Return to system.mdwn CVS log

Up to [NetBSD Developer Wiki] / wikisrc / kerberos

Annotation of wikisrc/kerberos/system.mdwn, revision 1.14

1.1       schmonz     1: [[!tag kerberos howto]]
                      2: 
1.8       wiki        3: ## Why enable Kerberos on your system?
1.1       schmonz     4: 
1.2       schmonz     5: Convenience and security. With
                      6: [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
1.3       wiki        7: login grants access to all NetBSD web services. Configuration is easy
                      8: and you only have to do it once (sometimes less).
1.1       schmonz     9: 
1.5       schmonz    10: 
1.8       wiki       11: ## NetBSD
1.1       schmonz    12: 
1.2       schmonz    13: NetBSD needs to be configured to prevent Kerberos from being used
                     14: to log into _your_ system, and then to enable Kerberos.
1.1       schmonz    15: 
1.2       schmonz    16: 7. Either disable Kerberos auth for `sshd`, `login`, etc. in
1.4       wiki       17: `/etc/pam.d`, or tell your relevant services not to use PAM.
                     18: 
                     19:    /!\ Disabling KerberosAuthentication in `/etc/ssh/sshd_config` does **NOT** prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.
                     20: 
1.1       schmonz    21: 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
                     22: 
1.2       schmonz    23: NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
                     24: in DNS. To use Kerberized TNF services, log in with your Kerberos
                     25: [[password]]:
1.1       schmonz    26: 
1.9       schmonz    27:     $ kinit <username>@NETBSD.ORG
1.1       schmonz    28: 
1.12      wiki       29: The right-hand side is a Kerberos realm, not a DNS domain. *Case is significant!*
1.3       wiki       30: 
1.8       wiki       31: 
1.9       schmonz    32: ## Mac OS X
1.8       wiki       33: 
                     34: OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
                     35: To use Kerberized TNF services, log in with your Kerberos [[password]]:
                     36: 
1.13      wiki       37: 7. Launch `Ticket Viewer.app` from `/System/Library/CoreServices`
1.8       wiki       38: 
1.11      wiki       39: 7. Press the "Add Identity" button
1.8       wiki       40: 
1.11      wiki       41: 7. In the identity field enter your `<username>@NETBSD.ORG`
1.8       wiki       42: 
1.11      wiki       43:     The right-hand side is a Kerberos realm, not a DNS domain. *Case is significant!*
1.8       wiki       44: 
1.11      wiki       45: 7. Enter the password associated with this identity in the password field
1.8       wiki       46: 
1.11      wiki       47:    By default Ticket Viewer.app will save password details in keychain, un-tick "Remember password in my keychain" if this is not desired behaviour
1.8       wiki       48: 
1.11      wiki       49: 7. Press continue
1.10      wiki       50: 
1.13      wiki       51: If successful, you'll be returned to the main window with a new entry below the icons containing `<username>@NETBSD.ORG` and the date and time which the ticket obtained is due to expire.
1.8       wiki       52: 
1.14    ! wiki       53: Alternately, from the command line:
        !            54: 
        !            55:     koolaid:~ 196> kinit <username>@NETBSD.ORG
        !            56:     <username>@NETBSD.ORG's Password: 
        !            57:     koolaid:~ 197> 
        !            58: 
        !            59: The klist command will show current tickets.  Additionally, a kinit created entry will show up in Ticket Viewer.app.
        !            60: 
        !            61: 
1.8       wiki       62: ## Windows XP
1.3       wiki       63: 
1.9       schmonz    64: Windows does not provide an easy way to configure and use KDCs
                     65: different from the one embedded into an Active Directory.
1.4       wiki       66: 
1.9       schmonz    67: Therefore, to use [[Kerberos]], you should follow the following
                     68: steps:
1.4       wiki       69: 
1.9       schmonz    70: 7. Download the
                     71:    [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2)
                     72:    installer. It is composed of different tools traditionally found
                     73:    with Kerberos distributions, like
                     74:    [[!template id=man name=kinit section=1]] or
                     75:    [[!template id=man name=klist section=1]], and a Network Identity
                     76:    Manager, an application used to manage credential caching of
                     77:    Kerberos tickets.
                     78: 
                     79: 7. Install the package. Use the default provided options, then
                     80:    restart the computer.
                     81: 
                     82: 7. The Network Identity Manager
                     83:    [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf)
                     84:    should automatically start when you login. As there is no principal
                     85:    currently configured, it should open a dialog box to obtain the
                     86:    new credentials.
1.4       wiki       87: 
                     88: 7. Enter your principal:
                     89: 
1.9       schmonz    90:     Username: <username>
                     91:     Realm: NETBSD.ORG
1.3       wiki       92: 
1.9       schmonz    93: 7. Click `Ok`. After a few seconds, it should obtain the TGT for
                     94:    you from the NETBSD.ORG KDC.