[Kerberos] User Ticket Management
Kerberos客户端常用命令包括 kinit, klist, kdestroy, and kpasswd,用户使用这些命令管理自己的 ticket。
此外,每台运行Kerberos的机器应该都配置/etc/krb5.conf,At a minimum, it should define a default_realm setting in [libdefaults]. If you are not using DNS SRV records, it must also contain a [realms] section containing information for your realm’s KDCs.
Ticket 管理
Kerberos Ticket的若干属性:
- forwardable 简单来讲,KDC可以基于该类型TGT发放新的TGT,即使 network address不同。这样不需要再次输入密码。
- proxiable 类似于forwardable,但是不同的是只允许service继承client的认证
- proxy
- postdated
- Renewable 用户不需要重新输入密码就可以获得新的 session key. 但是这种TGT有过期时间。
- invalid
- hardware authentication 申请使用硬件的Ticket认证
- okay as delegate ticket指定的服务器可以用作delegate determined by the policy of that realm
- anonymous ticket is one in which the named principal is a generic principal for that realm; it does not actually specify the individual that will be using the ticket. This ticket is meant only to securely distribute a session key.
用 kinit 获得Ticket
如果你的登录系统集成了Kerberos v5,那么登录时自动获得kerberos ticket. 否则,必须显示获取,比如用 kinit。类似,如果 ticket过期了,kinit可以申请新的ticket.
By default, kinit假设你想要默认realm里与自己名字相同的principal的ticket。
shell% kinit
Password for jennifer@ATHENA.MIT.EDU: <-- [Type jennifer's password here.]
shell%
如果想要申请 forwardable ticket,可以
shell% kinit -f
Password for jennifer@ATHENA.MIT.EDU: <-- [Type your password here.]
shell%
shell% kinit -f -l 3h david@EXAMPLE.COM
Password for david@EXAMPLE.COM: <-- [Type david's password here.]
shell%
用 klist 查看 ticket
当你第一次获得 ticket, 那么只能是TGT,看起来如下:
shell% klist
Ticket cache: /tmp/krb5cc_ttypa
Default principal: jennifer@ATHENA.MIT.EDU Valid starting Expires Service principal
// :: // :: krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
shell%
如果连接到其他机器上,比如:daffodil.mit.edu,但是在同一个realm,klist会得到
shell% klist
Ticket cache: /tmp/krb5cc_ttypa
Default principal: jennifer@ATHENA.MIT.EDU Valid starting Expires Service principal
// :: // :: krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
// :: // :: host/daffodil.mit.edu@ATHENA.MIT.EDU
shell%
当jennifer用ssh程序登陆主机daffodil.mit.edu,ssh程序将jennifer的TGT给KDC,并请求主机ticket,这样jennifer不用再输入密码。
klist有各种flag,具体可以通过 man klist 查看。
用 kdestory 销毁ticket.
由于ticket可能被偷走,这样离开机器的时候可以顺便销毁ticket.
shell% kdestroy
shell%
其他客户端命令
- kdestroy: kdestroy utility destroys the user’s active Kerberos authorization tickets by overwriting and deleting the credentials cache that contains them
- kinit: kinit obtains and caches an initial ticket-granting ticket(TGT) for principal
- klist: klist lists the Kerberos principal and Kerberos tickets held in a credentials cache, or the keys held in a keytab file.
- kpasswd: kpasswd command is used to change a Kerberos principal’s password
- krb5-config
- ksu
- kswitch
- kvno
- sclient
[Kerberos] User Ticket Management的更多相关文章
- FIM 2010: Kerberos Authentication Setup
The goal of this article is to provide some background information regarding the Kerberos related co ...
- KERBEROS PROTOCOL TUTORIAL
KERBEROS PROTOCOL TUTORIAL This tutorial was written by Fulvio Ricciardi and is reprinted here wit ...
- Magic Quadrant for Security Information and Event Management
https://www.gartner.com/doc/reprints?id=1-4LC8PAW&ct=171130&st=sb Summary Security and risk ...
- Kerberos主从配置文档
Kerberos主从配置文档 1. Kerberos主从同步机制 在Master上通过以下命令同步数据: kdb5_util dump /var/kerberos/krb5kdc/slave_db ...
- kafka Enabling Kerberos Authentication
CDK 2.0 and higher Powered By Apache Kafka supports Kerberos authentication, but it is supported onl ...
- 票据传递攻击(Pass the Ticket,PtT)
目录 黄金票据 生成票据并导入 查看票据 验证是否成功 黄金票据和白银票据的不同 票据传递攻击(PtT)是一种使用Kerberos票据代替明文密码或NTLM哈希的方法.PtT最常见的用途可能是使用黄金 ...
- httpcomponents-client-4.4.x
Chapter 1. Fundamentals Prev Next Chapter 1. Fundamentals 1.1. Request execution The most essent ...
- httpcomponents-client-ga(4.5)
http://hc.apache.org/httpcomponents-client-ga/tutorial/html/ Chapter 1. Fundamentals Prev Next ...
- httpcomponents-client-4.3.x DOC
Chapter 1. Fundamentals Prev Next Chapter 1. Fundamentals 1.1. Request execution The most essent ...
随机推荐
- 使用好压(HaoZip)软件打包EverEdit制作安装程序
最近使用EverEdit,使用原始的安装程序安装后,需要重新安装插件,对配置文件进行了修改,定制了工具栏.将安装后的程序目录进行打包,制作新的安装包,便于携带. 以下为打包制作过程: 打包原料:Eve ...
- 【WPF系列】Textbox
Style定义实例 给Textbox定义一个阴影效果. <Style x:Key="{x:Type TextBox}" TargetType="{x:Type Te ...
- 第9章 Java类的三大特性之一:继承
1.什么是继承 子类继承父类就是对父类的扩展,继承时会自动拥有父类所拥有的处private之外的所有成员作用:增加代码复用语法格式: class 子类名 extends 父类名{…………}第9章 Ja ...
- no-proxy 和proxy 的区别
Child <- many-to-one ->Parent class Child { private Parent paren ...
- 2016中国·西安“华山杯”WriteUp- SeeSea
题目打包下载:https://yunpan.cn/ckyrKxHJDPAIN (提取码:bbaf) Web 1.签到(10) 扫码回复 hs_ctf拿flag, 套路题. flag_Xd{hSh_ct ...
- ConcurrentHashMap和HashMap的一点区别
HashMap不是线程安全的,ConcurrentHashMap则在某一个方法的执行上是线程安全的. package testMap; import java.util.HashMap; public ...
- 从数据库导出到excel
在项目 扬中 News shenbaocreateall //选中的id string cc = Request["IDcheck"]; Response.C ...
- protobuf简介
#1,简介 把某种数据结构的信息,以某种格式保存起来: 主要用于数据存储,传输协议格式. #2,优点 性能好 反观XML的缺点:解析的开销惊人,不适用于事件性能敏感的场合:为了有较好的可读性,引入一些 ...
- 让游戏以高性能GPU(独立显卡)运行
在EXE中导出全局变量: N卡: extern "C" { __declspec(dllexport) DWORD NvOptimusEnablement = 0x00000001 ...
- requests 模块
发送请求 使用Requests发送网络请求非常简单. 一开始要导入Requests模块: >>> import requests 然后,尝试获取某个网页.本例子中,我们来获取Gith ...