2.8 Definitions
Following are definitions of some of the Kerberos terminology.
- client
- an entity that can obtain a ticket. This entity is usually either a
user or a host.
- host
- a computer that can be accessed over a network.
- Kerberos
- in Greek mythology, the three-headed dog that guards the entrance to the
underworld. In the computing world, Kerberos is a network security
package that was developed at MIT.
- KDC
- Key Distribution Center. A machine that issues Kerberos tickets.
- keytab
- a key table file containing one or more keys. A host or service
uses a keytab file in much the same way as a user uses his/her
password.
- principal
- a string that names a specific entity to which a set of credentials may
be assigned. It can have an arbitrary number of components, but
generally has three:
- primary
- the first part of a Kerberos principal. In the case of a user, it
is the username. In the case of a service, it is the name of the
service.
- instance
- the second part of a Kerberos principal. It gives information that
qualifies the primary. The instance may be null. In the case of a
user, the instance is often used to describe the intended use of the
corresponding credentials. In the case of a host, the instance is the
fully qualified hostname.
- realm
- the logical network served by a single Kerberos database and a set of
Key Distribution Centers. By convention, realm names are generally all
uppercase letters, to differentiate the realm from the internet domain.
The typical format of a typical Kerberos principal is
primary/instance@REALM.
- service
- any program or computer you access over a network. Examples of services
include “host” (a host, e.g., when you use
telnet and
rsh), “ftp” (FTP), “krbtgt” (authentication;
cf. ticket-granting ticket), and “pop” (email).
- ticket
- a temporary set of electronic credentials that verify the identity of a
client for a particular service.
- TGT
- Ticket-Granting Ticket. A special Kerberos ticket that permits the
client to obtain additional Kerberos tickets within the same Kerberos
realm.