48.6.5. Configuring a Kerberos 5 Server
- Ensure that time synchronization and DNS are functioning correctly on all client and server machines before configuring Kerberos. Pay particular attention to time synchronization between the Kerberos server and its clients. If the time difference between the server and client is greater than five minutes (this is configurable in Kerberos 5), Kerberos clients can not authenticate to the server. This time synchronization is necessary to prevent an attacker from using an old Kerberos ticket to masquerade as a valid user.It is advisable to set up a Network Time Protocol (NTP) compatible client/server network even if Kerberos is not being used. Red Hat Enterprise Linux includes the
ntppackage for this purpose. Refer to
/usr/share/doc/ntp-<version-number>/index.html(where <version-number> is the version number of the
ntppackage installed on your system) for details about how to set up Network Time Protocol servers, and http://www.ntp.org for more information about NTP.
- Install the
krb5-workstationpackages on the dedicated machine which runs the KDC. This machine needs to be very secure — if possible, it should not run any services other than the KDC.
- Edit the
/var/kerberos/krb5kdc/kdc.confconfiguration files to reflect the realm name and domain-to-realm mappings. A simple realm can be constructed by replacing instances of EXAMPLE.COM and example.com with the correct domain name — being certain to keep uppercase and lowercase names in the correct format — and by changing the KDC from kerberos.example.com to the name of the Kerberos server. By convention, all realm names are uppercase and all DNS hostnames and domain names are lowercase. For full details about the formats of these configuration files, refer to their respective man pages.
- Create the database using the
kdb5_utilutility from a shell prompt:
/usr/kerberos/sbin/kdb5_util create -sThe
createcommand creates the database that stores keys for the Kerberos realm. The
-sswitch forces creation of a stash file in which the master server key is stored. If no stash file is present from which to read the key, the Kerberos server (
krb5kdc) prompts the user for the master server password (which can be used to regenerate the key) every time it starts.
- Edit the
/var/kerberos/krb5kdc/kadm5.aclfile. This file is used by
kadmindto determine which principals have administrative access to the Kerberos database and their level of access. Most organizations can get by with a single line:
*/admin@EXAMPLE.COM *Most users are represented in the database by a single principal (with a NULL, or empty, instance, such as joe@EXAMPLE.COM). In this configuration, users with a second principal with an instance of admin (for example, joe/admin@EXAMPLE.COM) are able to wield full power over the realm's Kerberos database.After
kadmindhas been started on the server, any user can access its services by running
kadminon any of the clients or servers in the realm. However, only users listed in the
kadm5.aclfile can modify the database in any way, except for changing their own passwords.
kadminutility communicates with the
kadmindserver over the network, and uses Kerberos to handle authentication. Consequently, the first principal must already exist before connecting to the server over the network to administer it. Create the first principal with the
kadmin.localcommand, which is specifically designed to be used on the same host as the KDC and does not use Kerberos for authentication.Type the following
kadmin.localcommand at the KDC terminal to create the first principal:
/usr/kerberos/sbin/kadmin.local -q "addprinc username/admin"
- Start Kerberos using the following commands:
service krb5kdc start
service kadmin start
service krb524 start
- Add principals for the users using the
kadmin.localare command line interfaces to the KDC. As such, many commands — such as
addprinc— are available after launching the
kadminprogram. Refer to the
kadminman page for more information.
- Verify that the KDC is issuing tickets. First, run
kinitto obtain a ticket and store it in a credential cache file. Next, use
klistto view the list of credentials in the cache and use
kdestroyto destroy the cache and the credentials it contains.
kinitattempts to authenticate using the same system login username (not the Kerberos server). If that username does not correspond to a principal in the Kerberos database,
kinitissues an error message. If that happens, supply
kinitwith the name of the correct principal as an argument on the command line (