------------------------------------------------------------------- SearchWin2000.com's Security Tip -------------------------------------------------------------------- TODAY'S SECURITY TIP: Kerberos and network access security ==================================================================== SPONSORED BY: NetIQ ==================================================================== SECURITY SECRETS REVEALED: FREE WEBCAST Get the step-by-step advice you need to secure your Enterprise during the June 12 "Secrets to Developing a Sound Security Plan" Webcast. Security experts from NetIQ, Trend Micro and Check Point will reveal the essentials of developing and implementing a successful security strategy to protect your corporate network infrastructure. Register now at http://webevents.road-show.com/netiq/6122001/start/register.asp?origin=sectps522 ==================================================================== "Kerberos and network access security" By William Boswell Windows 2000 now has Kerberos security, and this tip, excerpted from InformIT, will tell you the basics for understanding this technology. The material for this tip comes from the author's book, "Inside Windows 2000 Server." -------------------------------------------------------------------- Since its inception, classic NT has used a proprietary authentication scheme called NT LAN Manager (NTLM) Challenge-Response. With Windows 2000, Microsoft adopted a public domain authentication scheme called Kerberos. Kerberos was developed at MIT (Massachusetts Institute of Technology) as part of Project Athena. It takes its name from the mythological three-headed hound that guarded the gates of the underworld in Roman mythology. (If you're a humanities scholar making the transition to Information Technology, you may wonder why Project Athena picked a Roman mythic creature rather than the Greek counterpart, Cerberus. I can't help you. Computers and classics just don't mix.) Windows 2000 uses Version 5 of Kerberos as defined by RFC 1510, "The Kerberos Network Authentication Service V5." Many Kerberos implementations also use an API library described in RFC 1964, "The Kerberos Version 5 Generic Security Service Application Programming Interface (GSS-API) Mechanism." Windows 2000 does not use the GSS-API directly. Instead, it uses a similar set of function calls exposed by the Security Support Provider Interface (SSPI). Because the authentication mechanism is designed to be as transparent as possible, it isn't all that obvious that Kerberos is at work rather than the classic NTLM Challenge-Response. Windows 2000 uses Kerberos in the following circumstances: - Authenticating users logging on to Windows 2000 domain controllers - Authenticating users logging on to Windows 2000 servers and workstations that are members of a Windows 2000 domain - Authenticating users logging on to standalone Windows 2000 servers and workstations - Authenticating users accessing a Windows 2000 server or workstation from a Windows 9x client configured with the Active Directory add-on NTLM Challenge-Response authentication is used in the following instances: - Authenticating users logging on to Windows 2000 servers and workstations that are members of a classic NT domain (or accessing a classic NT domain from a Windows 2000 domain via a trust relationship) - Authenticating users accessing a Windows 2000 server or workstation from a classic NT server or workstation - Authenticating users accessing a Windows 2000 server from a standard Windows 9x or 3.1x client If you find yourself wondering how to verify this, you can enable auditing and examine the logged transactions, because a user logs on both at the console of a member workstation and the console of the server. -------------------------------------------------------------------- To learn more about Inside Windows 2000 Server, or to buy this book, go to http://www.digitalguru.com/dgstore/product.asp?isbn=1562059297&ac_id=73. To read all of this tip, click below to visit InformIT. You have to register there, but it's free. [http://www.informit.com/myinformit/login/index.asp?session_id={EF1F1EBB-3CEC-4085-919F-EEB6F86CE5D2}&t={6373D50E-EF0B-4084-B8A7-032653E262E2}&n={211F1130-8B67-45AE-8C82-2804428F41A0}] ==================================================================== ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ DID YOU LIKE THIS TIP? ==================================================================== Whether you loved it or hated it, why not let us know? E-mail us at mailto:[EMAIL PROTECTED] to sound off. ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ ==================================================================== LAST CHANCE TO WIN AN MP3 PLAYER! ==================================================================== This is the final week of our TIP CONTEST! Don't miss out on this final opportunity to win a Sony Vaio 64MB MP3 Player, valued at $300! As an added bonus, the winner will be the first person in our Tip Hall of Fame! Submit your tip now at http://searchwin2000.techtarget.com/tipsIndex/0,289482,sid1_tax5e3,00.html. (Categories include Administrator, Developer, Exchange, Migration and Security.) ==================================================================== ASK THE EXPERT ==================================================================== Not only is William Boswell the author of today's security tip, he's also on of searchWin2000's resident experts. Ask Bill your Administration and Performance related question today at http://searchwin2000.techtarget.com/ateAnswers/0,289620,sid1_tax285114,00.html. ==================================================================== however, questions that are of general interest have priority. If you no longer wish to receive this newsletter simply reply to this message with "REMOVE" in the subject line. Or, visit http://searchWin2000.techtarget.com/register and adjust your subscriptions accordingly. If you choose to unsubscribe using our automated processing, you must send the "REMOVE" request from the email account to which this newsletter was delivered. Please allow 24 hours for your "REMOVE" request to be processed.
