Datasheet

“main” (Installation and Administration) — 2004/6/25 — 13:29 — page 669 — #695
i
i
i
i
i
i
i
i
26
Security in the Network
Accepting the defaults by pressing




Enter is okay. Choose a good password,
however.
Next, create another principal named newbie/admin by typing add
newbie/admin at the kadmin prompt. The admin suffixed to your
user name is a role. Later, use this role when administering the Kerberos
database. A user can have several roles for different purposes. Roles are
basically completely different accounts with similar names.
Starting the KDC
Start the KDC daemons. This includes kdc itself (the daemon handling
user authentication and ticket requests), kadmind (the server perform-
ing remote administration), and kpasswddd (handling user’s password
change requests). To start the daemon manually, enter rckdc start. Also
make sure KDC is started by default when the server machine is rebooted
with the command insserv kdc.
26.6.6 Configuring Kerberos Clients
When configuring Kerberos, there are basically two approaches you can
take — static configuration via the /etc/krb5.conf file or dynamic con-
figuration via DNS. With DNS configuration, Kerberos applications try to
locate the KDC services via DNS records. With static configuration, add the
host names of your KDC server to krb5.conf (and update the file when-
ever you move the KDC or reconfigure your realm in other ways).
DNS-based configuration is generally a lot more flexible and the amount
of configuration work per machine is a lot less. However, it requires that
your realm name is either the same as your DNS domain or a subdomain
of it. Configuring Kerberos via DNS also creates a minor security issue —
an attacker can seriously disrupt your infrastructure through your DNS (by
shooting down the name server, by spoofing DNS records, etc). However,
this amounts to a denial of service at most. A similar scenario applies to
the static configuration case unless you enter IP addresses in krb5.conf
instead of host names.
Static Configuration
One way to configure Kerberos is to edit the configuration file /etc/
krb5.conf. The file installed by default contains various sample entries.
Erase all of these entries before starting. krb5.conf is made up of sev-
eral sections, each introduced by the section name included in brackets like
[this].
669SUSE LINUX Enterprise Server