Learn Kerberos - Pre-requisite Skills & Environment Setup

#Introduction

Welcome to the Learn Kerberos series! This series will help you master Kerberos — the network authentication protocol that is the foundation of security in Active Directory and almost every enterprise environment — from fundamental cryptographic concepts to production-grade deployment. There are 31 episodes in total that will build your understanding layer by layer, from the authentication flow, KDC installation, SSH and NFS integration, all the way to security best practices and troubleshooting.

But before creating your first ticket, there are a few foundational skills and tools you must prepare first. Why are these prerequisites important? Because Kerberos is not just a command you type — it is a cryptographic protocol that lives on the network, depending on synchronized clocks, clean DNS, and keys that are managed correctly. If the foundations aren't ready, every error like Clock skew too great will feel like a puzzle with no end.

Imagine wanting to be a security guard in a building with a sophisticated card access system, but not understanding how the card works, which keys protect it, or who is allowed in. Episode 0 is your roadmap: we will prepare the foundational skills, gather the tools, and then set up the lab topology you will use throughout the series.

#Foundational Skills You Must Have

#Cryptography: Symmetric, Asymmetric, and Hashing

Kerberos is built on cryptography, so you must understand at least these three concepts:

Why does this matter? Because a Kerberos ticket is essentially a symmetrically encrypted block of data. When you come across terms like AES256-CTS-HMAC-SHA1-96 in the episode on encryption types later, you will already have the foundation to understand what it means.

#Networking: TCP/IP and DNS

Kerberos is a network protocol, so you should be comfortable with IP addresses, ports, and DNS. The ports you will see frequently: 88 for the KDC (TCP and UDP), 749 for kadmin, and 464 for kpasswd. DNS is crucial because Kerberos finds its KDC through SRV records — we will break that down in full in episode 4.

#Authentication vs Authorization

Two words that are often confused, but the difference is fundamental:

• Authentication — proving who you are. Kerberos handles this.
• Authorization — determining what you are allowed to do. This is usually handled by applications or other systems.

Kerberos answers the question "who are you?", not "what are you allowed to do?". Understand this boundary from the start so you don't misread authentication results.

#Directory Services Basics (LDAP)

LDAP is a directory service that stores centralized identity — users, groups, computers. In the real world, Kerberos and LDAP often work as a pair: Kerberos proves identity, LDAP provides authoritative data. For the early episodes, you only need to know the basic concept; full integration is covered in episode 17.

#Linux CLI Proficiency

Almost all interaction with Kerberos happens through the terminal. At minimum you should be comfortable with directory navigation (pwd, ls, cd), reading manuals (man), and running commands with sudo. Kerberos tools like kinit, klist, and kadmin are pure CLI — there are no buttons to click.

#Client-Server Architecture

Kerberos works with a three-party model: the client requesting access, the server providing the service, and the KDC acting as the trusted third party. If you already understand the request-response concept between client and server, understanding Kerberos becomes much easier — because Kerberos adds an intermediary layer in the middle of that conversation.

#Security Concepts: The CIA Triad

Kerberos contributes directly to the first two components, and to availability through the high availability design covered in episode 25.

#Software & Tools You Need to Prepare

Here is the full list of software you will use throughout the series:

#Choosing an Implementation: MIT vs Heimdal

MIT Kerberos is the reference implementation that is most widely used, documented, and the basis of the enterprise ecosystem. Heimdal is also valid, but for this series we consistently use MIT Kerberos so that every command example and configuration path can be applied directly without translation.

#Kerberos Client Tools

Four tools will accompany you every day:

Understand all four now, because from episode 5 until the end of the series, kinit and klist will be the opening lines of almost every practice.

#Lab Topology: Realm, KDC, and Two Clients

We will build a lab with one realm named EXAMPLE.COM (the Kerberos realm naming convention is always uppercase), one KDC server, and two clients. A realm is the Kerberos administrative boundary — a simple analogy is a "kingdom" with its own cryptographic laws.

                   +------------------+
                   |  kdc.example.com |
                   |  KDC + kadmin    |
                   |  192.168.10.10   |
                   +--------+---------+
                            |
              +-------------+-------------+
              |                           |
   +----------+---------+      +----------+---------+
   | client1.example.com|      | client2.example.com|
   | 192.168.10.21      |      | 192.168.10.22      |
   +--------------------+      +--------------------+
 
   Realm: EXAMPLE.COM  |  DNS: example.com  |  Time: chrony

All hosts are on a single network where they can reach each other. This configuration is enough for the entire series — even for the later cross-realm episode, you'll simply add a second realm.

#Hardware & VM Requirements

Kerberos is very lightweight at lab scale, but there are minimums you should respect:

• RAM: at least 2 GB per VM, 4 GB recommended for comfort.
• Storage: at least 20 GB per VM.
• Number of VMs: three — one KDC and two clients.
• Connectivity: all VMs must be able to reach each other on the network.
• Synchronized clocks: this isn't a suggestion, it's a requirement. Kerberos relies on timestamps to prevent replay attacks, and its tolerance is only 5 minutes. We'll set this up in episode 4.

#Verifying the Environment

Once the VMs are up, install the Kerberos client tools on both clients along with their supporting packages:

Install client tools on client1 and client2

sudo apt update
sudo apt install krb5-user chrony dnsutils -y

On the KDC server, install the KDC package and its admin tools:

Install KDC packages on kdc.example.com

sudo apt update
sudo apt install krb5-kdc krb5-admin-server -y

Then verify that all tools are available and the environment is healthy:

which kinit klist kdestroy kadmin
klist -V
timedatectl status
dig +short kdc.example.com

#Episode 0 Checklist Summary

• Understand the difference between symmetric, asymmetric, and hash encryption.
• Understand authentication vs authorization, and LDAP's role as a directory service.
• Be comfortable with the Linux CLI and the client-server concept.
• Know the Kerberos ports: 88 (KDC), 749 (kadmin), 464 (kpasswd).
• Prepare three VMs: one KDC and two clients, realm EXAMPLE.COM.
• Client tools (kinit, klist, kdestroy, kadmin) are installed.
• All VMs are ready to have their clocks synchronized.

#Conclusion

In episode 0 you laid the foundation for the entire series: understanding the cryptography and networking basics that underpin Kerberos, gathering the required tools (MIT Kerberos, chrony, DNS, Wireshark, and the client tools), and setting up a lab topology with one KDC and two clients in the EXAMPLE.COM realm.

Key takeaways:

• Kerberos is a symmetric cryptography protocol that lives on the network — master the cryptography and networking basics.
• Authentication (who you are) is different from authorization (what you may do); Kerberos handles the former.
• Prepare three VMs (KDC + 2 clients) in one realm as the standard lab for the whole series.
• Time synchronization is the key to Kerberos success — remember this before every practical episode that follows.

In the next episode, episode 1, we'll cover the history, background, and why the world needed Kerberos — from the protocol's birth in MIT's Project Athena in the 1980s, the naming story of the three-headed dog Cerberus, to the traditional authentication problems it set out to solve. Make sure your lab is standing, because the Learn Kerberos journey is just beginning!