このコンテンツは選択した言語では利用できません。
19.6. Configuring a Kerberos 5 Client
Setting up a Kerberos 5 client is less involved than setting up a server. At a minimum, install the client packages and provide each client with a valid
krb5.conf
configuration file. Kerberized versions of rsh
and rlogin
also requires some configuration changes.
- Be sure that time synchronization is in place between the Kerberos client and the KDC. Refer to Section 19.5, “Configuring a Kerberos 5 Server” for more information. In addition, verify that DNS is working properly on the Kerberos client before configuring the Kerberos client programs.
- Install the
krb5-libs
andkrb5-workstation
packages on all of the client machines. Supply a valid/etc/krb5.conf
file for each client (usually this can be the samekrb5.conf
file used by the KDC). - Before a workstation in the realm can allow users to connect using kerberized
rsh
andrlogin
, that workstation must have thexinetd
package installed and have its own host principal in the Kerberos database. Thekshd
andklogind
server programs also need access to the keys for their service's principal.Usingkadmin
, add a host principal for the workstation on the KDC. The instance in this case is the hostname of the workstation. Use the-randkey
option for thekadmin
'saddprinc
command to create the principal and assign it a random key:addprinc -randkey host/blah.example.com
Now that the principal has been created, keys can be extracted for the workstation by runningkadmin
on the workstation itself, and using thektadd
command withinkadmin
:ktadd -k /etc/krb5.keytab host/blah.example.com
- To use other kerberized network services, they must first be started. Below is a list of some common kerberized services and instructions about enabling them:
rsh
andrlogin
— To use the kerberized versions ofrsh
andrlogin
, enableklogin
,eklogin
, andkshell
.- Telnet — To use kerberized Telnet,
krb5-telnet
must be enabled. - FTP — To provide FTP access, create and extract a key for the principal with a root of
ftp
. Be certain to set the instance to the fully qualified hostname of the FTP server, then enablegssftp
. - IMAP — To use a kerberized IMAP server, the
cyrus-imap
package uses Kerberos 5 if it also has thecyrus-sasl-gssapi
package installed. Thecyrus-sasl-gssapi
package contains the Cyrus SASL plugins which support GSS-API authentication. Cyrus IMAP should function properly with Kerberos as long as thecyrus
user is able to find the proper key in/etc/krb5.keytab
, and the root for the principal is set toimap
(created withkadmin
).Thedovecot
package also contains an IMAP server alternative tocyrus-imap
, which is also included with Red Hat Enterprise Linux, but does not support GSS-API and Kerberos to date. - CVS — To use a kerberized CVS server,
gserver
uses a principal with a root ofcvs
and is otherwise identical to the CVSpserver
.
For details about how to enable services, refer to the chapter titled Controlling Access to Services in the System Administrators Guide.