Enabling Pam Support For Kerberos - Novell LINUX ENTERPRISE SERVER 11 - SECURITY Manual

Services such the SSH daemon read this key and use it to obtain new tickets automati-
cally when needed. The default keytab file resides in /etc/krb5.keytab.
To create a host service principal for jupiter.example.com enter the following
commands during your kadmin session:
kadmin -p newbie/admin
Authenticating as principal newbie/admin@EXAMPLE.COM with password.
Password for newbie/admin@EXAMPLE.COM:
kadmin: addprinc -randkey host/jupiter.example.com
WARNING: no policy specified for host/jupiter.example.com@EXAMPLE.COM;
defaulting to no policy
Principal "host/jupiter.example.com@EXAMPLE.COM" created.
Instead of setting a password for the new principal, the -randkey flag tells kadmin
to generate a random key. This is used here because no user interaction is wanted for
this principal. It is a server account for the machine.
Finally, extract the key and store it in the local keytab file /etc/krb5.keytab.
This file is owned by the superuser, so you must be root to execute the next command
in the kadmin shell:
kadmin: ktadd host/jupiter.example.com
Entry for principal host/jupiter.example.com with kvno 3, encryption type
Triple
DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab.
Entry for principal host/jupiter.example.com with kvno 3, encryption type DES
cbc mode with CRC-32 added to keytab WRFILE:/etc/krb5.keytab.
kadmin:
When completed, make sure that you destroy the admin ticket obtained with kinit above
with kdestroy.

6.4.9 Enabling PAM Support for Kerberos

SUSE® Linux Enterprise Server comes with a PAM module named pam_krb5, which
supports Kerberos login and password update. This module can be used by applications,
such as console login, su, and graphical login applications like KDM, where the user
presents a password and would like the authenticating application to obtain an initial
Kerberos ticket on his behalf. To configure PAM support for Kerberos, use the following
command:
pam-config --add --krb5
Network Authentication with Kerberos 103