By default, Kerberos rejects any tickets with a time stamp that is more than five minutes off. This, however, means that nodes in the Kerberos realm should be set with the correct time. After a week of resetting clocks, we installed a Network Time Protocol daemon in our lab facility to synchronize clocks across our network. Kerberos Principals User account s in Kerberos are called principals. Kerberos authenticates sessions between principals using tickets, which are encrypted using various principals' keys.
Authentication occurs when the server successfully decrypts a ticket to find the user's identity.
Be careful not to confuse instances with user groups. There is another use for a Kerberos instance. Bypassing standard Unix security, ksu allows users with a root instance to use their own private root password to gain root access to Unix machines in the Kerberos realm. The machine's true root password is never given out. We found this to be an invaluable tool to protecting root passwords and are using it in our own Unix network.