Kerberos is a complex legacy authentication protocol, that optionally provides authorization. Kerberos enables hosts communicating over a non-secure network to prove their identity to each other in a reasonably secure (before 2015) manner. The design is a client-server model, providing mutual authentication, where both the user and the server verify the identity of the other host with which they are communicating.
Vendors have their own implementation of Kerberos, configuration details for each implementation vary significantly and with significant complexity.
Over time, nearly all Kerberos implementations have been revealed to have critical security design and implementation flaws. Most existing and new implementations should be assumed vulnerable and insecure unless specific mitigations and compensating controls are included.
For Microsoft implementations, examples of additional controls may include:
additional physical protection of the secrets database with the use of Shielded or Guardian virtualization;
bastion or administrative forests, used in conjunction with Just In Time (JIT) administration and dynamic, group-based time-constrained privilege enablement;
strict separation of where the small number of privileged AD accounts may or may not be used for AD administration;
AD administrative accounts must not share a host operating system with other non-privileged user processes and sessions (do not connect to remote desktop hosts or any other host that have user accounts that are not AD administrators).
Used with name services under your control
Below are information that may help those troubleshooting Kerberos on commonly used platforms.
RFC Kerberos - http://www.faqs.org/rfcs/rfc1510.html
Kerberos Blogs by AD support team at Microsoft - http://blogs.technet.com/b/askds/archive/tags/Kerberos/
Kerberos blogs by Open Specification team at Microsoft - http://blogs.msdn.com/b/openspecification/archive/tags/Kerberos/
Kerberos.NET Framework - https://syfuhs.net/a-deep-dive-into-the-design-kerberos-net
Ubuntu Linux post on Kerberos - https://help.ubuntu.com/community/Kerberos