Kerberos: The Definitive Guide

MIT

The MIT KDC can evaluate user-supplied passwords based on two metrics: the number of character classes it contains, and its length. The length of a password is obvious, but what is a character class? The MIT KDC defines five different character classes:

• Lowercase letters

• Uppercase letters

• Numbers

• Punctuation

• Other characters

For example, given a password policy with a minimum length of six and minimum of two character classes, the password “MITkdc” would be accepted, while the password “mitkdc” would be rejected. However, a simple password based on a dictionary word such as “Tokens” will pass through fine given a minimum of two character classes. A minimum of three character classes will prevent any dictionary word from being used directly, as a nonalphabetical character is required somewhere in the password.

When specifying the number of character classes required in a password, there is no way to enforce that a number of characters of each class must be included in a password before it is accepted. If the minimum number of character classes is three, then the password is valid as long as there is at least one character from each class in the password.

To enforce certain standards on the strength of passwords used in the MIT KDC, a user policy can be established which can then be applied to a set of principals. To establish or modify an existing policy, the following kadmin commands can be used. More information on these commands can be found in Appendix A.

kadmin: add_policy [-maxlife ...