Kerberos is a network authentication protocol built to secure communications in hostile networks. It uses tickets issued by a Key Distribution Center (KDC) to prove identity without sending passwords over the wire. Service accounts are the backbone of this process. They represent applications or services, store long-term keys, and allow non-human actors to authenticate under Kerberos.
A Kerberos service account is tied to a principal stored in the KDC database. It is assigned a password or keytab file, which must be protected with zero tolerance for leaks. Any compromise gives attackers valid credentials to impersonate a service. Unlike user accounts, service accounts often run constantly and hold elevated permissions. This makes them prime targets for credential theft and replay attacks.
Every service account must map to a specific Service Principal Name (SPN). The SPN tells Kerberos which service a ticket is intended for and ensures tickets cannot be reused across different services. Set SPNs precisely. Avoid generic or duplicate names. Mismatched SPNs lead to failed authentications or, worse, misdirected tickets.
Key management is essential. Rotate passwords or keytabs regularly. Store keytabs in directories with strict file permissions. Remove unused service accounts. Monitor usage with centralized logging to detect anomalies such as ticket requests at unusual times or from unfamiliar hosts.