Kerberos

Published on: July 25, 2026

Most important commands to remember

kinit — obtain initial credentials from the realm.
klist — inspect cached tickets and their validity periods.
kvno — request a ticket for a specific service principal.

Commands and flags

Command or syntax	Meaning
`mktemp -d` / `kerberos_lab=$(…)`	Create a private temporary directory / save its path.
`-c "FILE:$kerberos_lab/ccache"`	Select this exercise’s separate file credential cache.
`kinit student@LAB.EXAMPLE`	Request initial credentials; enter the password at its prompt.
`klist`	Show the client principal and cached service tickets.
`kvno HTTP/web.lab.example@LAB.EXAMPLE`	Obtain a ticket and report its service key version number.
`kdestroy` / `rmdir`	Destroy the selected cache / remove its empty directory.

Quotes preserve the cache path. The principal names are provisioned lab identities, not names automatically created by these commands.

The concepts that matter

1. A realm coordinates trust

Kerberos authenticates principals through a trusted Key Distribution Center, or KDC. A realm is an administrative authentication domain containing user and service principals.

A principal names an identity, such as a user or an HTTP service on a particular host. The service shares long-term key material with the realm so it can process tickets issued for it. A Kerberos realm name may resemble a DNS domain, but the two are different concepts.

2. A TGT avoids repeatedly presenting the password

Initial authentication obtains a ticket-granting ticket, or TGT, and associated client credentials. The client can use these to request tickets for services without submitting the user’s password to each service.

Tickets have validity periods and live in a credential cache. That cache is sensitive: possessing usable credentials may let someone act as the principal. Avoid treating a cached login as harmless diagnostic data.

3. A service ticket targets one service

The client requests a service ticket for a specific principal and presents it as part of authentication to that service. Session keys and fresh authenticators help prove possession; the protocol is more than sending a reusable username string.

Obtaining a ticket proves that the KDC issued it, not that the service accepted it or granted application access. A web application still applies its own authorization rules after authentication.

4. Names, keys, and clocks must agree

A service principal mismatch can break authentication even when the hostname resolves and the server is reachable. Services also need the correct key material, commonly stored in a keytab, to accept their tickets.

Time matters because validity windows and replay protections depend on clocks within allowed skew. Diagnose ticket lifetime, service naming, and key configuration separately from network connectivity. A password reset or cache deletion is not a universal repair for these distinct failures.

One small example

Optional: run in the stated preconfigured test realm, replacing the lab names only with your assigned test principals. Run lines individually after directory creation succeeds. The separate cache keeps the exercise away from your normal login cache.

kerberos_lab=$(mktemp -d)
kinit -c "FILE:$kerberos_lab/ccache" student@LAB.EXAMPLE
klist -c "FILE:$kerberos_lab/ccache"
kvno -c "FILE:$kerberos_lab/ccache" HTTP/web.lab.example@LAB.EXAMPLE
klist -c "FILE:$kerberos_lab/ccache"
kdestroy -c "FILE:$kerberos_lab/ccache"
rmdir "$kerberos_lab"

After kinit, look for a TGT whose service name begins with krbtgt. After kvno, compare the second listing for the requested HTTP service and its start/expiry times. The reported key version is not a software version or a success response from the web application.

If authentication fails, stop interpreting later commands as successful and still clean up any created cache. kdestroy removes only the selected local credentials; it does not revoke copied tickets globally. The final line removes the empty temporary directory.

Keep this idea: Kerberos turns realm authentication into time-limited tickets for named services; ticket issuance and application permission remain separate.