Kerberos

Synopsis

Creates an emulated Kerberos Key Distribution Center that identifies AS-REQ and TGS-REQ messages, recovers the principal components they carry, and always answers with a KRB-ERROR so it looks like a real KDC to the client. Every parsed request is logged with the recovered principal information.

Schema

- id: <numeric>
  name: <string>
  description: <string>
  type: kerberos
  tags: <string[]>
  pipelines: <pipeline[]>
  status: <boolean>
  properties:
    address: <string>
    port: <numeric>
    dns_domain: <string>
    computer_name: <string>
    timeout: <numeric>

Configuration

The following fields are used to define the device:

Device

Field	Required	Default	Description
id	Y		Unique identifier
name	Y		Device name
description	N	-	Optional description
type	Y		Must be kerberos
tags	N	-	Optional tags
pipelines	N	-	Optional pre-processor pipelines
status	N	true	Enable/disable the device

Connection

Field	Required	Default	Description
address	N	"0.0.0.0"	Listen address
port	Y		Listen port
timeout	N	15	Deadline in seconds for each TCP connection, set once when the client connects. Activity does not extend it, so a connection is closed this long after it opened

note

The listener binds both UDP and TCP on the configured port. Over TCP, each message is prefixed with a 4-byte length field. The Kerberos realm answered by the device is the uppercased dns_domain — corp.local becomes CORP.LOCAL.

Realm

Field	Required	Default	Description
dns_domain	N	"corp.local"	Domain name uppercased to form the answered Kerberos realm
computer_name	N	"DC01"	Accepted for configuration consistency with the other honeypot devices

note

computer_name is accepted, and changing it reloads the device, but it does not affect any response. Only dns_domain influences behavior, by way of the realm.

Ingest Buffer

Field	Required	Default	Description
max_buffer_size	N	128MB	Ingest buffer admission cap. Also sizes this listener's ingest buffers: 3/8 of this value at start, growing to at most 3x

note

max_buffer_size is the ingest-buffer admission cap, and is distinct from any buffer_size field above, which sizes the network read buffer. Left unset it is 128MB, whose buffers take 48 MiB of heap per listener worker at start and grow to at most 384 MiB as bursts need the room — and with reuse: true a device runs one worker per listener. Size strings are binary, and 32MB and 32MiB are exact synonyms.

See Listener Memory Sizing for the arithmetic, the sizing table, and what happens when the cap is exhausted.

Details

Emulated KDC

The device identifies the message from the ASN.1 application tag: 0x6A for AS-REQ, 0x6C for TGS-REQ. Any other tag is dropped. Rather than a full ASN.1 parse, it scans for GeneralString values to recover the principal components — username, realm, and service principal name.

It always answers with a synthesized KRB-ERROR ([APPLICATION 30], pvno 5, msg-type 30, sname of krbtgt/REALM):

Message	Error returned
AS-REQ	25 KDC_ERR_PREAUTH_REQUIRED
TGS-REQ	7 KDC_ERR_S_PRINCIPAL_UNKNOWN

AS-REQ traffic reveals attempted usernames, which is the signature of user enumeration and AS-REP roasting. TGS-REQ traffic reveals requested service principals, which is the signature of Kerberoasting.

Logged Events

Each parsed message generates one of the following event types:

event_type	Emitted when
as_req	An AS-REQ message is identified and parsed
tgs_req	A TGS-REQ message is identified and parsed

Event Fields

Every event carries timestamp, event_type, source_ip, source_port, and local_addr. The remaining fields depend on the event type:

Field	Description
transport	Transport the request arrived on: udp or tcp
msg_type	Identified message type: AS-REQ or TGS-REQ
username	First principal component recovered from the message
realm	First all-uppercase dotted principal component recovered from the message, otherwise the configured realm
principals	All principal components recovered from the message

Examples

The following are commonly used configuration types.

Basic

Creating a minimal Kerberos honeypot on the standard port...

devices: - id: 1 name: basic_kerberos type: kerberos properties: port: 88

Custom Realm

Answering as a different Active Directory realm...

devices: - id: 2 name: kerberos_custom_realm type: kerberos properties: port: 88 dns_domain: contoso.com

With Pre-Processing

Routing captured requests through a pre-processing pipeline before ingestion...	devices: - id: 3 name: kerberos_preprocessed type: kerberos pipelines: - decoy-honeypot-enrich properties: port: 88 dns_domain: corp.local
A TGS-REQ for a service principal is logged, showing a Kerberoasting-style request...	{ "timestamp": "2026-08-03T09:14:22.481937204Z", "event_type": "tgs_req", "source_ip": "203.0.113.44", "source_port": "51422", "local_addr": "10.0.4.12:88", "transport": "tcp", "msg_type": "TGS-REQ", "username": "svc-sql", "realm": "CORP.LOCAL", "principals": ["svc-sql", "CORP.LOCAL", "MSSQLSvc/sql01.corp.local:1433"] }