PAM Kerberos Release Note, HP 9000 Networking

18 Chapter1

PAM Kerberos Release Note

Conﬁguration

klogin 543/tcp # Kerberos rlogin -kfall

kshell 544/tcp cmd # Kerberos remote shell

kerberos-adm 749/tcp # Kerberos 5 admin/changepw

kerberos-adm 749/udp # Kerberos 5 admin/changepw

krb5_prop 754/tcp # Kerberos slave propagation

eklogin 2105/tcp # Kerberos encrypted rlogin

krb524 4444/tcp # Kerberos 5 to 4 ticket translator

kerberos-adm 464/udp # Kerberos Password Change protocol

kerberos-adm 464/tcp # Kerberos Password Change protocol

See the services (4) man page for additional information.

• /usr/local/var/krb5kdc/kdc.conf

The kdc.conf ﬁle contains KDC conﬁguration information, including the ﬁle locations of

database and keytab ﬁle and defaults used when issuing Kerberos tickets.

Create a kdc.conf ﬁle using the sample listed under Appendix C . Replace the underlined

REALM.HP.COM and hostname.hp.com with the name of your Kerberos realm and

hostname.

Modify the default values for maximum life and maximum renewable life if necessary.

For further information, refer to the DCE white paper, Using HP DCE 9000 and

Praesidium /Security Service with MIT Kerberos Applications,

/opt/dce/newcconﬁg/RelNotes/krbWhitePaper.ps on HP-UX 11.0 and Kerberos

documentation listed in “References”.

Application Server (a.k.a. Kerberos Client)

An application server node is a node where application servers, such as telnetd or ftpd, will be

run. The Application Server requires proper conﬁguration of the following ﬁles:

• /etc/pam.conf

The behavior of the PAM modules is controlled by the conﬁguration ﬁle /etc/pam.conf.It

speciﬁes the PAM modules for each of the services and how they can be stacked in a

system. The pam.conf ﬁle contains a listing of services. Each service is paired with a

corresponding service module. When a service is requested, its associated module is

invoked. HP-UX system entry services including but not limited to login, rlogin, telnet,

ftp, passwd, and su use PAM and the appropriate entry should be included for each of

these in the /etc/pam.conf ﬁle at the application server.

Each entry has the following format:

service_name module_type control_flag module_path options

For example: