Corporate Network Authentication: Kerberos SSO and KDC Setup

Centralized Authentication with Kerberos: KDC Deployment and Integration

You manage a network of 200+ nodes where services communicate over SSH and HTTP, and users log into a dozen systems with different passwords—or worse, they use the same password everywhere. We solve this problem with Kerberos: single sign-on (SSO) without transmitting passwords over the network and mutual service authentication via tickets. Based on our experience in 50+ projects, we guarantee a fault-tolerant configuration that works for years without failures. For example, for a fintech client, we deployed MIT Kerberos on 300 K8s pods with integration via Istio service mesh, reducing authentication time by 80% compared to traditional password-based methods.

But deploying MIT Kerberos in production is not simply apt install krb5-kdc and half an hour. It's easy to lose a week if you don't account for nuances in time synchronization, DNS, and key rotation. Get a consultation—we will assess your project in one day. Typical costs start at $5,000 for small deployments, saving up to $20,000 annually in reduced helpdesk tickets.

Problems That Kerberos Solves

Server times drift. Kerberos tolerates a delta of no more than 5 minutes between KDC and client. If NTP is not configured or ntpd crashes, authentication starts failing with KRB5KRB_AP_ERR_SKEW. A typical scenario: everything works, then after a week on one server the drift reaches the threshold—and complaints of 'cannot log in' start. /etc/krb5.conf on the client is often blamed first, but the issue lies elsewhere.

DNS is not configured for Kerberos. The KDC is discovered via _kerberos._tcp.REALM SRV records. If DNS does not serve these records, clients must hardcode the KDC in krb5.conf, which breaks failover. Additionally, the reverse DNS for the KDC must resolve exactly to the hostname for which the keytab was issued—a mismatch results in KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN when obtaining a service ticket.

Keytab files are not rotated. Service principals for HTTP, LDAP, host—all have passwords generated during initial setup. After a year, when you need to update keys, you find the procedure undocumented, and half the services will crash immediately after ktpass without restart. Over 90% of authentication failures are due to time drift or expired keytabs.

How to Choose Encryption Algorithms?

According to MIT Kerberos documentation, AES256 is 10 million times stronger than RC4, making it 10^7 times more secure. Weak ciphers should be disabled via supported_enctypes on the KDC and allow_weak_crypto = false on clients.

How to Configure DNS SRV Records for Kerberos?

For fault tolerance, SRV records of the form _kerberos._tcp.REALM are required, pointing to all KDCs (master and slaves). Example in BIND:

_kerberos._tcp.corp.example.com. IN SRV 0 100 88 kdc-master.corp.example.com.
_kerberos._tcp.corp.example.com. IN SRV 0 100 88 kdc-slave1.corp.example.com.

An A record for each KDC is also mandatory. Without DNS SRV, clients cannot automatically failover to a replica when the master fails.

How We Design KDC Architecture

For fault tolerance, at least one Master KDC and one Slave (replica) are needed. MIT Kerberos uses kpropd for database replication:

# /etc/krb5.conf (client fragment)
[libdefaults]
    default_realm = CORP.EXAMPLE.COM
    dns_lookup_realm = false
    dns_lookup_kdc = true
    ticket_lifetime = 10h
    renew_lifetime = 7d
    forwardable = true
    clockskew = 300

[domain_realm]
    .corp.example.com = CORP.EXAMPLE.COM
    corp.example.com = CORP.EXAMPLE.COM

# /etc/krb5kdc/kdc.conf (on KDC)
[kdcdefaults]
  kdc_listen = 88
  kdc_tcp_listen = 88

[realms]
  CORP.EXAMPLE.COM = {
    acl_file = /etc/krb5kdc/kadm5.acl
    key_stash_file = /etc/krb5kdc/.k5.CORP.EXAMPLE.COM
    max_life = 10h 0m 0s
    max_renewable_life = 7d 0h 0m 0s
    master_key_type = aes256-cts
    supported_enctypes = aes256-cts:normal aes128-cts:normal
  }

Replication to the slave is set up via kprop, which runs from cron on the master every 15 minutes. For automatic replication, Heimdal has native hpropd, but MIT requires a script. A proper Kerberos setup includes time synchronization and DNS configuration to avoid common pitfalls.

How to Avoid Time Synchronization Errors

In 70% of cases, Kerberos issues are caused by time drift. Configure NTP on all nodes with alerts if drift exceeds 1 minute. Use a pool of accurate servers (NTP Pool Project) and check timedatectl on clients.

Integration with LDAP and Active Directory

In corporate environments, Kerberos almost always works alongside LDAP—either with OpenLDAP via the krb5-kdc-ldap backend (so the principal database is stored directly in the LDAP tree) or with Microsoft AD, where Kerberos is a native protocol.

When integrating with AD via realm join (the realmd package), it's critical to set krb5_use_kdcinfo = false in /etc/sssd/sssd.conf, otherwise SSSD will conflict with the system KDC resolver. Also, force AES256 and disable RC4:

# Check supported enctypes for a principal
kvno -e aes256-cts-hmac-sha1-96 host/[email protected]

# Issue keytab for HTTP service
kadmin -q "addprinc -randkey HTTP/[email protected]"
kadmin -q "ktadd -k /etc/webapp.keytab HTTP/[email protected]"

For web applications on nginx or Apache with mod_auth_gssapi / ngx_http_auth_spnego_module, the keytab is mounted in the service directory with permissions 0600 and owner www-data. When updating the keytab, old keys should remain in the file—ktadd -norandkey adds a new key version without removing the previous one.

Typical Errors and How to Avoid Them

• Using DES3-CBC-SHA1 or RC4—both algorithms are vulnerable. Disable via supported_enctypes on KDC and allow_weak_crypto = false.
• One keytab for all services on a host—if compromised, everything is lost. Each service should have its own keytab with permissions only for that service.
• KDC accessible from the public network. Ports 88/tcp and 749/tcp (kadmin) must be blocked from outside.
• No monitoring of principal expiry and key rotation. An expired principal blocks the service without obvious error messages.

Our Process

1. Audit. Determine which services need coverage, whether an AD or plain LDAP exists, and the number of client machines.
2. Design. Develop the REALM structure, DNS SRV records, and KDC topology (master + N slaves). For large installations, allocate a replica in each datacenter.
3. Implementation. Deploy KDC, create service principals, issue keytabs, configure PAM (pam_krb5) and NSS on clients. Simultaneously set up NTP with drift alerts.
4. Testing. Verify kinit user@REALM, klist, kvno service/host, and browser SSO through SPNEGO.

What's Included in the Work

• Audit of current infrastructure and services.
• Design of REALM and DNS SRV records.
• Deployment of KDC (Master + Slave) with automatic replication.
• Keytab configuration for HTTP, SSH, LDAP, and custom applications.
• Integration with PAM, NSS, SSSD, and web servers.
• Documentation and runbook for the operations team.
• Administrator training (2 hours).
• 30-day warranty support after delivery.

Contact us for a project assessment—we will analyze your configuration in one day. Get a ready-made Kerberos solution that works without failures. Enhancing Kerberos security requires disabling weak encryption and enforcing mutual authentication.