This page decribes how to install Kerberos on a Linux box to talk to an Windows 2000 or 2003 ActiveDirectory Server.
This one was tricky and took a bit of fidgeting to get right, but here goes. As you will be able to see, we may need to create directories for the log files. Also note that the sections which are in uppercase have to be in uppercase or the thing won't work.
Use the following config file (in debian, redhat and suse at least). Be sure to use the same capitalisation. Also, if you are receiving the "UnknownHostException: some.host" you can use the IP address instead of the domain name for the kdc.
/etc/krb5.conf:
[logging]
default = FILE:/var/log/krb5/libs.log
kdc = FILE:/var/log/krb5/kdc.log
admin_server = FILE:/var/log/krb5/admin.log
[libdefaults]
ticket_lifetime = 24000
default_realm = THINCLIENT.TEST.ORG
default_tgs_enctypes = des-cbc-crc des-cbc-md5
default_tkt_enctypes = des-cbc-crc des-cbc-md5
forwardable = true
proxiable = true
dns_lookup_realm = true
dns_lookup_kdc = true
[realms]
THINCLIENT.TEST.ORG = {
kdc = test1.thinclient.test.org:88
default_domain = thinclient.test.org
}
[domain_realm]
.thinclient.test.org = THINCLIENT.TEST.ORG
thinclient.test.org = THINCLIENT.TEST.ORG
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
The second part of setting up the kerberos section is to make sure that kerberos is defined in our services file (/etc/services). It should contain a line along the following.
kerberos 88/tcp kdc kerberos5 krb5 # Kerberos v5 kerberos 88/udp kdc kerberos5 krb5 # Kerberos v5
You can use kinit to test your kerberos setup by issuing a ticket from the KDC.
kinit Administrator@THINCLIENT.TEST.ORG
This will prompt you for a password and return success if it succeeds. If you get an error "KDC has no support for encryption type", you need to re-set the password for that windows user, typically Administrator (as in this example), just reset your password using Active Directory Users and Computers to your original password.
We had a problem with Windows (XP SP2) clients not being able to access the Samba server by name, only by IP address.
The Windows client worked if the dotted decimal IP address was used:
C:\>net view \\192.168.10.4 Shared resources at \\192.168.10.4
... good response elided ...
but not if the name was used:
C:\>net view \\spongebob System error 5 has occurred. Access is denied.
The Samba log had this error:
[2005/05/31 11:56:18, 1] smbd/sesssetup.c:reply_spnego_kerberos(173) Failed to verify incoming ticket!
The solution was to remove (comment out just in case!) the following 3 lines from krb5.conf:
[libdefaults] #default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 #default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 #permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
I found the solution after much searching 
here ("with newer krb5 libs you don't need these lines").
One page links to ActiveDirectoryKerberos:
