Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't know what the best practice for kerberos is with regards to security. I was wondering is it a good idea to allow a kerberos server to be public so public servers can use single-sign on or is it something that is only reserved for internal lan.

Also the kerberos server is an Windows Server that has other services on it as well. What would you guys do?

share|improve this question
What is the role of the server? – DanBig Jan 14 '11 at 18:38
do you mean the public servers or the windows server? basically we have a bunch of ssh servers I'd like to use SSO for. However the kerberos server is a windows small business server so it kind of has everything on it right now like LDAP and email. – PHGamer Jan 14 '11 at 19:10

Exposing an Active Directory DC to the Internet is a Bad Idea™

A tightly secured Kerberos TGS can be exposed to the net with minimal liability. That said, Windows Server 2003 has minimal ability to configure Kerberos, it just wasn't mean to be exposed to the net directly like that.

share|improve this answer
Bad is an understatement – Zypher Jan 14 '11 at 19:20
I thought as much. Although more generally I am curious what people who set up kerberos servers do. Is it common for them to expose it or do they generally reserve SSO for internal use only? – PHGamer Jan 14 '11 at 19:38

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.