Port 88 (Kerberos)
Authentication in Active Directory domains, served by domain controllers.
- Transport
- TCP/UDP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Kerberoasting requests service tickets for accounts with SPNs and cracks them offline.
- AS-REP roasting targets accounts with Kerberos pre-authentication disabled.
- Golden and silver tickets forge Kerberos tickets after key material is stolen.
When it shows up in your logs
A burst of service ticket requests (event 4769) with RC4 encryption from one account suggests Kerberoasting.