Chapter 2. Kerberos

Installing a Kerberos Server

Installing a Kerberos Server

To use NFSv4 with Kerberos authentication, we need a Kerberos server. Because we may later switch to a Novell Kerberos server, and Novell seems to ship Heimdal, we use Heimdal, on Debian Lenny.

If you wish to use a different Linux distribution, or a different UNIX, there is excellent documentation on the MIT.edu site. You probably want to read the part on installation.

But since the Heimdal and MIT implementations differ in details, I fall back on the more elaborate MIT docs if necessary, sticking first to the Heimdal-specific documentation on the Heimdal site, in particular on building and installing.

Procedure 2.1. Installation of a Kerberos server on Ubuntu Lucid

	Note
	On Ubuntu, you may have to loosen security a bit and do sudo ufw disable before you proceed. We are using Debian Lenny, which comes with no iptables rules enabled by default.

Preconfiguring the Heimdal packages
Create a file debconf-kerberos-settings containing this:
# Kerberos servers for your realm: krb5-config krb5-config/kerberos_servers string krbserver.mydomain.com # Default Kerberos version 5 realm: krb5-config krb5-config/default_realm string MYDOMAIN.COM # Local realm name: heimdal-kdc heimdal/realm string MYDOMAIN.COM # Administrative server for your Kerberos realm: krb5-config krb5-config/admin_server string krbserver.mydomain.com # Does DNS contain pointers to your realm's Kerberos Servers? krb5-config krb5-config/dns_for_default boolean false # Add locations of default Kerberos servers to /etc/krb5.conf? krb5-config krb5-config/add_servers boolean true

This is the hostname of the Kerberos server, the machine we are configuring. We 've got only one at this stage, which is to be KDC as well as Administration server.

By convention, the Kerberos domain is identical to the uppercased domain name.
Now tell debconf about these settings:

apprentice@krbserver:~$ cat debconf-kerberos-settings |sudo debconf-set-selections apprentice@krbserver:~$

Installing the packages

	Warning
	On Ubuntu Lucid, bug #579127 causes a hanging `debconf`, which you will have to kill. After that, doing an uninstall (without purge) and then another install of `heimdal-kdc` will suffice.

	Note
	Because we preseeded the package, it is not necessary to initialize the `realm` MYDOMAIN.COM.

Adding an admin principal

apprentice@krbserver:~$ sudo kadmin -l kadmin> add apprentice/admin@MYDOMAIN.COM Max ticket life [1 day]: Max renewable life [1 week]: Principal expiration time [never]: Password expiration time [never]: Attributes []: apprentice/admin@MYDOMAIN.COM's Password: Verifying - apprentice/admin@MYDOMAIN.COM's Password: kadmin> quit apprentice@krbserver:~$
Granting admin access to the newly created principal
(Re)start the services

apprentice@krbserver:~$ sudo /etc/init.d/openbsd-inetd start apprentice@krbserver:~$ sudo /etc/init.d/heimdal-kdc restart Stopping Heimdal password server: kpasswdd. Stopping Heimdal KDC: heimdal-kdc. Starting Heimdal KDC: heimdal-kdc. Starting Heimdal password server: kpasswdd. apprentice@krbserver:~$
Creating a Kerberos principal for a user

apprentice@krbserver:~$ /usr/sbin/kadmin kadmin> add joeuser@MYDOMAIN.COM apprentice/admin@MYDOMAIN.COM's Password: Max ticket life [1 day]: Max renewable life [1 week]: Principal expiration time [never]: Password expiration time [never]: Attributes []: joeuser@MYDOMAIN.COM's Password: Verifying - joeuser@MYDOMAIN.COM's Password: kadmin> list * default joeuser apprentice/admin kadmin/admin kadmin/hprop krbtgt/MYDOMAIN.COM kadmin/changepw changepw/kerberos kadmin> quit apprentice@krbserver:~$

Note
This time, we ran kadmin without the -l switch, and without sudo, and still it worked. This also goes to show that the kadmind works, at least for the localhost.

	This is the hostname of the Kerberos server, the machine we are configuring. We 've got only one at this stage, which is to be KDC as well as Administration server.
	By convention, the Kerberos domain is identical to the uppercased domain name.

	Note
	This time, we ran `kadmin` without the -l switch, and without sudo, and still it worked. This also goes to show that the `kadmind` works, at least for the `localhost`.


Outline		Chapter 3. NFS