Diff for /wikisrc/kerberos/system.mdwn between versions 1.3 and 1.7

version 1.3, 2009/11/05 03:14:44 version 1.7, 2011/08/06 00:09:47
Line 15  To use Kerberized TNF services, log in w Line 15  To use Kerberized TNF services, log in w
 `$ kinit <username>@NETBSD.ORG`  `$ kinit <username>@NETBSD.ORG`
   
 The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!  The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
   
   ##### A Keychain.app trick
   
   To pop up a GUI password dialog:
   
   `$ kinit <username>@NETBSD.ORG </dev/null`
   
   Check "Remember this password in my keychain" to make future Kerberos
   logins (sans input redirection) prompt-free.
 """]]  """]]
   
 #### [[!toggle id="netbsd" text="NetBSD"]]  #### [[!toggle id="netbsd" text="NetBSD"]]
Line 23  NetBSD needs to be configured to prevent Line 32  NetBSD needs to be configured to prevent
 to log into _your_ system, and then to enable Kerberos.  to log into _your_ system, and then to enable Kerberos.
   
 7. Either disable Kerberos auth for `sshd`, `login`, etc. in  7. Either disable Kerberos auth for `sshd`, `login`, etc. in
 `/etc/pam.d`, or tell your relevant services not to use PAM.    `/etc/pam.d`, or tell your relevant services not to use PAM.
 (Note that disabling KerberosAuthentication in `/etc/ssh/sshd_config`  
 does NOT prevent `sshd` from invoking `pam_krb5.so` and prompting     /!\ Disabling KerberosAuthentication in `/etc/ssh/sshd_config` does **NOT** prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.
 for a Kerberos password -- oops. Since you probably do not have a  
 host key in the realm NETBSD.ORG you have little to fear from ssh's  
 KerberosAuthentication method -- nothing can get tickets to use  
 your machine, because there is no host instance for your machine  
 shared between the NetBSD kerberos server and your local keytab.  
 So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM  
 configuration; don't worry about KerberosAuthentication or  
 GSSAPIAuthentication in `sshd` itself.)  
 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.  7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
   
 NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined  NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
Line 47  The right-hand side is a Kerberos realm, Line 49  The right-hand side is a Kerberos realm,
   
 #### [[!toggle id="windows" text="Windows XP"]]  #### [[!toggle id="windows" text="Windows XP"]]
 [[!toggleable id="windows" text="""  [[!toggleable id="windows" text="""
 Windows docs generally assume you want to add your machine to the realm and use Kerberos logins as system logins. This is not what we want.  
   
 Progress so far:  Windows does not provide an easy way to configure and use KDCs different from the one embedded into an Active Directory.
   
   Therefore, to use [[Kerberos]], you should follow the following steps:
   
   7. Download the [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2) installer. It is composed of different tools traditionally found with Kerberos distributions, like [[!template id=man name=kinit section=1]] or [[!template id=man name=klist section=1]], and a Network Identity Manager, an application used to manage credential caching of Kerberos tickets.
   
   7. Install the package. Use the default provided options, then restart the computer.
   
   7. The Network Identity Manager [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf) should automatically start when you login. As there is no principal currently configured, it should open a dialog box to obtain the new credentials.
   
   7. Enter your principal:
   
           Username: <username>
           Realm: NETBSD.ORG
   
 7. Download [Windows XP Service Pack 2 Support Tools](http://www.microsoft.com/downloads/details.aspx?FamilyId=49AE8576-9BB9-4126-9761-BA8011FABF38).  7. Click `Ok`. After a few seconds, it should obtain the TGT for you from NetBSD.ORG KDC.
 7. Install custom/full (whatever it takes to get everything installed).  
 7. From the Start menu, choose Run and enter `cmd` to get to the prompt.  
 7. `ksetup /AddKdc NETBSD.ORG`  
 7. `ksetup /MapUser <username>@NETBSD.ORG "%USERNAME%"`  
   
 This may or may not be on the right track. Don't know how to `kinit <username@NETBSD.ORG>` yet.  
 """]]  """]]

Removed from v.1.3  
changed lines
  Added in v.1.7


CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb