Manually Configuring Kerberos Clients - Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual

Figure 6.3 YaST: Advanced Configuration of a Kerberos Client
For more information about the configuration of Expert PAM Settings and PAM Services
tabs, see the official documentation referenced in Section 6.5, "For More Information"
(page 108) and the manual page man 5 krb5.conf.

Manually Configuring Kerberos Clients

When configuring Kerberos, there are basically two approaches you can take—static
configuration in the /etc/krb5.conf file or dynamic configuration with DNS.
With DNS configuration, Kerberos applications try to locate the KDC services using
DNS records. With static configuration, add the hostnames of your KDC server to krb5
.conf (and update the file whenever you move the KDC or reconfigure your realm
in other ways).
DNS-based configuration is generally a lot more flexible and the amount of configuration
work per machine is a lot less. However, it requires that your realm name is either the
same as your DNS domain or a subdomain of it. Configuring Kerberos via DNS also
creates a minor security issue—an attacker can seriously disrupt your infrastructure
through your DNS (by shooting down the name server, spoofing DNS records, etc.).
However, this amounts to a denial of service at most. A similar scenario applies to the
Network Authentication with Kerberos 97