Differences between current version and previous revision of ActiveDirectoryKerberos.
Other diffs: Previous Major Revision, Previous Author, or view the Annotated Edit History
| Newer page: | version 5 | Last edited on Wednesday, October 11, 2006 9:56:16 pm | by PerryLorier | |
| Older page: | version 4 | Last edited on Tuesday, May 31, 2005 2:25:41 pm | by MattCurtis | Revert |
@@ -10,55 +10,60 @@
This one was tricky and took a bit of fidgeting to get right, but here goes. As you will be able to see, we may need to create directories for the log files. Also note that the sections which are in uppercase __have__ to be in uppercase or the thing won't work.
Use the following config file (in debian, redhat and suse at least). Be sure to use the same capitalisation. Also, if you are receiving the "UnknownHostException: some.host" you can use the IP address instead of the domain name for the kdc.
-''
/etc/krb5.conf''
+/etc/krb5.conf:
+<verbatim>
+[logging]
+default = FILE:/var/log/krb5/libs.log
+kdc = FILE:/var/log/krb5/kdc.log
+admin_server = FILE:/var/log/krb5/admin.log
-
[[logging
]
-
default = FILE:/var/log/krb5/libs
.log
- kdc
= FILE:/var/log/krb5/kdc.log
- admin
_server
= FILE:/var/log/krb5/admin.log
+[libdefaults
]
+ticket_lifetime = 24000
+
default_realm
= THINCLIENT
.TEST.ORG
+default_tgs_enctypes
= des-cbc-crc des-cbc-md5
+default_tkt
_enctypes
= des-cbc-crc des-cbc-md5
+forwardable = true
+proxiable = true
+dns_lookup_realm = true
+dns_lookup_kdc = true
- [
[libdefaults
]
- ticket_lifetime = 24000
- default_realm =
THINCLIENT.TEST.ORG
- default_tgs_enctypes
= des-cbc-crc des-cbc-md5
-
default_tkt_enctypes
= des-cbc-crc des-cbc-md5
- forwardable = true
- proxiable = true
- dns_lookup_realm = true
- dns_lookup_kdc = true
+[realms
]
+THINCLIENT.TEST.ORG = {
+ kdc
= test1.thinclient.test.org:88
+
default_domain
= thinclient.test.org
+ }
-
[[realms
]
-
THINCLIENT.TEST.ORG = {
- kdc = test1.
thinclient.test.org:88
- default_domain
= thinclient
.test
.org
- }
+[domain_realm
]
+.thinclient.test.org =
THINCLIENT.TEST.ORG
+thinclient.test.org = THINCLIENT
.TEST
.ORG
-
[[domain_realm
]
- .thinclient.test.org
= THINCLIENT.TEST.ORG
- thinclient.test.org = THINCLIENT.TEST
.ORG
+[kdc
]
+profile
= /var/kerberos/krb5kdc/kdc
.conf
-
[[kdc
]
- profile
= /var/kerberos/krb5kdc/kdc.conf
+[pam
]
+debug
= false
+ticket_lifetime = 36000
+renew_lifetime = 36000
+forwardable = true
+krb4_convert = false
+<
/verbatim>
- [[pam]
- debug = false
- ticket_lifetime = 36000
- renew_lifetime = 36000
- forwardable = true
- krb4_convert = false
-
-
+The second part of setting up the kerberos section is to make sure that kerberos is defined in our services file (<tt>
/etc/services</tt>
). It should contain a line along the following.
+<verbatim>
kerberos 88/tcp kdc kerberos5 krb5 # Kerberos v5
kerberos 88/udp kdc kerberos5 krb5 # Kerberos v5
+</verbatim>
! Testing the kerberos configuration
You can use kinit to test your kerberos setup by issuing a ticket from the KDC.
+<verbatim>
kinit Administrator@THINCLIENT.TEST.ORG
+</verbatim>
This will prompt you for a password and return success if it succeeds.
If you get an error "KDC has no support for encryption type", you need to re-set the password for that windows user, typically Administrator (as in this example), just reset your password using Active Directory Users and Computers to your original password.
@@ -67,31 +72,39 @@
We had a problem with Windows (XP SP2) clients not being able to access the Samba server by name, only by IP address.
The Windows client worked if the dotted decimal IP address was used:
-
C:\>net view \\192.168.10.4
- Shared resources at \\192.168.10.4
- ... [[
good response elided]
...
+<verbatim>
+
C:\>net view \\192.168.10.4
+Shared resources at \\192.168.10.4
+</verbatim>
+... ''
good response elided''
...
but not if the name was used:
+<verbatim>
C:\>net view \\spongebob
System error 5 has occurred.
Access is denied.
+</verbatim>
The Samba log had this error:
- [
[2005/05/31 11:56:18, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
- Failed to verify incoming ticket!
+<verbatim>
+
[2005/05/31 11:56:18, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
+Failed to verify incoming ticket!
+</verbatim>
The solution was to remove (comment out just in case!) the following 3 lines from krb5.conf:
- [
[libdefaults]
-
#default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
-
#default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
-
#permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+<verbatim>
+
[libdefaults]
+#default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+#default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+#permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
+</verbatim>
-I found the solution after much searching [here | http://lists.backports.org/pipermail/backports/2004-October/001216.html] ("with newer krb5 libs you don't need [[
these]
lines").
+I found the solution after much searching [here | http://lists.backports.org/pipermail/backports/2004-October/001216.html] ("with newer krb5 libs you don't need ''
these''
lines").
-----
CategoryInteroperability
