Node: Definitions, Previous: The User/Kerberos Interaction, Up: How Kerberos Works

### Definitions

Following are definitions of some of the Kerberos terminology.

client
  an entity that can obtain a ticket. This entity is usually either a user or a host.
host
  a computer that can be accessed over a network.
Kerberos
  in Greek mythology, the three-headed dog that guards the entrance to the underworld. In the computing world, Kerberos is a network security package that was developed at MIT.
KDC
  Key Distribution Center. A machine that issues Kerberos tickets.
keytab
  a key table file containing one or more keys. A host or service uses a keytab file in much the same way as a user uses his/her password.
principal
  a string that names a specific entity to which a set of credentials may be assigned. It can have an arbitrary number of components, but generally has three:
  primary
    the first part of a Kerberos principal. In the case of a user, it is the username. In the case of a service, it is the name of the service.
  instance
    the second part of a Kerberos principal. It gives information that qualifies the primary. The instance may be null. In the case of a user, the instance is often used to describe the intended use of the corresponding credentials. In the case of a host, the instance is the fully qualified hostname.
  realm
    the logical network served by a single Kerberos database and a set of Key Distribution Centers. By convention, realm names are generally all uppercase letters, to differentiate the realm from the internet domain.

  The typical format of a typical Kerberos principal is primary/instance@REALM.

service
  any program or computer you access over a network. Examples of services include "host" (a host, e.g., when you use `telnet` and `rsh`), "ftp" (FTP), "krbtgt" (authentication; cf. ticket-granting ticket), and "pop" (email).
ticket
  a temporary set of electronic credentials that verify the identity of a client for a particular service.
TGT
  Ticket-Granting Ticket. A special Kerberos ticket that permits the client to obtain additional Kerberos tickets within the same Kerberos realm.