I often use openssl s_client
to test and debug SSL connections (to LDAPS or HTTPS services). It allows me to isolate the problem down to SSL, without anything getting in the way.
I want to do something similar with Kerberos. I would like to use a small test, which would show :
- The initial machine logon (the computer account)
- The initial AS request from the user requesting a service
- The kerberos exchange of the user getting a ticket
- (optional) the request being sent to the service
I can do steps 1, 2 and 3 if I run Wireshark on a KDC, but it is usually not an option. I can manage to capture steps 2, 3 and 4 if I monitor trafic on the client.
Is there tool that would allow me to capture the every Kerberos login steps starting with the computer account, without running Wireshark on the KDC ?