- ciphertext
Encrypted data.
- client
An entity on the network (a user, a host, or an application)
that can get a ticket from Kerberos.
- credential cache or ticket file
A file which contains the keys for encrypting communications
between a user and various network services. Kerberos 5 supports a
framework for using other cache types, such as shared memory, but
files are more thoroughly supported.
- crypt hash
A one way hash used to authenticate users. While more secure
than plain text, it is fairly easy to decrypt for an experienced
cracker.
- GSS-API
The Generic Security Service Application Program Interface
[RFC-2743] is a set of functions which provide security services
which clients can use to authenticate to servers and which servers
can use to authenticate to clients without specific knowledge of
the underlying mechanism. If a network service (such as IMAP) uses
GSS-API, it can authenticate using Kerberos.
- key
Data used when encrypting or decrypting other data. Encrypted
data cannot be decrypted without the proper key or extremely good
guessing.
- Key Distribution Center (KDC)
A service that issues Kerberos tickets, usually run on the
same host as the Ticket Granting Server
- key table or keytab
A file that includes an unencrypted list of principals and
their keys. Servers retrieve the keys they need from keytab files
instead of using kinit. The default keytab file
is /etc/krb5.keytab. The KDC administration
server, /usr/kerberos/sbin/kadmind, is the only
service that uses any other file (it uses
/var/kerberos/krb5kdc/kadm5.keytab).
- kinit
The kinit command allows a principal who has
already logged in to obtain and cache the initial Ticket Granting
Ticket (TGT). For more on using the kinit
command, see its man page.
- principal
The principal is the unique name of a user or service that can
authenticates using Kerberos. A principal's name is in the form
root[/instance]@REALM. For a
typical user, the root is the same as their login ID. The
instance is optional. If the
principal has an instance, it is separated from the root with a
forward slash ("/"). An empty string ("") is considered a valid
instance (which differs from the default
NULL instance), but using it can
be confusing. All principals in a realm have their own key, which
for users is derived from a password or is randomly set for
services.
- realm
A network that uses Kerberos, composed of one or more servers
called KDCs and a potentially large number of clients.
- service
A program accessed over the network.
- ticket
A temporary set of electronic credentials that verify the
identity of a client for a particular service.
- Ticket Granting Service (TGS)
A server that issues tickets for a desired service which are
in turn given to users for access to the service. The TGS usually
runs on the same host as the KDC
- Ticket Granting Ticket (TGT)
A special ticket that allows the client to obtain additional
tickets without applying for them from the KDC.
- unencrypted password
A plain text, human-readable password.
