Configuring Kerberos Authentication - Cisco WS-X6066-SLB-APC - Content Switching Module Software Manual

Chapter 21 Configuring Switch Access Using AAA

Configuring Kerberos Authentication

These sections describe how to configure Kerberos authentication on the switch.
•
•
•
•
•
•
•
•
•
•
•
•
Configuring a Kerberos Server
Before you can use Kerberos as an authentication method on the switch, you need to configure the
Kerberos server. You will need to create a database for the KDC and add the switch to the database.
Note Kerberos authentication requires that NTP is enabled. Additionally, we recommend that you enable
DNS.
To configure the Kerberos server, perform this procedure:
Before you can enter the switch in the Kerberos server's key table, you must create the database the KDC
Step 1
will use. In the following example, a database called CISCO.EDU is created:
/usr/local/sbin/kdb5_util create -r CISCO.EDU -s
Add the switch to the database. The following example adds a switch called Cat6509 to the CISCO.EDU
Step 2
database:
ank host/Cat6509.cisco.edu@CISCO.EDU
Step 3 Add the username as follows:
ank user1@CISCO.EDU
Add the administrative principals as follows:
Step 4
ank user1/admin@CISCO.EDU
Using the admin.local ktadd command, create the database entry for the switch as follows:
Step 5
ktadd host/Cat6509.cisco.edu@CISCO.EDU
Move the keytab file to a place where the switch can reach it.
Step 6
78-13315-02
Configuring a Kerberos Server, page 21-31
Enabling Kerberos, page 21-32
Defining the Kerberos Local Realm, page 21-33
Specifying a Kerberos Server, page 21-33
Mapping a Kerberos Realm to a Host Name or DNS Domain, page 21-34
Copying SRVTAB Files, page 21-34
Deleting an SRVTAB Entry, page 21-35
Enabling Credentials Forwarding, page 21-36
Disabling Credentials Forwarding, page 21-37
Defining and Clearing a Private DES Key, page 21-38
Encrypting a Telnet Session, page 21-38
Displaying and Clearing Kerberos Configurations, page 21-39
Catalyst 6000 Family Software Configuration Guide—Releases 6.3 and 6.4
Configuring Authentication
21-31