Cisco WS-C6506 Software Manual page 968

Configuring Authentication on the Switch
•
•
•
•
•
•
•
•
Configuring a Kerberos Server
Before you can use Kerberos as an authentication method on the switch, you need to configure the
Kerberos server. You will need to create a database for the KDC and add the switch to the database.
Kerberos authentication requires that NTP is enabled. Additionally, we recommend that you enable
Note
DNS.
To configure the Kerberos server, perform these steps:
Before you can enter the switch in the Kerberos server's key table, you must create the database that the
Step 1
KDC will use. In the following example, a database called CISCO.EDU is created:
/usr/local/sbin/kdb5_util create -r CISCO.EDU -s
Add the switch to the database. The following example adds a switch called Cat6509 to the CISCO.EDU
Step 2
database:
ank host/Cat6509.cisco.edu@CISCO.EDU
Add the username as follows:
Step 3
ank user1@CISCO.EDU
Add the administrative principals as follows:
Step 4
ank user1/admin@CISCO.EDU
Using the admin.local ktadd command, create the database entry for the switch as follows:
Step 5
ktadd host/Cat6509.cisco.edu@CISCO.EDU
Step 6 Move the keytab file to a place where the switch can reach it.
Step 7 Start the KDC server as follows:
/usr/local/sbin/krb5kdc
Catalyst 6500 Series Switch Software Configuration Guide—Release 8.7
39-34
Mapping a Kerberos Realm to a Host Name or DNS Domain, page 39-37
Copying SRVTAB Files, page 39-37
Deleting an SRVTAB Entry, page 39-38
Enabling Credentials Forwarding, page 39-39
Disabling Credentials Forwarding, page 39-40
Defining and Clearing a Private DES Key, page 39-41
Encrypting a Telnet Session, page 39-41
Displaying and Clearing Kerberos Configurations, page 39-42
/usr/local/sbin/kadmind
Chapter 39 Configuring the Switch Access Using AAA
OL-8978-04