Kerberos Underworld Ondrej Sevecek | MCM: Directory | MVP: Security |

AN INTRODUCTION Kerberos Underworld

The topics The hell of windows authentication mechanisms Basic, NTLM, Kerberos Certificates and smart cards or tokens How they work differently What is better or worse Weird and weirder things that you may not know

And the environment Windows 2000 and newer Active Directory domains Maybe some trusts or multidomain forests Connections to SMB, LDAP, Exchange, SQL, HTTP, WMI, remote administration, RDP and other servers

NETWORK INTERACTIONS Kerberos Underworld

Local Logon DC Client Kerberos LDAP SMB TGT: User GPO List GPO Download TGS: LDAP, CIFS

CTRL-ALT-DEL Password Password is stored in memory only LSASS process In the form of MD4 hash never given out

Authentication Interactions in General DC Client Kerberos Server App Traffic DC SMB D/COM TGT: User In-band TGS: Server NTLM Occasional PAC Validation TGS: Server D/COM Dynamic TCP NTLM Pass-through

The three authentication methods Basic plain-text password results in Kerberos authentication NTLM hashed password (MD4) method from the past LM (DES), NTLM (DES), NTLMv2 (MD5) Kerberos hashed password (MD4) plus RC4/DES or AES mutual authentication and delegation can use certificates instead of passwords

Basic and RDP Network Logon DC Client Server App Traffic DC In-band clear text Kerberos TGT: User

NTLM Network Logon DC Client Server App Traffic DC SMB D/COM In-band NTLM hash Pass-through NTLM hash D/COM Dynamic TCP

Kerberos Network Logon (basic principle) DC Client Kerberos Server App Traffic TGT: User In-band TGS: Server

Kerberos Network Logon (complete) DC Client Kerberos Server App Traffic DC SMB D/COM TGT: User In-band TGS: Server Occasional PAC Validation TGS: Server D/COM Dynamic TCP

PERFORMANCE COMPARISON Kerberos Underworld

NTLM Network Logon DC Client Server DC % CPU 55 % CPU

Kerberos Network Logon, no PAC Validation DC Client Server DC % CPU 0 % CPU

Kerberos Network Logon with PAC Validation DC Client Server DC % CPU 0 % CPU14 % CPU

Basic Authentication DC Client Server DC % CPU 0 % CPU

NTLM Performance Issues DC ClientServer 7 concurrent Client 40 sec.

NTLM Trusts DC B D\UserA\Server DC A DC CDC D

Kerberos Trusts DC B D\UserA\Server DC A DC CDC D

WE WANT KERBEROS, SO WHAT? Kerberos Underworld

Basic Facts Do not use IP addresses Configure SPN (service principal name) Have time in sync Use trusted identities to run services on Windows 2008 and newer instead of AD user accounts no PAC validation Enable AES with Windows 2008 DFL

Trusted Identities – Network Service

Trusted Identities – Service Accounts

Trusted Identities – AppPoolIdentity

Trusted Identities – Managed Service Account

IDENTITY ISOLATION FOR SERVICES Kerberos Underworld

Identity Isolation Services on a single machine Services that access other back-end services

Windows Identities IdentityPasswordPAC Validation Local Isolation Network Isolation Operating System SYSTEMrandom changed 30 days noAdministrators no isolation no2000 AD User Accountadministrator changed??? yesUsers isolated yes2000 Network Servicerandom changed 30 days noUsers no isolation noXP Local Serviceno network credentials noUsers no isolation noXP Service Accountrandom changed 30 days noUsers isolated noVista 2008 Managed Service Account random changed 30 days noUsers isolated yes R2

SMART CARD LOGON Kerberos Underworld

Smart Card Logon DC Client Kerberos PKINIT Server App Traffic DC TGT: User TGS: Server

Smart Card Logon and NTLM DC Client Server NTLM Hash DC TGT: User TGS: Server NTLM Hash

Smart Card Logon and NTLM DC Client Server NTLM Hash DC TGT: User TGS: Server NTLM Hash

DELEGATION Kerberos Underworld

Basic Delegation Client Front-End Server Back-End Server DC Password TGS: Back-End TGT: User

Kerberos Delegation Options

Kerberos Delegation (Simplified) DC Client TGT: User TGS: Front-End Front-End Server Back-End Server DC TGS: Front-End TGS: Back-End

Protocol Transition Client Front-End Server Back-End Server DC TGS: Back-End Nothing Kamil

GROUP MEMBERSHIP Kerberos Underworld

Group Membership Limits AD Group in forest with 2000 FFL 5000 direct members limit AD Group in forest with FFL unlimited membership Kerberos Ticket network transport limited to 8 kB on 2000 and XP up to 12 kB on HTTP.SYS header limits 16 kB of Base-64 encoded tickets Access Token local representation of a logon up to 1025 groups including local and system

Kerberos Ticket (PAC) KamilS-1-5-Prague-1158 Prague MarketingGlobal30828 Bytes Prague SalesGlobal30838 Bytes Paris VisitorsDomain Local Paris S-1-5-Paris Bytes Roma ISDomain Local Roma S-1-5-Roma Bytes Prague DocumentsDomain Local IDTT S-1-5-Prague Bytes Business OwnersUniversal IDTT Bytes EmployeesUniversal Paris S-1-5-Paris Bytes

TAKEAWAY Kerberos Underworld

Takeaway Kerberos is most secure, flexible and performance efficient Don’t be afraid and play with them! Ondrej Sevecek | MCM: Directory | MVP: Security |

Don’t forget to submit your feedback and win a great Nokia smartphone and Kindle e-reader!