krb5.conf configuration file. Kerberized versions of rsh and rlogin will also require some configuration changes.
Be sure that you have time synchronization in place between the Kerberos client and the KDC. See Section 17.5 Configuring a Kerberos 5 Server
Install the krb5-libs and krb5-workstation packages on all of the client machines. You must supply a version of /etc/krb5.conf for each client; usually this can be the same krb5.conf file used by the KDC.
Before a workstation in the realm can allow users to connect using kerberized rsh and rlogin, that workstation will need to have the xinetd package installed and have its own host principal in the Kerberos database. The kshd and klogind server programs will also need access to the keys for their service's principal.
Using kadmin-randkey option to kadmin's addprinc command to create the principal and assign it a random key:
addprinc -randkey host/blah.example.com |
Now that you have created the principal, you can extract the keys for the workstation by running kadmin on the workstation itself, and using the ktadd command within kadmin:
ktadd -k /etc/krb5.keytab host/blah.example.com |
rsh and rlogin — In order to use the kerberized versions of rsh and rlogin, you must enable klogin, eklogin, and kshell.
Telnet — To use kerberized Telnet, you must enable krb5-telnet.
FTP — To provide FTP access, create and extract a key for the principal with a root of ftp. Be certain to set the instance to the fully qualified hostname of the FTP server, then enable gssftp.
IMAP — The IMAP server included in the imap package will use GSS-API authentication using Kerberos 5 if it finds the proper key in /etc/krb5.keytab. The root for the principal should be imap.
CVS — CVS's kerberized gserver uses a principal with a root of cvs and is otherwise identical to the CVS pserver.
For details on enabling services, refer to the chapter titled Controlling Access to Services in the Red Hat Linux Customization Guide.
| Главная |