Home
Main website
Display Sidebar
Hide Ads
Recent Changes
View Source:
KerberosNotes
Edit
PageHistory
Diff
Info
LikePages
Setting up [Kerberos] 5 Your Kerberos realm is normally the same as your DNS name, in capital letters. Therefore, if your DNS name is element.tla, your Kerberos realm will be ELEMENT.TLA Under debian, install the following packages: libkrb53 krb5-clients krb5-config krb5-doc krb5-user libpam-krb5 krb5-admin-server krb5-kdc Enter your Kerberos realm, select 'nopreauth', and specify where your kerberos servers are (probably the curernt machine) Run the following to set up your kerberos realm: krb5_newrealm This will set up the realm and create an administrative principal called root/admin@ELEMENT.TLA, if your realm is ELEMENT.TLA Alternative: Run the following the set up kerberos (AddToMe) kdb5_util create -r ELEMENT.TLA -s echo "*/admin@ELEMENT.TLA *" > /etc/krb5kdc/kadm5.acl kadmin.local addprinc root/admin@ELEMENT.TLA ktadd -k /etc/krb5kdc/kadm5.keytab kadmin/admin kadmin/changepw quit /etc/init.d/krb5-kdc restart /etc/init.d/krb5-admin-server restart ----- check it works with kinit root/admin then klist -e to list your keys. if you don't have any keys, you've done something wrong. Good luck finding out what :) (but when you do... Wiki the problem/answer on this page) ---- kadmin.local has a whole heap of useful commands letting you add new users/delete users and change passwords. Neat! ---- You might want avoid mixing [MIT] [KerberosV] and [Heimdal] KerberosV in your network, at least if you intend to use kadmin remotely from your KDC; which, of course, you do, it's the [Proper Way], after all. I've found that using Heimdal's kadmin to talk to your MIT KDC will just hang when you try to execute a command. ---- [Microsoft] has an [Interoprability Guide|http://www.microsoft.com/resources/documentation/Windows/XP/all/reskit/en-us/Default.asp?url=/resources/documentation/Windows/XP/all/reskit/en-us/prdp_log_tjil.asp] on their website for setting up Windows 2000 and XP Professional to use interactive logins that use the KDC as the authentication source. Unfortunatly this guide is not complete, it fails to mention that [MIT]'s version of [KerberosV] and [Microsoft]'s implementation only share one enctype in common, namely DES-CBC-CRC. This means that when you add a host principle for a Windows machine you will need to use the "-e des-cbc-crc:normal" option to the ank command. Otherwise Windows will try to use its own RC4-HMAC enctype, which is not (currently) supported by MIT KerberosV; it possibly is supported by [Heimdal] [KerberosV].
One page links to
KerberosNotes
:
AFSNotes
