Diff for /wikisrc/kerberos/system.mdwn between versions 1.1 and 1.3

version 1.1, 2009/10/21 01:06:48 version 1.3, 2009/11/05 03:14:44
Line 1 Line 1
 [[!tag kerberos howto]]  [[!tag kerberos howto]]
   
 #### Why Kerberize your system?  #### Why enable Kerberos on your system?
   
 Convenience and security. With [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single login grants access to all NetBSD web services.  Convenience and security. With
   [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
   login grants access to all NetBSD web services. Configuration is easy
   and you only have to do it once (sometimes less).
   
 #### [[!toggle id="macosx" text="Mac OS X"]]  #### [[!toggle id="macosx" text="Mac OS X"]]
 [[!toggleable id="macosx" text="""  [[!toggleable id="macosx" text="""
 OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS. To use Kerberized TNF services, log in with your Kerberos [[password]]:  OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
   To use Kerberized TNF services, log in with your Kerberos [[password]]:
   
 `$ kinit <username>@NETBSD.ORG`  `$ kinit <username>@NETBSD.ORG`
   
Line 15  The right-hand side is a Kerberos realm, Line 19  The right-hand side is a Kerberos realm,
   
 #### [[!toggle id="netbsd" text="NetBSD"]]  #### [[!toggle id="netbsd" text="NetBSD"]]
 [[!toggleable id="netbsd" text="""  [[!toggleable id="netbsd" text="""
 NetBSD needs to be configured to prevent Kerberos from being used to log into _your_ system, and then to enable Kerberos.  NetBSD needs to be configured to prevent Kerberos from being used
   to log into _your_ system, and then to enable Kerberos.
   
 7. Either disable Kerberos auth for `sshd`, `login`, etc. in `/etc/pam.d`, or tell your relevant services not to use PAM.    7. Either disable Kerberos auth for `sshd`, `login`, etc. in
 (Note that disabling KerberosAuthentication in `/etc/ssh/sshd_config` does NOT prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.)  `/etc/pam.d`, or tell your relevant services not to use PAM.  
   (Note that disabling KerberosAuthentication in `/etc/ssh/sshd_config`
   does NOT prevent `sshd` from invoking `pam_krb5.so` and prompting
   for a Kerberos password -- oops. Since you probably do not have a
   host key in the realm NETBSD.ORG you have little to fear from ssh's
   KerberosAuthentication method -- nothing can get tickets to use
   your machine, because there is no host instance for your machine
   shared between the NetBSD kerberos server and your local keytab.
   So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM
   configuration; don't worry about KerberosAuthentication or
   GSSAPIAuthentication in `sshd` itself.)
 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.  7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
   
 NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined in DNS. To use Kerberized TNF services, log in with your Kerberos [[password]]:  NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
   in DNS. To use Kerberized TNF services, log in with your Kerberos
   [[password]]:
   
 `$ kinit <username>@NETBSD.ORG`  `$ kinit <username>@NETBSD.ORG`
   
 The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!  The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
 """]]  """]]
   
   #### [[!toggle id="windows" text="Windows XP"]]
   [[!toggleable id="windows" text="""
   Windows docs generally assume you want to add your machine to the realm and use Kerberos logins as system logins. This is not what we want.
   
   Progress so far:
   
   7. Download [Windows XP Service Pack 2 Support Tools](http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38).
   7. Install custom/full (whatever it takes to get everything installed).
   7. From the Start menu, choose Run and enter `cmd` to get to the prompt.
   7. `ksetup /AddKdc NETBSD.ORG`
   7. `ksetup /MapUser <username>@NETBSD.ORG "%USERNAME%"`
   
   This may or may not be on the right track. Don't know how to `kinit <username@NETBSD.ORG>` yet.
   """]]

Removed from v.1.1  
changed lines
  Added in v.1.3


CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb