Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Scaricare il pdf (Pagina 144)

144 Chapter 11. Kerberos

Once you have completed the steps listed above, your Kerberos server should be up and running. Next,

you will need to set up your Kerberos clients.

11.7. Conﬁguring a Kerberos 5 Client

Setting up a Kerberos 5 client is less involved than setting up a server. At minimum, you should install

the client packages and provide your clients with a valid krb5.conf conﬁguration ﬁle. Kerberized

versions of rsh and rlogin will also require some conﬁguration changes.

1. Be sure that you have time synchronization in place between the Kerberos client and KDC.

See Section 11.6 for more information. In addition, DNS should be working properly on the

Kerberos client before installing the Kerberos client programs.

2. Install the krb5-libs and krb5-workstation packages on all of the clients in your realm.

You must supply your own version of /etc/krb5.conf for your client workstations; usually

this can be the same krb5.conf used by the KDC.

3. Before a particular workstation in your realm can allow users to connect using kerberized rsh

and rlogin, that workstation will need to have the xinetd package installed and have its own

host principal in the Kerberos database. The kshd and klogind server programs will also need

access to the keys for their service’s principal.

Using kadmin, add a host principal for the workstation. The instance in this case will be the

hostname of the workstation. Because you will never need to type the password for this principal

again, and you probably do not want to bother with coming up with a good password. You can

use the -randkey option to kadmin’s addprinc command to create the principal and assign it

a random key:

addprinc -randkey host/blah.example.com

Now that you have created the principal, you can extract the keys for the workstation by running

kadmin on the workstation itself , and using the ktadd command within kadmin:

ktadd -k /etc/krb5.keytab host/blah.example.com

In order to use the kerberized versions of rsh and rlogin, you must enable klogin, eklogin,

and kshell.

4. Other kerberized network services will need to be started. To use kerberized telnet, you must

enable krb5-telnet.

To provide FTP access, create and extract a key for a principal with a root of ftp, with the

instance set to the hostname of the FTP server. Then enable gssftp.

The IMAP server included in the imap package will use GSS-API authentication using Kerberos

5 if it ﬁnds the proper key in /etc/krb5.keytab. The root for the principal should be imap.

The CVS gserver uses a principal with a root of cvs and is otherwise identical to a pserver.

That should be all you need to do to set up a simple Kerberos realm.

1. Refer to the chapter titled Controlling Access to Services in the Ofﬁcial Red Hat Linux Customization Guide

for details on enabling services.

1. Refer to the chapter titled Controlling Access to Services in the Ofﬁcial Red Hat Linux Customization Guide

for details on enabling services.

1. Refer to the chapter titled Controlling Access to Services in the Ofﬁcial Red Hat Linux Customization Guide

for details on enabling services.

1 2 ... 139 140 141 142 143 144 145 146 147 148 149 ... 281 282

Nessun commento

Red Hat LINUX 7.2 - OFFICIAL LINUX CUSTOMIZATION GUIDE Guida di Installazione Pagina 144