Using Ldap And Kerberos - Novell LINUX ENTERPRISE SERVER 10 SP2 - INSTALLATION AND ADMINISTRATION Installation Manual

46.11 Using LDAP and Kerberos

When using Kerberos, one way to distribute the user information (such as user ID,
groups,and home directory) in your local network is to use LDAP. This requires a strong
authentication mechanism that prevents packet spoofing and other attacks. One solution
is to use Kerberos for LDAP communication, too.
OpenLDAP implements most authentication flavors through SASL, the simple authen-
tication session layer. SASL is basically a network protocol designed for authentication.
The SASL implementation is cyrus-sasl, which supports a number of different authen-
tication flavors. Kerberos authentication is performed through GSSAPI (General Secu-
rity Services API). By default, the SASL plug-in for GSSAPI is not installed. Install it
manually with rpm -ivh cyrus-sasl-gssapi-*.rpm.
To enable Kerberos to bind to the OpenLDAP server, create a principal
ldap/earth.example.com and add that to the keytab.
By default, the LDAP server slapd runs as user and group ldap, while the keytab file
is readable by root only. Therefore, either change the LDAP configuration so the
server runs as root or make the keytab file readable by the group ldap. The latter is
done automatically by the OpenLDAP start script (/etc/init.d/ldap) if the keytab
file has been specified in the OPENLDAP_KRB5_KEYTAB variable in /etc/
sysconfig/openldap and the OPENLDAP_CHOWN_DIRS variable is set to yes,
which is the default setting. If OPENLDAP_KRB5_KEYTAB is left empty, the default
keytab under /etc/krb5.keytab is used and you must adjust the privileges yourself
as described below.
To run slapd as root, edit /etc/sysconfig/openldap. Disable the
OPENLDAP_USER and OPENLDAP_GROUP variables by putting a comment character
in front of them.
To make the keytab file readable by group LDAP, execute
chgrp ldap /etc/krb5.keytab
chmod 640 /etc/krb5.keytab
Installing and Administering Kerberos 865