Kerberos for Mutual Authentication Recall that Authentication is the determination of a principal's identity via a shared secret known only by the principal and the security service. For non-interactive principals, the shared secret is the server key , which is stored in a keytab file on the server's disk. The term key is commonly used for the shared secrets of both users and servers. Kerberos authenticates the identity of DCE principals, which may have to be distinct from their Unix identities, e.g., the cell-admin. Password is used only for encryption and decryption, and is therefore not passed over the network.
All tickets expire, according to administrator determined ticket lifetimes.
An unexpired TGT lets a client system automatically refresh other tickets when they expire. But, when the TGT expires, the client must re-authenticate himself or herself, by resubmitting a password. When PTGTs expire, systems can automatically refresh it using the keytab file. Expiration times are inside the encrypted tickets, so clients cannot modify them. As a rule, the life of server tickets should be less than that of PTGTs, which should, in turn, be less than that of TGTs.