Este contenido no está disponible en el idioma seleccionado.
3.3. Configuring a Kerberos 5 Server
When setting up Kerberos, install the master KDC first and then install any necessary secondary servers after the master is set up.
3.3.1. Configuring the Master KDC Server
- Ensure that time synchronization and DNS are functioning correctly on all client and server machines before configuring Kerberos.Pay particular attention to time synchronization between the Kerberos server and its clients. If the time difference between the server and client is greater than the configured limit (five minutes by default), Kerberos clients cannot authenticate to the server. This time synchronization is necessary to prevent an attacker from using an old Kerberos ticket to masquerade as a valid user.The NTP documentation is located at
/usr/share/doc/ntp-
version-number/html/index.html
and online at http://www.ntp.org. - Install the
krb5-libs
,krb5-server
, andkrb5-workstation
packages on the dedicated machine which runs the KDC. This machine needs to be very secure — if possible, it should not run any services other than the KDC. - Edit the
/etc/krb5.conf
and/var/kerberos/krb5kdc/kdc.conf
configuration files to reflect the realm name and domain-to-realm mappings. A simple realm can be constructed by replacing instances of EXAMPLE.COM and example.com with the correct domain name — being certain to keep uppercase and lowercase names in the correct format — and by changing the KDC from kerberos.example.com to the name of the Kerberos server. By convention, all realm names are uppercase and all DNS hostnames and domain names are lowercase. The man pages of these configuration files have full details about the file formats. - Create the database using the
kdb5_util
utility./usr/sbin/kdb5_util create -s
Thecreate
command creates the database that stores keys for the Kerberos realm. The-s
argument creates a stash file in which the master server key is stored. If no stash file is present from which to read the key, the Kerberos server (krb5kdc
) prompts the user for the master server password (which can be used to regenerate the key) every time it starts. - Edit the
/var/kerberos/krb5kdc/kadm5.acl
file. This file is used bykadmind
to determine which principals have administrative access to the Kerberos database and their level of access. Most organizations can be accommodated by a single line:*/admin@EXAMPLE.COM *
Most users are represented in the database by a single principal (with a NULL, or empty, instance, such as joe@EXAMPLE.COM). In this configuration, users with a second principal with an instance of admin (for example, joe/admin@EXAMPLE.COM) are able to exert full administrative control over the realm's Kerberos database.Afterkadmind
has been started on the server, any user can access its services by runningkadmin
on any of the clients or servers in the realm. However, only users listed in thekadm5.acl
file can modify the database in any way, except for changing their own passwords.Note
Thekadmin
utility communicates with thekadmind
server over the network, and uses Kerberos to handle authentication. Consequently, the first principal must already exist before connecting to the server over the network to administer it. Create the first principal with thekadmin.local
command, which is specifically designed to be used on the same host as the KDC and does not use Kerberos for authentication. - Create the first principal using
kadmin.local
at the KDC terminal:/usr/sbin/kadmin.local -q "addprinc username/admin"
- Start Kerberos using the following commands:
/sbin/service krb5kdc start /sbin/service kadmin start
- Add principals for the users using the
addprinc
command withinkadmin
.kadmin
andkadmin.local
are command line interfaces to the KDC. As such, many commands — such asaddprinc
— are available after launching thekadmin
program. Refer to thekadmin
man page for more information. - Verify that the KDC is issuing tickets. First, run
kinit
to obtain a ticket and store it in a credential cache file. Next, useklist
to view the list of credentials in the cache and usekdestroy
to destroy the cache and the credentials it contains.Note
By default,kinit
attempts to authenticate using the same system login username (not the Kerberos server). If that username does not correspond to a principal in the Kerberos database,kinit
issues an error message. If that happens, supplykinit
with the name of the correct principal as an argument on the command line:kinit principal
3.3.2. Setting up Secondary KDCs
When there are multiple KDCs for a given realm, one KDC (the master KDC) keeps a writable copy of the realm database and runs
kadmind
. The master KDC is also the realm's admin server. Additional secondary KDCs keep read-only copies of the database and run kpropd
.
