Return to system.mdwn CVS log

Up to [NetBSD Developer Wiki] / wikisrc / kerberos

Initial revision

    1: [[!tag kerberos howto]]
    2: 
    3: #### Why Kerberize your system?
    4: 
    5: Convenience and security. With [Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single login grants access to all NetBSD web services.
    6: 
    7: #### [[!toggle id="macosx" text="Mac OS X"]]
    8: [[!toggleable id="macosx" text="""
    9: OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS. To use Kerberized TNF services, log in with your Kerberos [[password]]:
   10: 
   11: `$ kinit <username>@NETBSD.ORG`
   12: 
   13: The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
   14: """]]
   15: 
   16: #### [[!toggle id="netbsd" text="NetBSD"]]
   17: [[!toggleable id="netbsd" text="""
   18: NetBSD needs to be configured to prevent Kerberos from being used to log into _your_ system, and then to enable Kerberos.
   19: 
   20: 7. Either disable Kerberos auth for `sshd`, `login`, etc. in `/etc/pam.d`, or tell your relevant services not to use PAM.  
   21: (Note that disabling KerberosAuthentication in `/etc/ssh/sshd_config` does NOT prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.)
   22: 7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.
   23: 
   24: NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined in DNS. To use Kerberized TNF services, log in with your Kerberos [[password]]:
   25: 
   26: `$ kinit <username>@NETBSD.ORG`
   27: 
   28: The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!
   29: """]]