Return to system.mdwn CVS log

Up to [NetBSD Developer Wiki] / wikisrc / kerberos

web commit by cyber

    1: [[!tag kerberos howto]]
    2: 
    3: ## Why enable Kerberos on your system?
    4: 
    5: Convenience and security. With
    6: [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
    7: login grants access to all NetBSD web services. Configuration is easy
    8: and you only have to do it once (sometimes less).
    9: 
   10: 
   11: ## NetBSD
   12: 
   13: NetBSD needs to be configured to prevent Kerberos from being used
   14: to log into _your_ system, and then to enable Kerberos.
   15: 
   16: 7. Either disable Kerberos auth for `sshd`, `login`, etc. in
   17: `/etc/pam.d`, or tell your relevant services not to use PAM.
   18: 
   19:    /!\ Disabling KerberosAuthentication in `/etc/ssh/sshd_config` does **NOT** prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.
   20: 
   21: 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
   22: 
   23: NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
   24: in DNS. To use Kerberized TNF services, log in with your Kerberos
   25: [[password]]:
   26: 
   27:     $ kinit <username>@NETBSD.ORG
   28: 
   29: The right-hand side is a Kerberos realm, not a DNS domain. *Case is significant!*
   30: 
   31: 
   32: ## Mac OS X
   33: 
   34: OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
   35: To use Kerberized TNF services, log in with your Kerberos [[password]]:
   36: 
   37: 7. Launch `Ticket Viewer.app` from `/System/Library/CoreServices`
   38: 
   39: 7. Press the "Add Identity" button
   40: 
   41: 7. In the identity field enter your `<username>@NETBSD.ORG`
   42: 
   43:     The right-hand side is a Kerberos realm, not a DNS domain. *Case is significant!*
   44: 
   45: 7. Enter the password associated with this identity in the password field
   46: 
   47:    By default Ticket Viewer.app will save password details in keychain, un-tick "Remember password in my keychain" if this is not desired behaviour
   48: 
   49: 7. Press continue
   50: 
   51: If successful, you'll be returned to the main window with a new entry below the icons containing `<username>@NETBSD.ORG` and the date and time which the ticket obtained is due to expire.
   52: 
   53: Alternately, from the command line:
   54: 
   55:     koolaid:~ 196> kinit <username>@NETBSD.ORG
   56:     <username>@NETBSD.ORG's Password: 
   57:     koolaid:~ 197> 
   58: 
   59: The klist command will show current tickets.  Additionally, a kinit created entry will show up in Ticket Viewer.app.
   60: 
   61: 
   62: ## Windows XP
   63: 
   64: Windows does not provide an easy way to configure and use KDCs
   65: different from the one embedded into an Active Directory.
   66: 
   67: Therefore, to use [[Kerberos]], you should follow the following
   68: steps:
   69: 
   70: 7. Download the
   71:    [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2)
   72:    installer. It is composed of different tools traditionally found
   73:    with Kerberos distributions, like
   74:    [[!template id=man name=kinit section=1]] or
   75:    [[!template id=man name=klist section=1]], and a Network Identity
   76:    Manager, an application used to manage credential caching of
   77:    Kerberos tickets.
   78: 
   79: 7. Install the package. Use the default provided options, then
   80:    restart the computer.
   81: 
   82: 7. The Network Identity Manager
   83:    [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf)
   84:    should automatically start when you login. As there is no principal
   85:    currently configured, it should open a dialog box to obtain the
   86:    new credentials.
   87: 
   88: 7. Enter your principal:
   89: 
   90:     Username: <username>
   91:     Realm: NETBSD.ORG
   92: 
   93: 7. Click `Ok`. After a few seconds, it should obtain the TGT for
   94:    you from the NETBSD.ORG KDC.