View Source: ActiveDirectoryKerberos - Waikato Linux Users Group

Edit PageHistory Diff Info LikePages
This page decribes how to install Kerberos on a Linux box to talk to an Windows 2000 or 2003 ActiveDirectory Server.

! Required Software (Debian)
* libkrb5
* krb5-user
* krb5-config

! Configuring Kerberos

This one was tricky and took a bit of fidgeting to get right, but here goes.  As you will be able to see, we may need to create directories for the log files.  Also note that the sections which are in uppercase __have__ to be in uppercase or the thing won't work.

Use the following config file (in debian, redhat and suse at least).  Be sure to use the same capitalisation.  Also, if you are receiving the "UnknownHostException: some.host" you can use the IP address instead of the domain name for the kdc.

/etc/krb5.conf:
<verbatim>
[logging]
default = FILE:/var/log/krb5/libs.log
kdc = FILE:/var/log/krb5/kdc.log
admin_server = FILE:/var/log/krb5/admin.log

[libdefaults]
ticket_lifetime = 24000
default_realm = THINCLIENT.TEST.ORG
default_tgs_enctypes = des-cbc-crc des-cbc-md5
default_tkt_enctypes = des-cbc-crc des-cbc-md5
forwardable = true
proxiable = true
dns_lookup_realm = true
dns_lookup_kdc = true

[realms]
THINCLIENT.TEST.ORG = {
   kdc = test1.thinclient.test.org:88
   default_domain = thinclient.test.org
 }

[domain_realm]
.thinclient.test.org = THINCLIENT.TEST.ORG
thinclient.test.org = THINCLIENT.TEST.ORG

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
</verbatim>

The second part of setting up the kerberos section is to make sure that kerberos is defined in our services file (<tt>/etc/services</tt>).  It should contain a line along the following.

<verbatim>
  kerberos    88/tcp    kdc kerberos5 krb5  # Kerberos v5
  kerberos    88/udp    kdc kerberos5 krb5  # Kerberos v5
</verbatim>

! Testing the kerberos configuration

You can use kinit to test your kerberos setup by issuing a ticket from the KDC.

<verbatim>
kinit Administrator@THINCLIENT.TEST.ORG
</verbatim>

This will prompt you for a password and return success if it succeeds.
If you get an error "KDC has no support for encryption type", you need to re-set the password for that windows user, typically Administrator (as in this example), just reset your password using Active Directory Users and Computers to your original password.

! Problems with Windows clients (IP address vs. name)

We had a problem with Windows (XP SP2) clients not being able to access the Samba server by name, only by IP address.

The Windows client worked if the dotted decimal IP address was used:

<verbatim>
C:\>net view \\192.168.10.4
Shared resources at \\192.168.10.4
</verbatim>
... ''good response elided'' ...

but not if the name was used:

<verbatim>
 C:\>net view \\spongebob
 System error 5 has occurred.
 Access is denied.
</verbatim>

The Samba log had this error:

<verbatim>
[2005/05/31 11:56:18, 1] smbd/sesssetup.c:reply_spnego_kerberos(173)
Failed to verify incoming ticket!
</verbatim>

The solution was to remove (comment out just in case!) the following 3 lines from krb5.conf:

<verbatim>
[libdefaults]
#default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
#default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
#permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5
</verbatim>

I found the solution after much searching [here | http://lists.backports.org/pipermail/backports/2004-October/001216.html] ("with newer krb5 libs you don't need ''these'' lines").


-----
CategoryInteroperability
One page links to ActiveDirectoryKerberos:
ActiveDirectorySamba
Last edited on Wednesday, October 11, 2006 9:56:16 pm by PerryLorier
Edit PageHistory Diff Info LikePages