3.4. Configuring a Kerberos 5 Client
All that is required to set up a Kerberos 5 client is to install the client packages and provide each client with a valid
krb5.conf configuration file. While ssh and slogin are the preferred methods of remotely logging in to client systems, Kerberized versions of rsh and rlogin are still available, with additional configuration changes.
- Be sure that time synchronization is in place between the Kerberos client and the KDC and that DNS is working properly on the Kerberos client.
- Install the
krb5-libsandkrb5-workstationpackages on all of the client machines. - Supply a valid
/etc/krb5.conffile for each client (usually this can be the samekrb5.conffile used by the KDC). - To use kerberized
rshandrloginservices, install thershpackage. - Before a workstation can use Kerberos to authenticate users who connect using
ssh,rsh, orrlogin, it must have its own host principal in the Kerberos database. Thesshd,kshd, andklogindserver programs all need access to the keys for the host service's principal.- Using
kadmin, add a host principal for the workstation on the KDC. The instance in this case is the hostname of the workstation. Use the-randkeyoption for thekadmin'saddprinccommand to create the principal and assign it a random key:addprinc -randkey host/server.example.com
- The keys can be extracted for the workstation by running
kadminon the workstation itself and using thektaddcommand.ktadd -k /etc/krb5.keytab host/server.example.com
- To use other kerberized network services, install the krb5-server package and start the services. The kerberized services are listed in Table 3.3, “Common Kerberized Services”.
| Service Name | Usage Information |
|---|---|
| ssh | OpenSSH uses GSS-API to authenticate users to servers if the client's and server's configuration both have GSSAPIAuthentication enabled. If the client also has GSSAPIDelegateCredentials enabled, the user's credentials are made available on the remote system. |
| rsh and rlogin | Enable klogin, eklogin, and kshell. |
| Telnet | Enable krb5-telnet. |
| FTP | Create and extract a key for the principal with a root of ftp. Be certain to set the instance to the fully qualified hostname of the FTP server, then enable gssftp. |
| IMAP |
The
cyrus-imap package uses Kerberos 5 if it also has the cyrus-sasl-gssapi package installed. The cyrus-sasl-gssapi package contains the Cyrus SASL plugins which support GSS-API authentication. Cyrus IMAP functions properly with Kerberos as long as the cyrus user is able to find the proper key in /etc/krb5.keytab, and the root for the principal is set to imap (created with kadmin).
An alternative to
cyrus-imap can be found in the dovecot package, which is also included in Red Hat Enterprise Linux. This package contains an IMAP server but does not, to date, support GSS-API and Kerberos.
|
| CVS | gserver uses a principal with a root of cvs and is otherwise identical to the CVS pserver. |
