1 | <sect2>
|
---|
2 | <title>Configuring Heimdal</title>
|
---|
3 |
|
---|
4 | <sect3><title>Config files</title>
|
---|
5 | <para><filename>/etc/heimdal/*</filename></para>
|
---|
6 | </sect3>
|
---|
7 |
|
---|
8 | <sect3><title>Configuration Information</title>
|
---|
9 |
|
---|
10 | <sect4><title>Master KDC Server Configuration</title>
|
---|
11 |
|
---|
12 | <para>
|
---|
13 | Create the Kerberos configuration file with the following command:
|
---|
14 | </para>
|
---|
15 |
|
---|
16 | <screen><userinput><command>mkdir /etc/heimdal &&
|
---|
17 | cat > /etc/heimdal/krb5.conf << "EOF"</command>
|
---|
18 | # Begin /etc/heimdal/krb5.conf
|
---|
19 |
|
---|
20 | [libdefaults]
|
---|
21 | default_realm = <replaceable>[LFS.ORG]</replaceable>
|
---|
22 | encrypt = true
|
---|
23 |
|
---|
24 | [realms]
|
---|
25 | <replaceable>[LFS.ORG]</replaceable> = {
|
---|
26 | kdc = <replaceable>[belgarath.lfs.org]</replaceable>
|
---|
27 | admin_server = <replaceable>[belgarath.lfs.org]</replaceable>
|
---|
28 | }
|
---|
29 |
|
---|
30 | [domain_realm]
|
---|
31 | .<replaceable>[lfs.org]</replaceable> = <replaceable>[LFS.ORG]</replaceable>
|
---|
32 |
|
---|
33 | [logging]
|
---|
34 | kdc = FILE:/var/log/kdc.log
|
---|
35 | admin_server = FILE:/var/log/kadmin.log
|
---|
36 | default = FILE:/var/log/krb.log
|
---|
37 |
|
---|
38 | # End /etc/heimdal/krb5.conf
|
---|
39 | <command>EOF</command></userinput></screen>
|
---|
40 |
|
---|
41 | <para>
|
---|
42 | You will need to substitute your domain and proper hostname for the
|
---|
43 | occurances of the belgarath and lfs.org names.
|
---|
44 | </para>
|
---|
45 |
|
---|
46 | <para>
|
---|
47 | <userinput>default_realm</userinput> should be the name of your domain changed to ALL CAPS.
|
---|
48 | This isn't required, but both Heimdal and <acronym>MIT</acronym>
|
---|
49 | recommend it.
|
---|
50 | </para>
|
---|
51 |
|
---|
52 | <para>
|
---|
53 | <userinput>encrypt = true</userinput> provides encryption of all traffic between kerberized
|
---|
54 | clients and servers. It's not necessary and can be left off. If you
|
---|
55 | leave it off, you can encrypt all traffic from the client to the server
|
---|
56 | using a switch on the client program instead.
|
---|
57 | </para>
|
---|
58 |
|
---|
59 | <para>
|
---|
60 | The <userinput>[realms]</userinput> parameters tell the client programs where to look for the
|
---|
61 | <acronym>KDC</acronym> authentication services.
|
---|
62 | </para>
|
---|
63 |
|
---|
64 | <para>
|
---|
65 | The <userinput>[domain_realm]</userinput> section maps a domain to a realm.
|
---|
66 | </para>
|
---|
67 |
|
---|
68 | <para>
|
---|
69 | Store the master password in a key file using the following commands:
|
---|
70 | </para>
|
---|
71 |
|
---|
72 | <screen><userinput><command>install -d -m 755 /var/lib/heimdal &&
|
---|
73 | kstash</command></userinput></screen>
|
---|
74 |
|
---|
75 | <para>
|
---|
76 | Create the <acronym>KDC</acronym> database:
|
---|
77 | </para>
|
---|
78 |
|
---|
79 | <screen><userinput><command>kadmin -l</command></userinput></screen>
|
---|
80 |
|
---|
81 | <para>
|
---|
82 | Choose the defaults for now. You can go in later and change the
|
---|
83 | defaults, should you feel the need. At the
|
---|
84 | <userinput>kadmin></userinput> prompt, issue the following statement:
|
---|
85 | </para>
|
---|
86 |
|
---|
87 | <screen><userinput><command>init <replaceable>[LFS.ORG]</replaceable></command></userinput></screen>
|
---|
88 |
|
---|
89 | <para>
|
---|
90 | Now we need to populate the database with principles (users). For now,
|
---|
91 | just use your regular login name or root.
