Cybersecurity glossary
What is Kerberos?
Learn what Kerberos is, how ticket-granting tickets enable enterprise SSO, common attacks like Kerberoasting, and hardening practices for Active Directory Kerberos environments.
Definition
Kerberos is a network authentication protocol that uses time-limited, encrypted tickets issued by a trusted Key Distribution Center (KDC) so clients can prove identity to services without repeatedly sending passwords over the network.
Why Kerberos became enterprise SSO
On a corporate network, endlessly prompting for passwords is unusable and unsafe. Kerberos lets a trusted Key Distribution Center issue time-bound tickets so users authenticate once and access many services without sending the password to each host.
It remains foundational in Active Directory—and a favorite target when service accounts are weak.
Core Kerberos exchange
Authentication Service (AS) exchange
The client proves knowledge of the user secret to the KDC and receives a TGT.
TGT cached locally
The ticket-granting ticket enables SSO for its lifetime without re-entering the password.
TGS request for a service
The client asks the KDC for a service ticket for a specific Service Principal Name.
Service ticket presented
The application server validates the ticket and establishes an authenticated session.
Tickets expire
Lifetimes and renewals bound risk; stolen tickets eventually become useless.
Important Kerberos concepts
KDC
Trusted authority (often domain controllers) that issues tickets.
SPN
Service Principal Name identifying a service instance in the realm.
Session keys
Per-ticket keys protect authenticator messages between parties.
Realm
Administrative Kerberos domain, commonly aligned to AD domain names.
Delegation
Allows a service to act on behalf of a user—powerful and dangerous if broad.
PAC / authorization data
May carry group membership used for Windows access decisions.
Common attacks and defenses
| Attack pattern | Idea | Defense focus |
|---|---|---|
| Kerberoasting | Crack service account passwords offline from tickets | gMSA / long secrets, AES, monitor unusual TGS |
| AS-REP roasting | Target accounts without pre-authentication | Require pre-auth; fix weak accounts |
| Pass-the-ticket | Reuse stolen TGTs/service tickets | Credential Guard, short lifetimes, detection |
| Unconstrained delegation abuse | Impersonate users via overly trusting services | Remove unconstrained delegation; use resource-based |
Hardening checklist
- Use group Managed Service Accounts or equivalent long random secrets for SPNs.
- Disable weak encryption types; prefer AES.
- Tier administrative accounts; avoid daily work on domain-admin identities.
- Review delegation settings and remove unconstrained delegation.
- Keep tight time synchronization across clients and domain controllers.
- Monitor anomalous service-ticket requests and privilege group changes.
- Protect domain controllers as Tier 0 assets with strong physical and network controls.
- Add MFA at remote access edges; consider smart-card/PKINIT for privileged users.
The practical takeaway
Kerberos provides ticket-based enterprise authentication and SSO through a trusted KDC. It keeps passwords off the wire to every service—but ticket theft and weak service accounts remain serious risks.
Harden service identities, encryption, delegation, and monitoring so Kerberos tickets stay a convenience for users rather than a shortcut for attackers.
Related security terms
Single Sign-On (SSO)
Broader SSO concept; Kerberos is a classic enterprise SSO protocol.
LDAP
Directory protocol often paired with Kerberos in enterprise identity stacks.
Authentication
General identity verification category Kerberos implements for networks.
Privileged Access Management (PAM)
Controls that limit damage from stolen Kerberos credentials.
Least Privilege
Reduces impact of service account ticket attacks.
Frequently asked questions
What is Kerberos in simple terms?
Kerberos is a ticket system for enterprise networks. You prove your password once to a central server and receive tickets that let you access file shares, email, and other services without retyping credentials constantly.
What are TGT and TGS?
A Ticket-Granting Ticket (TGT) proves you authenticated to the KDC. A Ticket-Granting Service (TGS) exchange uses the TGT to obtain service tickets for specific applications.
Where is Kerberos still used?
Widely in Microsoft Active Directory domains, many Unix estates, and some HPC or legacy application environments.
What is Kerberoasting?
An attack that requests service tickets for accounts with Service Principal Names and offline-cracks weak service account passwords from those tickets.
Why does Kerberos care about time sync?
Tickets include timestamps and lifetimes. Clock skew between clients and KDCs causes authentication failures or expands replay windows if misconfigured.
Is Kerberos phishing-resistant MFA?
Classic password-derived Kerberos is not. Organizations often add MFA at VPN/IdP edges or use PKINIT/smart cards for stronger Kerberos authentication.
How do you harden Kerberos?
Long random service account passwords or gMSA, AES encryption types, protected users / credential guard where applicable, tiered admin models, and monitoring for anomalous ticket requests.
References
Explore authoritative guidance and frameworks related to kerberos.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.