2 ms·
You can pretty much get away with just a Kerberos KDC (and optionally pam_krb5) if setting up user accounts on the servers by hand/via configuration management
by rb12345 7y ago
You can pretty much get away with just a Kerberos KDC (and optionally pam_krb5) if setting up user accounts on the servers by hand/via configuration management is a practical option. At scale, you'd want LDAP to set the user IDs and other account attributes everywhere. Managed devices are nice but not entirely necessary.
You can also use "GSSAPIKeyExchange yes" to solve the trust-on-first-use issue without resorting to DNSSEC, since the server identity gets verified via Kerberos in that case.
The main benefits of certificates I can see are the increased auth flow options and better scaling at large scales since you lose the service ticket traffic.