Kerberos
Authentication protocol in Privacy & security
People recommend Kerberos for strong network authentication, such as securing NFS mounts. Critics say setup is hard and the protocol is outdated.
People recommend Kerberos for strong network authentication, such as securing NFS mounts. Critics say setup is hard and the protocol is outdated.
22 people gave an opinion
- recommend it
- 12
- criticize it
- 10
- approval share
- 55%
Recommended in 7 of 13 months
- November 2025: recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 12 people recommend itNeeds 10 or more, met.
- 1.2 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 7 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Secures NFS and network filesystems
“It is malpractice not to secure NFS mounts (and other network filesystems with sensitive data), and that means Kerberos.”
Comment from 4 Apr 2026 in “SSH certificates: the better SSH experience” “NFSv4 + OpenLDAP + Kerberos would be the correct answer in this particular case based on OP's concerns”
Comment from 10 Dec 2025 in “If NFS isn't the answer for an all-Linux setup, what is?” Works with OpenLDAP and DNS servers
“NFSv4 + OpenLDAP + Kerberos would be the correct answer in this particular case based on OP's concerns”
Comment from 10 Dec 2025 in “If NFS isn't the answer for an all-Linux setup, what is?” “I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server.”
Comment from 18 Feb 2026 in “Native FreeBSD Kerberos/LDAP with FreeIPA/IDM” Built-in extensibility and deliberate design
“The nice thing with kerberos is that it v5 has extensibility effectively built in”
Comment from 22 Sep 2026 in “What Sun got wrong” “It's almost like Kerberos was designed and implemented for a reason!”
Comment from 19 May 2026 in “CISA Admin Leaked AWS GovCloud Keys on GitHub”
What people warn about
Each mark is one comment
Hard to set up
“Setting up Kerberos in 2026 feels somewhat close to malpractice to me.”
Comment from 3 Apr 2026 in “SSH certificates: the better SSH experience” “I gave up after trying to set up a Kerberos server on the Synology”
Comment from 2 Feb 2026 in “TIL: Apple Broke Time Machine Again on Tahoe” “the experience was akin to staring into the sun”
Comment from 4 Dec 2025 in “Can Dutch universities do without Microsoft?” Protocol design seen as outdated
“No one would build KRB4/5 today, it makes no sense.”
Comment from 28 Nov 2025 in “Can Dutch universities do without Microsoft?” “But today, in 2026, Kerberos is indefensible.”
Comment from 23 Sep 2026 in “SAML: A fractal of bad design” “The protocol itself is fundamentally flawed.”
Comment from 28 Nov 2025 in “Can Dutch universities do without Microsoft?” - Comment from 28 Nov 2025 in “Can Dutch universities do without Microsoft?”
What people said
22 of the 24 comments that mention it, newest first. Each links to the original comment.
“But today, in 2026, Kerberos is indefensible.”
“The nice thing with kerberos is that it v5 has extensibility effectively built in”
“Kerberos security (adopted by Microsoft in SMB and Windows Server, etc.”
“how powerful it was for our little LAN in the dorm”
“setting up a KDC and then distributing krb5.conf and idmap.conf files is not such a hard task”
“It's almost like Kerberos was designed and implemented for a reason!”
“It is malpractice not to secure NFS mounts (and other network filesystems with sensitive data), and that means Kerberos.”
“Setting up Kerberos in 2026 feels somewhat close to malpractice to me.”
“which together with virtual service principal namespaces makes a very nice keytab orchestration system”
“I run: OpenLDAP, an MIT Kerberos KDC, and a PowerDNS server.”
“I hear generally good things”
“I gave up after trying to set up a Kerberos server on the Synology”
“NFSv4 + OpenLDAP + Kerberos would be the correct answer in this particular case based on OP's concerns”
“the experience was akin to staring into the sun”
“Its support for GeneralString is totally half-assed”
“MIT Kerberos on Linux is not really compatible with Windows Kerberos in ways that cause problems”
“You need Kerberos if you want to map user names instead of user ids and still have some security.”
“No one would build KRB4/5 today, it makes no sense.”
“you really need to read the kerberos book before picking up sssd”
“The protocol itself is fundamentally flawed.”
“Kerberos is not a great protocol”
“rewrite of Kerberos 5 in Rust, removing the dumb options and Kerberos 4 compatibility”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.