knowledge of this key with the KDC. The KDC then generates a session key which is used by the requester to access services on the “server”. In return the “server” provides access to the services and proves its identity to the requester based on information from the KDC.
Interesting enough, if you are running an Active Directory forest, domain members will also attempt to use Kerberos first. In instances where the KDC isn’t present or not trusted NTLM becomes the fallback. Sadly, NTLM is also used in instances where the application or operating system doesn’t support the usage of Kerberos.
The following benefits come into play when Kerberos is used:
- Passwords are never sent across the wire thus protecting them from man-in-the-middle attacks.
- As an authentication protocol the performance is better than NTLM.
- Hey Kerberos an open standard, NTLM is not.
- In Vista and Windows Server 2008, Kerberos supports AES encryption. NTLM doesn’t.
- Kerberos supports delegation. NTLM doesn’t.
Hmmmmm… at this point, you are probably asking the following question: Is it possible to “turn off” NTLM authentication?
Well, the answer is No! Unfortunately, NTLM is part of the Windows Operating System, and it can’t be turned off. However, there are some things that you can do limit its usage. For example:
- Do the items in my previous Authentication posting to enforce NTLMv2 usage and prevent LM hashes.
- Configure the applications that support Kerberos to only use Kerberos.
- Next, if you feeling randy, you can attempt to limit NTLM usage via Denying access to the NTLM Authentication group. See this post for more details: Link
- Or, you can do my favorite, and deploy IPSEC through-out your network (Domain Isolation): Link
Have Fun!
