-: LDAP and Kerberos.
LDAP is the lightweight directory access protocol.
This is a database that's used to centralize
information about your clients
and your objects on the network.
LDAP is essentially a simplified version of X.500,
which is a directory service,
and it contains a hierarchical organization
of the users, groups, servers, and systems
inside your network.
LDAP communicates over port 389
when it's doing it unencrypted.
And if you decide to encrypt it using SSL
or TLS, it's going to use port 636.
Both of these are ports you should know
for the Security+ exam.
Now, while LDAP is considered cross platform,
Microsoft created their own implementation of this,
known as AD or Active Directory.
This is yet another example of a single sign-on system.
In the Windows domain, Active Directory
is used to organize and manage everything on the network,
including those clients, servers, devices,
users, and groups.
Now, Active Directory can also be used
as part of your security policies
or access control through your group policies.
Now, Kerberos, on the other hand,
is focused on authentication and authorization.
This is performed through our Kerberos ticketing system
in a Windows domain.
Kerberos is an authentication protocol
that provides for two-way or mutual authentication.
When a user logs on to the domain,
they first contact the domain controller
which acts as the key distribution center, or KDC.
This KDC has two basic functions,
authentication and ticket granting.
So, if your client is authenticated properly,
the KDC will issue them a TGT,
which is called a ticket-granting ticket.
This ticket-granting ticket is then provided
to the domain controller anytime that user
wants to access a resource.
And then the domain controller can provide that user
with a service ticket or a session key to use,
whichever one's appropriate for their needs.
These tickets are presented to the resource
and the access is then granted,
because the resource always trusts the domain controller's
provided tickets.
If your domain controller is running Kerberos,
it's going to have port 88 open
so it can receive those inbound service login requests
from the clients.
Now, because Kerberos relies on the domain controller
to serve as that key distribution center,
this is a single point of failure in the domain.
If the domain controller is down,
ticket-granting services are also shut down.
To prevent this, though, what most people will do
is have a primary and a secondary active domain controller.
That will give you this form of redundancy
to ensure Kerberos is up and LDAP is still running.