Table of Contents
Advertisement
Chapter 19. Kerberos
7. Add principals for the users using the
are command line interfaces to the KDC. As such, many commands are
kadmin.local
available after launching the
information.
8. Verify that the KDC is issuing tickets. First, run
credential cache file. Next, use
to destroy the cache and the credentials it contains.
kdestroy
Note
By default,
username (not the Kerberos server). If that username does not correspond to a
principal in the Kerberos database,
happens, supply
the command line (
Once these steps are completed, the Kerberos server should be up and running.
6. Configuring a Kerberos 5 Client
Setting up a Kerberos 5 client is less involved than setting up a server. At a minimum, install the
client packages and provide each client with a valid
versions of
and
rsh
rlogin
1. Be sure that time synchronization is in place between the Kerberos client and the KDC. Refer
to
Section 5, "Configuring a Kerberos 5 Server"
DNS is working properly on the Kerberos client before configuring the Kerberos client
programs.
2. Install the
krb5-libs
a valid
/etc/krb5.conf
by the KDC).
3. Before a workstation in the realm can allow users to connect using kerberized
, that workstation must have the
rlogin
principal in the Kerberos database. The
access to the keys for their service's principal.
Using
, add a host principal for the workstation on the KDC. The instance in this case
kadmin
is the hostname of the workstation. Use the
command to create the principal and assign it a random key:
addprinc -randkey host/blah.example.com
350
addprinc
program. Refer to the
kadmin
to view the list of credentials in the cache and use
klist
attempts to authenticate using the same system login
kinit
with the name of the correct principal as an argument on
kinit
kinit <principal>
also requires some configuration changes.
and
krb5-workstation
file for each client (usually this can be the same
xinetd
kshd
command with
kadmin
kadmin
to obtain a ticket and store it in a
kinit
issues an error message. If that
kinit
).
configuration file. Kerberized
krb5.conf
for more information. In addition, verify that
packages on all of the client machines. Supply
package installed and have its own host
and
server programs also need
klogind
option for the
-randkey
.
and
kadmin
man page for more
file used
krb5.conf
and
rsh
's
kadmin
addprinc
Advertisement
Table of Contents
