TCP/IP Tutorial and Technical Overview - IBM Redbooks

usiness partner's and supplier's VPN solutions. Perhaps equally critical is the
ability to work with a vendor that understands the issues of deploying a VPN. The
implementation of a successful VPN involves more than technology. The
vendor's networking experience plays heavily into this equation.
22.11 Kerberos authentication and authorization system
The Kerberos Network Authentication Service Version 5 is a proposed standard
protocol. Its status is elective and described in RFC 1510.
According to The Enlarged Devil's Dictionary, by Ambrose Bierce, Kerberos is
“the watchdog of Hades, whose duty it was to guard the entrance against whom
or what does not clearly appear; Kerberos is known to have had three heads.”
A Kerberos service is normally run on its own system in a secure area. Users
have to validate themselves to Kerberos before they are allowed to connect to
other servers in the network. The server’s identities can also be checked against
Kerberos.
The Kerberos Authentication and Authorization System is an encryption-based
security system that provides mutual authentication between the users and the
servers in a network environment. The assumed goals for this system are:
► Authentication to prevent fraudulent requests/responses between users and
servers that must be confidential and between groups of at least one user and
one service.
► Authorization can be implemented independently from the authentication by
each service that wants to provide its own authorization system. The
authorization system can assume that the authentication of a user/client is
reliable.
► Permits the implementation of an accounting system that is integrated,
secure, and reliable, with modular attachment and support for “chargebacks”
or billing purposes.
The Kerberos system is mainly used for authentication purposes, but it also
provides the flexibility to add authorization information.
864 TCP/IP Tutorial and Technical Overview