Annotation of wikisrc/kerberos/system.mdwn, revision 1.10
1.1 schmonz 1: [[!tag kerberos howto]]
2:
1.8 wiki 3: ## Why enable Kerberos on your system?
1.1 schmonz 4:
1.2 schmonz 5: Convenience and security. With
6: [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
1.3 wiki 7: login grants access to all NetBSD web services. Configuration is easy
8: and you only have to do it once (sometimes less).
1.1 schmonz 9:
1.5 schmonz 10:
1.8 wiki 11: ## NetBSD
1.1 schmonz 12:
1.2 schmonz 13: NetBSD needs to be configured to prevent Kerberos from being used
14: to log into _your_ system, and then to enable Kerberos.
1.1 schmonz 15:
1.2 schmonz 16: 7. Either disable Kerberos auth for `sshd`, `login`, etc. in
1.4 wiki 17: `/etc/pam.d`, or tell your relevant services not to use PAM.
18:
19: /!\ Disabling KerberosAuthentication in `/etc/ssh/sshd_config` does **NOT** prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.
20:
1.1 schmonz 21: 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
22:
1.2 schmonz 23: NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
24: in DNS. To use Kerberized TNF services, log in with your Kerberos
25: [[password]]:
1.1 schmonz 26:
1.9 schmonz 27: $ kinit <username>@NETBSD.ORG
1.1 schmonz 28:
29: The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
1.3 wiki 30:
1.8 wiki 31:
1.9 schmonz 32: ## Mac OS X
1.8 wiki 33:
34: OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
35: To use Kerberized TNF services, log in with your Kerberos [[password]]:
36:
1.9 schmonz 37: $ kinit <username>@NETBSD.ORG
1.8 wiki 38:
39: The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
40:
41: ### A Keychain.app trick
42:
43: To pop up a GUI password dialog:
44:
1.9 schmonz 45: $ kinit <username>@NETBSD.ORG </dev/null
1.8 wiki 46:
47: Check "Remember this password in my keychain" to make future Kerberos
48: logins (sans input redirection) prompt-free.
49:
1.10 ! wiki 50: ### Storing the Kerberos Password in Your Keychain
! 51:
! 52: Let us say you have an account "bob" on the realm "NETBSD.ORG" with password "mypasswd". Then in a Terminal type on one single line
! 53:
! 54: security add-generic-password -a "bob" -l "NETBSD.ORG (bob)" -s "NETBSD.ORG" -w "mypasswd" -c "aapl" -T "/usr/bin/kinit"
! 55:
! 56: This will create an item in your default Keychain named "NETBSD.ORG (bob)" with your Kerberos credentials and kinit it will be authorized to access it. You can add as many -T "/fulpath/program" switches as you want, each will give access to the specific program to use your kerberos credentials. For example -T "/Applications/Mail.app/Contents/MacOS/Mail" will add access for Mail.app.
! 57:
! 58: More details with man security.
! 59:
! 60: After that kinit bob@NETBSD.ORG will not prompt you for a password but will get it from the keychain.
! 61:
! 62: (This tip is orignally from [superuser.com](http://superuser.com/questions/360262/integrate-kerberos-and-keychain))
1.8 wiki 63:
64: ## Windows XP
1.3 wiki 65:
1.9 schmonz 66: Windows does not provide an easy way to configure and use KDCs
67: different from the one embedded into an Active Directory.
1.4 wiki 68:
1.9 schmonz 69: Therefore, to use [[Kerberos]], you should follow the following
70: steps:
1.4 wiki 71:
1.9 schmonz 72: 7. Download the
73: [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2)
74: installer. It is composed of different tools traditionally found
75: with Kerberos distributions, like
76: [[!template id=man name=kinit section=1]] or
77: [[!template id=man name=klist section=1]], and a Network Identity
78: Manager, an application used to manage credential caching of
79: Kerberos tickets.
80:
81: 7. Install the package. Use the default provided options, then
82: restart the computer.
83:
84: 7. The Network Identity Manager
85: [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf)
86: should automatically start when you login. As there is no principal
87: currently configured, it should open a dialog box to obtain the
88: new credentials.
1.4 wiki 89:
90: 7. Enter your principal:
91:
1.9 schmonz 92: Username: <username>
93: Realm: NETBSD.ORG
1.3 wiki 94:
1.9 schmonz 95: 7. Click `Ok`. After a few seconds, it should obtain the TGT for
96: you from the NETBSD.ORG KDC.
CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb