Using DTrace With the Kerberos Service

The Kerberos mechanism supports various DTrace probes for decoding various protocol messages. The probes include KRB_AP_*, KRB_KDC_*, KRB_CRED, KRB_ERROR, KRB_PRIV, KRB_SAFE, and general messaging information. This has the distinct advantage over other protocol inspectors, by allowing the privileged user to easily look at unencrypted Kerberos and application data.

The following example shows what pre-authentication is chosen by the client. The first step is to create a DTrace script, like the following:

cat krbtrace.d
kerberos$target:::krb_message-recv
{
    printf("<- krb message recved: %s\n", args[0]->krb_message_type);
    printf("<- krb message remote addr: %s\n", args[1]->kconn_remote);
    printf("<- krb message ports: local %d remote %d\n",
            args[1]->kconn_localport, args[1]->kconn_remoteport);
    printf("<- krb message protocol: %s transport: %s\n",
            args[1]->kconn_protocol, args[1]->kconn_type);
}

kerberos$target:::krb_message-send
{
    printf("-> krb message sent: %s\n", args[0]->krb_message_type);
    printf("-> krb message remote addr: %s\n", args[1]->kconn_remote);
    printf("-> krb message ports: local %d remote %d\n",
            args[1]->kconn_localport, args[1]->kconn_remoteport);
    printf("-> krb message protocol: %s transport: %s\n",
            args[1]->kconn_protocol, args[1]->kconn_type);
    printf("\n");
}

kerberos$target:::krb_kdc_req-make
{
    printf("-> krb kdc_req make msg type: %s\n", args[0]->krb_message_type);
    printf("-> krb kdc_req make pre-auths: %s\n", args[1]->kdcreq_padata_types);
    printf("-> krb kdc_req make auth data: %s\n", args[1]->kdcreq_authorization_data);
    printf("-> krb kdc_req make client: %s server: %s\n", args[1]->kdcreq_client,
           args[1]->kdcreq_server );
}

kerberos$target:::krb_kdc_req-read
{
    /* printf("<- krb kdc_req msg type: %s\n", args[0]->krb_message_type); */
    printf("<- krb kdc_req client: %s server: %s\n", args[1]->kdcreq_client,
           args[1]->kdcreq_server );
    printf("\n");
}

kerberos$target:::krb_kdc_rep-read
{
    /* printf("<- krb kdc_rep msg type: %s\n", args[0]->krb_message_type); */
    printf("<- krb kdc_rep client: %s server: %s\n", args[1]->kdcrep_client,
           args[1]->kdcrep_enc_server );
    printf("\n");
}

kerberos$target:::krb_ap_req-make
{
    printf("-> krb ap_req make server: %s client: %s\n", args[2]->kticket_server,
           args[2]->kticket_enc_client );
}

kerberos$target:::krb_error-read
{
    printf("<- krb error code: %s\n", args[1]->kerror_error_code);
    printf("<- krb error client: %s server: %s\n", args[1]->kerror_client,
            args[1]->kerror_server);
    printf("<- krb error e-text: %s\n", args[1]->kerror_e_text);
    printf("\n");
}

Next, execute the krbtrace.d script as a privileged user on the Kerberos system by typing the following command:

# LD_BIND_NOW=1 dtrace -qs krbtrace.d -c "kinit -k"
  .
  .
-> krb kdc_req make pre-auths: FX_COOKIE(133) ENC_TIMESTAMP(2) REQ_ENC_PA_REP(149)

The pre-authentication types are displayed in the output. For more information about the various pre-authentication types see RFC 4120.