Kerberos

   A network security system developed as a part of Project Athena at MIT. Kerberos is used to authenticate a user who is asking for permission to use a particular network service.

   Kerberos can be used to control the initial connection to a server or to authenticate every single request between a client and the server. It grants tickets to a client to allow the use of a specific service and is secure even on a nonsecure network.

   Kerberos takes the following precautions:

   • Passwords are never sent over the network unencrypted, making it impossible for network snoopers to capture passwords. AllKerberosmessagesaretimestampedso that they cannot be captured and then replayed at a later time; Kerberos does not accept old messages.

   • When you request access to a service, to access a file server, for example, Kerberos gives you a "ticket" that is valid for access to the file server but not valid for any other service. When you try to connect to the server, you send your ticket with the request. Once the server knows who you are, the server decides whether to grant youaccess.Ticketsalsoexpire,andifyour session lasts longer than the predefined limit, you will have to reauthenticate yourself to Kerberos to get a new ticket.

   Kerberos is named after the three-headed dog Cerberus, who guards the gates of the underworld in Greek mythology.

   See also authentication; certificate; digital signature.