Configuration de Kerberos V5
1. Installez les packages krb5-libs, krb5-server et krb5-workstation
2. Modifiez le fichier /etc/krb5.conf et /var/kerberos/krb5kdc/kdc.conf pour refléter votre nom de domaine et les mappages de domaine à domaine. Un domaine simple peut être construit en remplaçant les instances de EXAMPLE.COM et example.com par votre nom de domaine (en veillant à conserver la même casse) et en remplaçant kerberos.example.com par le nom d'hôte complet du serveur.
Par exemple :
# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
ticket_lifetime = 24000
default_realm = UK.ORACLE.COM
[realms]
UK.ORACLE.COM = {
kdc = ukp9174.uk.oracle.com:88
admin_server = ukp9174.uk.oracle.com:749
default_domain = uk.oracle.com
}
[domain_realm]
.uk.oracle.com = UK.ORACLE.COM
uk.oracle.com = UK.ORACLE.COM
[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf
[pam]
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false # cat /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
[realms]
UK.ORACLE.COM = {
master_key_type = des-cbc-crc
database_name = /var/kerberos/krb5kdc/principal
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = des-cbc-crc:normal des3-cbc-raw:normal des3-cbc-sha1:norm
al des-cbc-crc:v4 des-cbc-crc:afs3
kadmind_port = 749
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/dict/words
} 3. Modifiez le fichier /var/kerberos/krb5kdc/kadm5.acl pour déterminer quels principaux ont accès à la base de données Kerberos
# vi /var/kerberos/krb5kdc/kadm5.acl */admin@UK.ORACLE.COM *
4. Créez la base de données Kerberos à l'aide de la commande kdb5_util :
# kdb5_util create -s Initializing database '/var/kerberos/krb5kdc/principal' for realm 'UK.ORACLE.COM', master key name 'K/M@UK.ORACLE.COM' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: admin Re-enter KDC database master key to verify: admin
5. Démarrez les services Kerberos :
# service krb5kdc start Starting Kerberos 5 KDC: [ OK ]
# service kadmin start
Extracting kadm5 Service Keys
Authenticating as principal root/admin@UK.ORACLE.COM with password.
Entry for principal kadmin/admin with kvno 3, encryption type DES cbc mode with CRC-32 added to
keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
Entry for principal kadmin/admin with kvno 3, encryption type Triple DES cbc mode raw added to
keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
Entry for principal kadmin/changepw with kvno 3, encryption type DES cbc mode with CRC-32 added
to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
Entry for principal kadmin/changepw with kvno 3, encryption type Triple DES cbc mode raw added
to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
[ OK ]
Starting Kerberos 5 Admin Server [ OK ] # service krb524 start Starting Kerberos 5-to-4 Server: [ OK ]
6. Ajoutez des principaux Kerberos :
# kadmin.local Authenticating as principal root/admin@UK.ORACLE.COM with password. > kadmin.local: addprinc host/ukp9174.uk.oracle.com WARNING: no policy specified for host/ukp9174.uk.oracle.com@UK.ORACLE.COM; defaulting to no policy Enter password for principal "host/ukp9174.uk.oracle.com@UK.ORACLE.COM": admin Re-enter password for principal "host/ukp9174.uk.oracle.com@UK.ORACLE.COM": admin Principal "host/ukp9174.uk.oracle.com@UK.ORACLE.COM" created.Notez que l'hôte est le mot "hôte" et non le nom d'hôte du serveur et ukp9174.uk.oracle.com est le nom d'hôte complet du serveur.
> kadmin.local: addprinc root WARNING: no policy specified for root@UK.ORACLE.COM; defaulting to no policy Enter password for principal "root@UK.ORACLE.COM": admin Re-enter password for principal "root@UK.ORACLE.COM": admin Principal "root@UK.ORACLE.COM" created.
7. Ajoutez l'hôte au keytab :
# kadmin.local: ktadd -k /etc/krb5.keytab host/ukp9174.uk.oracle.com Entry for principal host/ukp9174.uk.oracle.com with kvno 2, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/ukp9174.uk.oracle.com with kvno 2, encryption type Triple DES cbc mode raw added to keytab WRFILE:/etc/krb5.keytab. > kadmin.local: exit
8. Testez vous pouvez obtenir un ticket :
# kinit Password for root@UK.ORACLE.COM: admin
9. Prouvez que vous avez un ticket :
# klist Ticket cache: FILE:/tmp/krb5cc_0 Default principal: root@UK.ORACLE.COM Valid starting Expires Service principal 01/02/01 11:14:15 01/02/01 21:14:15 krbtgt/UK.ORACLE.COM@UK.ORACLE.COM Kerberos 4 ticket cache: /tmp/tkt0
Une fois que cela fonctionne, vous l'avez configuré correctement.