| 4.4 |  | AAA Servers Overview and Configuration |
| 4.4.4 |  | Kerberos overview |

| While TACACS+ and RADIUS are by far the most common network authentication protocols, it is important to be familiar with Kerberos, which is still used in some older networks. Figure illustrates the Kerberos authentication process. Kerberos is a secret-key network authentication protocol, developed at the Massachusetts Institute of Technology (MIT) that uses the Data Encryption Standard (DES) cryptographic algorithm for encryption and authentication. Kerberos was designed to authenticate requests for network resources. Kerberos, like other secret-key systems, is based on the concept of a trusted third party that performs secure verification of users and services.

In the Kerberos protocol, this trusted third party is called the Key Distribution Center (KDC). It performs the same function as a certification authority (CA), which is the subject of a later module.

Cisco IOS Release 12.0 includes Kerberos 5 support, which allows organizations already deploying Kerberos 5 to use an existing KDC, similar to a CA in IPSec, with their routers and NASs. The following Cisco IOS network services use Kerberos :

- Telnet - Telnet client from a router to another host and Telnet server from another host to a router
- rlogin - Logs a user into a remote UNIX host for an interactive session similar to Telnet
- rsh - Logs a user into a remote UNIX host and allows execution of one UNIX command
- rcp - Logs a user into a remote UNIX host and allows the copying of files from the host

| Web Links http://web.mit.edu/kerberos/www/