What is Kerberos?

Kerberos is a network authentication protocol that uses secret-key cryptography and time-stamped tickets to verify the identity of users and services without ever sending passwords across the network. A trusted key distribution center issues encrypted tickets so clients and servers can authenticate each other quickly and repeatedly.

Key takeaways

• Kerberos authenticates users and services without sending passwords over the wire.
• A key distribution center (KDC) issues encrypted, time-stamped tickets on request.
• A ticket-granting ticket (TGT) lets a client request service tickets on demand.
• Versa considers Kerberos authentication stronger than LDAP for user identification.
• VOS devices use Kerberos identities to match users in firewall and SD-WAN policy.

On this page: Why it matters · How it works · Types · Kerberos & Versa · FAQ

Why is Kerberos important?

Passwords sent across a network, even encrypted ones, are a standing risk: capture the exchange and an attacker can often replay or crack it offline. Kerberos removes that risk by design – the password never travels. Instead, a trusted third party vouches for identity with short-lived, cryptographically signed tickets, so a compromised link cannot expose long-term credentials.

That design has made Kerberos the default authentication protocol for enterprise networks for three decades. Microsoft Active Directory uses it natively for domain logons, and any device that needs to identify Active Directory users – file servers, proxies, firewalls – typically supports it. Because tickets are time-stamped and short-lived, a stolen ticket has a narrow window of usefulness, and because the KDC is centralized, revoking or auditing access does not require touching every server that trusts it.

What is Kerberos?

Kerberos works through a trusted intermediary: the key distribution center (KDC), which combines an authentication server (AS) and a ticket-granting service (TGS). A client first authenticates to the AS and receives a ticket-granting ticket (TGT) – a timestamped credential encrypted with the TGS’s secret key. The client does not need to present a password again; it presents the TGT to the TGS to request a service ticket for the specific service it wants to reach.

The client then sends that service ticket, along with its request, directly to the target service. The service decrypts the ticket with a key it shares with the KDC (often distributed in advance as a keytab file) and trusts the identity inside it. Because every step relies on secret-key cryptography and short validity windows, credentials are never exposed on the wire and stolen tickets expire quickly.

Types of Kerberos

Kerberos version 5 is the current standard, defined in RFC 4120, and the version essentially all modern implementations – including Active Directory and Versa’s VOS – use; the older version 4 is obsolete. Within v5 deployments, two ticket types do the work: the TGT, obtained once per session and used only to talk to the TGS, and service tickets, requested per target service and presented directly to it.

Deployments also differ by how the client authenticates. Keytab-based authentication lets a device or service authenticate without an interactive password prompt, using a pre-shared keytab file – the pattern VOS devices use to represent themselves to a KDC. Browser-based SSO, negotiated automatically over HTTP via SPNEGO/Negotiate, lets a domain user’s browser obtain a service ticket transparently once they are logged into their workstation, which is how Kerberos-authenticated web/proxy access typically works.

Kerberos & Versa

VOS devices support Kerberos as a strong, credential-safe alternative to LDAP for identifying users and groups in CoS (QoS), NGFW, SD-WAN, and UTM policy rules. Setup follows a defined sequence: generate a keytab file on the Active Directory server, upload it to the Director node and appliance, define a Kerberos profile referencing that keytab and an SPN, and wrap it in an authentication profile and rule. From Releases 22.1.3 onward, NGFW accepts Kerberos alongside certificate, LDAP, local-profile, RADIUS, and SAML authentication for the same user-and-group policy engine – see Configure Kerberos Authentication and its NGFW-specific counterpart.

Because Kerberos needs decrypted traffic to redirect a session and collect a token, VOS pairs it with a decryption profile in transparent or explicit full-proxy mode, a captive portal bound to a Kerberos virtual URL, and matching browser settings (Internet Explorer, Chrome, or Firefox). Administrators can then monitor live authenticated sessions and authentication event logs directly from Director and Analytics.

Frequently asked questions

What is a Kerberos ticket-granting ticket (TGT)?

A TGT is a timestamped credential the key distribution center issues after a client’s first authentication. It proves identity to the ticket-granting service without requiring the password again, and the client uses it to request service tickets for whatever it needs to reach next.

How does Kerberos differ from LDAP authentication?

LDAP authentication typically validates credentials directly against a directory each time a user connects, while Kerberos never transmits the password at all – it exchanges encrypted, time-stamped tickets instead. Versa documentation describes Kerberos as the stronger authentication method of the two for exactly this reason.

What is a Kerberos keytab file?

A keytab file stores pairs of Kerberos principals and their encrypted keys, derived from a service account’s password. It lets a device, such as a VOS appliance, authenticate to a KDC without an interactive password prompt, and must be regenerated if that password changes.

Why does Kerberos need a key distribution center (KDC)?

The KDC is the trusted third party every client and service relies on. It combines an authentication server, which issues the initial TGT, and a ticket-granting service, which issues per-service tickets – centralizing trust so no two parties need to share secrets directly.

How does Versa use Kerberos for firewall policy?

VOS devices use Kerberos-authenticated identities to match specific users or groups in CoS, NGFW, SD-WAN, and UTM policy rules. Because the device does not load a full user database into memory, it defines external users drawn from Kerberos, LDAP, SAML, or TACACS+ for policy matching.

More on Kerberos

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about Kerberos, these are worth looking at next.