Kerberos And Pam - Red Hat ENTERPRISE LINUX 4.5.0 Reference Manual

request a new ticket for that specific service from the TGS. The service ticket is then used to
authenticate the user to that service transparently.
Warning
The Kerberos system can be compromised any time any user on the network
authenticates against a non-kerberized service by sending a password in plain
text. Use of non-kerberized services is discouraged. Such services include
Telnet and FTP. Use of other encrypted protocols, such as SSH or SSL secured
services, however, is acceptable, though not ideal.
This is only a broad overview of how Kerberos authentication works. Those seeking a more
in-depth look at Kerberos authentication should refer to
Note
Kerberos depends on certain network services to work correctly. First, Kerberos
requires approximate clock synchronization between the machines on the
network. Therefore, a clock synchronization program should be set up for the
network, such as
/usr/share/doc/ntp-<version-number>/index.htm
Network Time Protocol servers (replace
number of the
Also, since certain aspects of Kerberos rely on the Domain Name Service (DNS),
be sure that the DNS entries and hosts on the network are all properly
configured. Refer to the Kerberos V5 System Administrator's Guide, provided in
PostScript and HTML formats in
/usr/share/doc/krb5-server-<version-number>
(replace
package installed on the system).

4. Kerberos and PAM

Currently, kerberized services do not make use of Pluggable Authentication Modules (PAM) —
kerberized servers bypass PAM completely. However, applications that use PAM can make use
of Kerberos for authentication if the
installed. The
pam_krb5
and to authenticate users as well as obtain initial credentials using their passwords. If
login gdm
access to network servers is always performed using kerberized services or services that use
GSS-API, such as IMAP, the network can be considered reasonably safe.
. For more about configuring
ntpd
package installed on the system).
ntp
with the version number of the
<version-number>
pam_krb5
package contains sample configuration files that allow services like
Section 7, "Additional
ntpd
<version-number>
for more information
module (provided in the
Kerberos and PAM
Resources".
, refer to
for details on setting up
with the version
krb5-server
package) is
pam_krb5
347