The master-slave propagation procedure entails the master KDC dumping its database to a temporary dump file and then transmitting that file to each of its slaves, which then overwrite their previously-received read-only copies of the database with the contents of the dump file.
To set up a secondary KDC:
- Copy the master KDC's
krb5.conf
andkdc.conf
files to the secondary KDC. - Start
kadmin.local
from a root shell on the master KDC.- Use the
kadmin.local add_principal
command to create a new entry for the master KDC's host service. - Use the
kadmin.local ktadd
command to set a random key for the service and store the random key in the master's default keytab file.Note
This key is used by thekprop
command to authenticate to the secondary servers. You will only need to do this once, regardless of how many secondary KDC servers you install.# kadmin.local -r EXAMPLE.COM Authenticating as principal root/admin@EXAMPLE.COM with password. kadmin: add_principal -randkey host/masterkdc.example.com Principal "host/host/masterkdc.example.com@EXAMPLE.COM" created. kadmin: ktadd host/masterkdc.example.com Entry for principal host/masterkdc.example.com with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/masterkdc.example.com with kvno 3, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/masterkdc.example.com with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/masterkdc.example.com with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/krb5.keytab. kadmin: quit
- Start
kadmin
from a root shell on the secondary KDC.- Use the
kadmin add_principal
command to create a new entry for the secondary KDC's host service. - Use the
kadmin ktadd
command to set a random key for the service and store the random key in the secondary KDC server's default keytab file. This key is used by thekpropd
service when authenticating clients.# kadmin -p jsmith/admin@EXAMPLE.COM -r EXAMPLE.COM Authenticating as principal jsmith/admin@EXAMPLE.COM with password. Password for jsmith/admin@EXAMPLE.COM: kadmin: add_principal -randkey host/slavekdc.example.com Principal "host/slavekdc.example.com@EXAMPLE.COM" created. kadmin: ktadd host/slavekdc.example.com@EXAMPLE.COM Entry for principal host/slavekdc.example.com with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/slavekdc.example.com with kvno 3, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/slavekdc.example.com with kvno 3, encryption type DES with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab. Entry for principal host/slavekdc.example.com with kvno 3, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/krb5.keytab. kadmin: quit
- With its service key, the secondary KDC could authenticate any client which would connect to it. Obviously, not all potential clients should be allowed to provide the
kprop
service with a new realm database. To restrict access, thekprop
service on the secondary KDC will only accept updates from clients whose principal names are listed in/var/kerberos/krb5kdc/kpropd.acl
.Add the master KDC's host service's name to that file.# echo host/masterkdc.example.com@EXAMPLE.COM > /var/kerberos/krb5kdc/kpropd.acl
- Once the secondary KDC has obtained a copy of the database, it will also need the master key which was used to encrypt it. If the KDC database's master key is stored in a stash file on the master KDC (typically named
/var/kerberos/krb5kdc/.k5.REALM
), either copy it to the secondary KDC using any available secure method, or create a dummy database and identical stash file on the secondary KDC by runningkdb5_util create -s
and supplying the same password. The dummy database will be overwritten by the first successful database propagation. - Ensure that the secondary KDC's firewall allows the master KDC to contact it using TCP on port 754 (krb5_prop), and start the
kprop
service. - Double-check that the
kadmin
service is disabled. - Perform a manual database propagation test by dumping the realm database on the master KDC to the default data file which the
kprop
command will read (/var/kerberos/krb5kdc/slave_datatrans
).# /usr/sbin/kdb5_util dump /var/kerberos/krb5kdc/slave_datatrans
- Use the
kprop
command to transmit its contents to the secondary KDC.# kprop slavekdc.example.com
- Using
kinit
, verify that the client system is able to correctly obtain the initial credentials from the KDC. The/etc/krb5.conf
for the client should list only the secondary KDC in its list of KDCs. - Create a script which dumps the realm database and runs the
kprop
command to transmit the database to each secondary KDC in turn, and configure thecron
service to run the script periodically.