CME-806

Kerberos Authentication (GSSAPI)

Harden Identity Unquantified evidence Preventive

Description

Enforce Kerberos (GSSAPI) as the authentication mechanism, replacing password-based authentication with cryptographic ticket exchange. The client authenticates to the Key Distribution Center (KDC) and receives a Ticket-Granting Ticket (TGT), then requests service tickets for specific services — passwords never cross the network. Service tickets are encrypted with the target service's key, time-limited (typically 10-hour TGT, configurable), and include timestamps for replay detection. Mutual authentication ensures both client and server prove their identity, preventing server impersonation attacks. On RHEL, Kerberos is deployed via FreeIPA/IdM (ipa-client-install enrolls the host and configures SSSD); on Windows, Active Directory provides native Kerberos. SSH access is secured via GSSAPI authentication (GSSAPIAuthentication yes in sshd_config). Known attack vectors against Kerberos itself (Kerberoasting, Pass-the-Ticket, Golden Ticket) require the attacker to already have domain credentials or host-level access — they represent post-compromise lateral movement, not the initial credential interception this control prevents.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	With password-based authentication, an attacker intercepting network traffic (MITM, packet capture) can capture replayable credentials and use them from any host at any time. With Kerberos, the client proves knowledge of the password to the KDC via an encrypted timestamp (pre-authentication) — the password itself never traverses the network. Service tickets are encrypted with the service's secret key, time-stamped for replay detection, and valid only for a limited window. The attacker must either compromise the KDC itself, crack service account passwords offline (Kerberoasting — requires existing domain credentials), or steal tickets from host memory (Pass-the-Ticket — requires local access). Each bypass requires preconditions beyond simple network interception

CWE Relationships

CWE-287 CWE-294 CWE-303 CWE-319

ATT&CK Technique Crosswalks

Verification

Verify Kerberos authentication is configured and enforced via keytab, GSSAPI, and domain enrollment

$ klist -k /etc/krb5.keytab 2>/dev/null | grep -c 'host/'
# Expected: >=1

Platform: linux

$ sshd -T | grep gssapiauthentication
# Expected: gssapiauthentication yes

Platform: linux

$ test -f /etc/krb5.conf && grep -c 'default_realm' /etc/krb5.conf
# Expected: >=1

Platform: linux

$ nltest /dsgetdc: 2>$null | Select-String 'DC:'
# Expected: DC:

Platform: windows

Remediation

linux SSH GSSAPI authentication with host keytab enforcement


printf 'GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
PasswordAuthentication no
ChallengeResponseAuthentication no
' > /etc/ssh/sshd_config.d/99-cme-806-gssapi.conf
systemctl restart sshd

rhel FreeIPA/IdM client enrollment with Kerberos and SSSD


dnf install -y ipa-client
ipa-client-install --domain=<ipa_domain> --server=<ipa_server> --mkhomedir --enable-dns-updates --unattended
printf 'GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
PasswordAuthentication no
ChallengeResponseAuthentication no
' > /etc/ssh/sshd_config.d/99-cme-806-gssapi.conf && systemctl restart sshd

Applicability (CVE 5.2.0 Schema)

Vendor	Product	CPEs	Platforms	Status
redhat	enterprise_linux	`cpe:2.3:o:redhat:enterprise_linux:8:::::::` `cpe:2.3:o:redhat:enterprise_linux:9:::::::` `cpe:2.3:o:redhat:enterprise_linux:10:::::::*`	All	applicable