File:  [NetBSD Developer Wiki] / wikisrc / kerberos / system.mdwn
Revision 1.9: download - view: text, annotated - select for diffs
Sat Feb 16 13:48:16 2013 UTC (13 months, 4 weeks ago) by schmonz
Branches: MAIN
CVS tags: HEAD
Improve formatting, wrap long lines.

[[!tag kerberos howto]]

## Why enable Kerberos on your system?

Convenience and security. With
[Kerberos](http://web.mit.edu/Kerberos/dialogue.html), a single
login grants access to all NetBSD web services. Configuration is easy
and you only have to do it once (sometimes less).


## NetBSD

NetBSD needs to be configured to prevent Kerberos from being used
to log into _your_ system, and then to enable Kerberos.

7. Either disable Kerberos auth for `sshd`, `login`, etc. in
`/etc/pam.d`, or tell your relevant services not to use PAM.

   /!\ Disabling KerberosAuthentication in `/etc/ssh/sshd_config` does **NOT** prevent `sshd` from invoking `pam_krb5.so` and prompting for a Kerberos password -- oops. Since you probably do not have a host key in the realm NETBSD.ORG you have little to fear from ssh's KerberosAuthentication method -- nothing can get tickets to use your machine, because there is no host instance for your machine shared between the NetBSD kerberos server and your local keytab. So, the bottom line: turn off UsePAM for `sshd` or adjust your PAM configuration; don't worry about KerberosAuthentication or GSSAPIAuthentication in `sshd` itself.

7. Create `/etc/krb5.conf` containing only the line `[libdefaults]`.

NetBSD will now autodiscover and uses the NETBSD.ORG KDC as defined
in DNS. To use Kerberized TNF services, log in with your Kerberos
[[password]]:

    $ kinit <username>@NETBSD.ORG

The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!


## Mac OS X

OS X autodiscovers and uses the NETBSD.ORG KDC as defined in DNS.
To use Kerberized TNF services, log in with your Kerberos [[password]]:

    $ kinit <username>@NETBSD.ORG

The right-hand side is a Kerberos realm, not a DNS domain. Case is significant!

### A Keychain.app trick

To pop up a GUI password dialog:

    $ kinit <username>@NETBSD.ORG </dev/null

Check "Remember this password in my keychain" to make future Kerberos
logins (sans input redirection) prompt-free.


## Windows XP

Windows does not provide an easy way to configure and use KDCs
different from the one embedded into an Active Directory.

Therefore, to use [[Kerberos]], you should follow the following
steps:

7. Download the
   [MIT Kerberos for Windows](http://web.mit.edu/Kerberos/dist/#kfw-3.2)
   installer. It is composed of different tools traditionally found
   with Kerberos distributions, like
   [[!template id=man name=kinit section=1]] or
   [[!template id=man name=klist section=1]], and a Network Identity
   Manager, an application used to manage credential caching of
   Kerberos tickets.

7. Install the package. Use the default provided options, then
   restart the computer.

7. The Network Identity Manager
   [(PDF)](http://web.mit.edu/kerberos/kfw-3.2/kfw-3.2.2/netidmgr_userdoc.pdf)
   should automatically start when you login. As there is no principal
   currently configured, it should open a dialog box to obtain the
   new credentials.

7. Enter your principal:

    Username: <username>
    Realm: NETBSD.ORG

7. Click `Ok`. After a few seconds, it should obtain the TGT for
   you from the NETBSD.ORG KDC.

CVSweb for NetBSD wikisrc <wikimaster@NetBSD.org> software: FreeBSD-CVSweb