Kerberos NTLM authentication

NTLM: a proven authentication method

The abbreviation NTLM stands for NT LAN Manager. It refers to the Windows NT operating system. This already highlights two characteristics of NTLM: firstly, it is a system developed by the software manufacturer Microsoft. Secondly, this authentication method has become somewhat dated – after all, the first NT version came onto the market back in 1993. Initially, this was a proprietary system from Microsoft. However, programs from other manufacturers also offered support for it – for example, the Mozilla Firefox and Opera browsers as well as the Apache web server. Since Microsoft published the specifications in 2007, any provider can use this system.

High security with Kerberos authentication

The Kerberos system has the same task as NTLM. Computer scientists at the renowned Massachusetts Institute of Technology developed the first version of this authentication method back in the 1980s. Over the years, it became clear that the Kerberos approach provides higher security . Therefore, this system has been continuously developed further . The latest version meets the requirements for authentication in a modern network brilliantly. The advantages of this authentication method led to Microsoft adopting this system as well. Since the introduction of Windows 2000, the Active Directory directory service has been using Kerberos as its preferred authentication method.

.

Comparison between NTLM and Kerberos – which is better?NTLM uses for the authentication of a user a so-called hash value. This is a complex code which, however, in the end represents nothing other than a password. If an attacker now infiltrates the network, they can intercept the hash value and use it to authenticate themselves. Kerberos, on the other hand, works with a third instance: the Kerberos server. The Kerberos server authenticates both the server and the client. It then transmits temporary tickets, which ensure secure communication

. Since these are only valid for a specific period of time, this method significantly increases security.

Kerberos or NTLM – in which cases is which protocol used?

Kerberos is the default authentication method for Active Directory and for many other systems. If both the server and the client support Kerberos, this method is used. Only if one of the parties does not offer support is NTLM used.

NMS supports you in designing secure networksNew Media Service GmbH (NMS) supports you with a secure design of your networks. If you have questions on this topic, we will be pleased to advise you. Furthermore, we can handle the implementation of the authentication method. As an official Microsoft Partner, our employees have extensive experience in dealing with Active Directory and ensure, during login, a

perfect interaction between NTLM and Kerberos.If you would like to find out more, you can simply contact us for a free and non-binding consultation. We will gladly inform you about this topic and, if required, handle the implementation and execution for you.