KB No. 2440: Differences between Kerberos and NTLM

NTLM uses a challenge-response mechanism. The client sends a request, the proxy asks it to authenticate itself, and the client sends the same request with its login credentials. Kerberos uses a symmetric encryption system to ensure secure communication between two parties.

Background

Differences between NTLM and Kerberos: 

NTLM

NTLM is an authentication method used in Microsoft's proprietary Active Directory network.

NTLM uses a challenge-response mechanism. The client sends a request, the proxy asks it to authenticate, and the client sends the same request with its login credentials. We will then see two 407s (1. authentication error, 2. authentication request), followed by access to the resource.

Kerberos

Kerberos uses a symmetric encryption system to ensure secure communication between two parties. Communication takes place using a shared secret key. The encryption algorithms are public (AES, DES, 3DES, etc.), and the entire security of the system relies on the confidentiality of the encryption key.

To facilitate the management of such a system, Kerberos relies on the use of a trusted third party that distributes keys to subscribed users and services (principals). A Kerberos server is called a KDC (Key Distribution Center).

Kerberos is a secure service that ensures confidentiality, data integrity, and non-repudiation (participants are identified, including the server, unlike NTLM). The authentication service ensures unique identification of the client and provides them with a session ticket that they can use to request tickets to use Kerberized services. A session ticket encrypted with the key of a Kerberized service constitutes a service ticket. There are two distinct features in a Kerberos service:

• the authentication service
• the service ticket delivery service.

Kerberos was developed at MIT in the 1990s. It is now widely deployed and available in all environments currently in use (Linux, Windows, Mac OS, etc.).

Steps

To perform integration with NTLM or Kerberos authentication, you must first join your Olfeo to the AD domain:

1. Declare a directory inSettings > Authentication > Directory. Be sure to fill in theDomain section(Domain + Workgroup).
2. Enter the domain controller or a DNS server that can correctly resolve DNS queries for the Olfeo machine as the DNS server.
3. When configuring an NTP server, it is preferable to use either the domain controller or the same NTP server as the domain controller.
4. Connect to the domain in Settings > Authentication > Join Windows domain.

   Here, enter the login and password for an account with the necessary rights (add_workstation).

If everything went well, you should see the name of your AD server in the status (LDAP server name: server.domain.tld).

Once the connection has been established, you can choose between NTLM or Kerberos authentication.

• NTLM can be used at two levels:
  • explicit proxy
  • NTLM captive portal
• Kerberos can be used with explicit proxy integration.

Validation

To verify that NTLM or Kerberos is working correctly in the command line:

NTLM

Various related commands:

• #>wbinfo -t: Verifies proper connection to the domain
• #>wbinfo -u: Lists domain users
• #>wbinfo -g: Lists the groups in the domain
• #>wbinfo –trusted-domains: Reports servers with trust relationships
• #>/usr/bin/ntlm_auth –helper-protocol=squid-2.5-basic user password: Allows you to test NTLM authentication in basic mode (login + password).

  Here, the return codes are simple:

  • OK, when the login/password combination is valid.
  • ERR, when the login/password combination is invalid.

The configuration files are:

• /etc/samba/smb.conf
• /etc/krb5.conf

Kerberos