|
---|
92 | </para>
|
---|
93 |
|
---|
94 | <screen><userinput><command>add <replaceable>[loginname]</replaceable></command></userinput></screen>
|
---|
95 |
|
---|
96 | <para>
|
---|
97 | The <acronym>KDC</acronym> server and any machine running kerberized
|
---|
98 | server daemons must have a host key installed:
|
---|
99 | </para>
|
---|
100 |
|
---|
101 | <screen><userinput><command>add --random-key host/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
|
---|
102 |
|
---|
103 | <para>
|
---|
104 | After choosing the defaults when prompted, you will have to export the
|
---|
105 | data to a keytab file:
|
---|
106 | </para>
|
---|
107 |
|
---|
108 | <screen><userinput><command>ext host/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
|
---|
109 |
|
---|
110 | <para>
|
---|
111 | This should have created two files in
|
---|
112 | <filename class="directory">/etc/heimdal</filename>;
|
---|
113 | <filename>krb5.keytab</filename> (Kerberos 5) and
|
---|
114 | <filename>srvtab</filename> (Kerberos 4). Both files should have 600
|
---|
115 | (root rw only) permissions. Keeping the keytab files from public access
|
---|
116 | is crucial to the overall security of the Kerberos installation.
|
---|
117 | </para>
|
---|
118 |
|
---|
119 | <para>
|
---|
120 | Eventually, you'll want to add server daemon principles to the database
|
---|
121 | and extract them to the keytab file. You do this in the same way you
|
---|
122 | created the host principles. Below is an example:
|
---|
123 | </para>
|
---|
124 |
|
---|
125 | <screen><userinput><command>add --random-key ftp/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
|
---|
126 |
|
---|
127 | <para>
|
---|
128 | (choose the defaults)
|
---|
129 | </para>
|
---|
130 |
|
---|
131 | <screen><userinput><command>ext ftp/<replaceable>[belgarath.lfs.org]</replaceable></command></userinput></screen>
|
---|
132 |
|
---|
133 | <para>
|
---|
134 | Exit the <command>kadmin</command> program (use <command>quit</command>
|
---|
135 | or <command>exit</command>) and return back to the shell prompt. Start
|
---|
136 | the <acronym>KDC</acronym> daemon manually, just to test out the
|
---|
137 | installation:
|
---|
138 | </para>
|
---|
139 |
|
---|
140 | <screen><userinput><command>/usr/sbin/kdc &</command></userinput></screen>
|
---|
141 |
|
---|
142 | <para>
|
---|
143 | Attempt to get a ticket with the following command:
|
---|
144 | </para>
|
---|
145 |
|
---|
146 | <screen><userinput><command>kinit <replaceable>[loginname]</replaceable></command></userinput></screen>
|
---|
147 |
|
---|
148 | <para>
|
---|
149 | You will be prompted for the password you created. After you get your
|
---|
150 | ticket, you can list it with the following command:
|
---|
151 | </para>
|
---|
152 |
|
---|
153 | <screen><userinput><command>klist</command></userinput></screen>
|
---|
154 |
|
---|
155 | <para>
|
---|
156 | Information about the ticket should be displayed on the screen.
|
---|
157 | </para>
|
---|
158 |
|
---|
159 | <para>
|
---|
160 | To test the functionality of the keytab file, issue the following
|
---|
161 | command:
|
---|
162 | </para>
|
---|
163 |
|
---|
164 | <screen><userinput><command>ktutil list</command></userinput></screen>
|
---|
165 |
|
---|
166 | <para>
|
---|
167 | This should dump a list of the host principal, along with the encryption
|
---|
168 | methods used to access the principal.
|
---|
169 | </para>
|
---|
170 |
|
---|
171 | <para>
|
---|
172 | At this point, if everything has been successful so far, you can feel
|
---|
173 | fairly confident in the installation and configuration of the package.
|
---|
174 | </para>
|
---|
175 |
|
---|
176 | <para>Install <filename>/etc/rc.d/init.d/heimdal</filename> init script
|
---|
177 | included in the <xref linkend="intro-important-bootscripts"/>
|
---|
178 | package.</para>
|
---|
179 |
|
---|
180 | <screen><userinput><command>make install-heimdal</command></userinput></screen>
|
---|
181 |
|
---|
182 | </sect4>
|
---|
183 |
|
---|
184 | </sect3>
|
---|
185 |
|
---|
186 | </sect2>
|
---|