Lion Cipher Lab
Run your own Kerberos KDC and watch a ticket get issued (the other protocol under Active Directory)
- Identity & Access Management
- Intermediate
- ~60 min
- Free · no account required
Why it matters
Kerberos is the authentication protocol that logs in most of the corporate world, and almost nobody who uses it every day has ever seen it work. Every Windows domain login, every 'single sign-on' inside an enterprise network, every silent authentication to a file share is Kerberos, because Active Directory is a Kerberos KDC with a directory bolted to it. It also generates a whole family of famous attacks — Kerberoasting, AS-REP roasting, Golden Tickets — that stay permanently confusing if 'ticket', 'TGT' and 'krbtgt' are just words you have read. An hour spent building your own KDC fixes that…
What you'll learn
- explaining what Kerberos solves and why passwords stop crossing the network
- defining a realm, a principal, the KDC, the AS and the TGS in plain language
- installing and configuring an MIT Kerberos KDC on Ubuntu from scratch
- creating the KDC database, the stash file and the master key with kdb5_util
- creating user, admin and service principals with kadmin.local
- extracting a keytab with ktadd and handling it as a password-equivalent secret
- reading klist output line by line: TGT, service ticket, flags, lifetimes
- obtaining a service ticket with kvno and proving the TGS did its job
- controlling ticket lifetimes and renewal with kinit -l, -r and -R
- reading /var/log/krb5kdc.log and diagnosing preauth and clock-skew failures
Steps in this lab
- The problem: your password should not visit every server you use
- Build the throwaway machine, and get its name right before anything else
- Install the KDC packages and answer the setup questions
- Create the database, understand the master key, and start the services
- Create principals: an admin, a human, and a service — and extract a keytab
- The moment: kinit, then read klist one line at a time
- Make the TGS work: get a real service ticket with kvno
- Lifetimes and renewal: why a ticket is safer than a password
- Watch the KDC think: reading krb5kdc.log, and breaking it on purpose
- The bridge: this IS Active Directory, and here is its attack surface
- When Kerberos is the right answer — and when it absolutely is not
- Clean up, and know exactly what you left behind