Contents
Where are Kerberos tickets stored?
ticket cache
Whenever you go to a service that uses Kerberos, you show that master ticket to the Kerberos server and get a ticket specifically for that service. Then, you show the ticket just for that service to the service to prove who you are. All of those tickets are stored on your local system in what is called a ticket cache.
How the tickets in Kerberos are encrypted?
The client and server do not initially share an encryption key. Whenever a client authenticates itself to a new verifier it relies on the authentication server to generate a new encryption key and distribute it securely to both parties.
Does YubiKey work with Active Directory?
If your user account is managed by Azure Active Directory (AAD), you can secure your computer with passwordless login with a YubiKey without needing to install any software.
How do I check my Kerberos lifetime ticket?
Navigate to Computer Configuration > Policies > Windows Settings > Security Settings > Account Policies > Kerberos Policy. If the value for “Maximum lifetime for user ticket” is 0 or greater than 10 hours, this is a finding.
Can I use YubiKey with Windows 10?
Yubico Login for Windows supports local authentication scenarios: it secures the local login process for local accounts on Windows computers. Use it to configure login with a YubiKey to a local account on an up-to-date system running Windows 8.1 or Windows 10.
Is it possible to move Kerberos tickets from Linux?
By passing these Kerberos Tickets from a Linux system, it is possible to move laterally from a compromised Linux system to the rest of the Active Directory domain. There are several ways to configure a Linux system to store Kerberos tickets. In this blog post, we will introduce Kerberos and cover some of the various storage solutions.
Can a YubiKey be used as a CA private key?
YubiHSM is symmetric only (AES…). Thus, if you used it for a CA private key, then it would have to be along these lines: the RSA private key would be stored encrypted, and the symmetric key stored in the YubiHSM.
Where do I go to register a spare YubiKey?
Registering a spare key is exactly the same process as registering your primary key. Please visit yubico.com/setup for information on how to register your YubiKeys. Once you identify the specific YubiKey you’d like to set up, select the services you want to register your YubiKey with and simply follow the instructions.
Where does the Kerberos key come from in Windows?
Windows creates a timestamp and encrypts the timestamp with the user’s Kerberos key (Note: User Kerberos keys vary based on encryption type. In the case of RC4 encryption, the user’s RC4 Kerberos key is directly derived from the user’s account password.