RedHat/CentOS安装和配置kerberos
需要在kerberos server和客户端都先安装ntp (Internet时间协议，保证服务器和客户机时间同步 )
1 kerberos 服务器端
1.1. install /start ntp
#sudo yum install ntp
#sudo service ntpd start
1.2. install kerberos server:
#yum install krb5-server krb5-libs krb5-auth-dialog
可选： install kerberos client:
# yum install krb5-workstation
1.3 Edit /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.conf
# sudo vi /etc/krb5.conf
Replacing EXAMPLE.COM with your domain name.
Replace the kerberos.example.com with your kdc server.
# sudo vi /var/kerberos/krb5kdc/kdc.conf
Replacing EXAMPLE.COM with your domain name.
1.4. create the databse using kdb5_util utility.
# sudo /usr/sbin/kdb5_util create -s
1.5. Edit /var/kerberos/krb5kdc/kadm5.acl file
# sudo vi /var/kerberos/krb5kdc/kadm5.acl file
such as:将 */admin@EXAMPLE.COM * 改为*/admin@MYCOMPANY.COM
1.6. use kadmin.local to add admin user:
#kadmin.local
#addprinc steve/admin
#addprinc tony/admin
1.7. start kerberos:
# /sbin/service krb5kdc start
# /sbin/service kadmin start
1.8. now you can use kadmin to manage principal:
#kadmin -q "addprinc user1/admin"
This way you actaully use client mode to connect to kdc and do admin level task
1.9. verify KDC ok.
#kinit tony/admin
#klist
2 各个客户机端
2.1. install kerberos client
#yum install krb5-workstation
2.2. edit /etc/krb5.conf
#sudo vi /etc/krb5.conf
Replace the EXAMPLE.com with your domain name
replace the kerberos.example.com with your kdc server
2.3. authenticate the admin user with kerberos
#kinit steve/admin
view the principls from client machine:
#sudo kadmin
#list_principals
3 用kerberos进行OS 级本地认证和远程登录
-----------------enable kerbose local authentication----------
1. install pAM
sudo apt-get install libpam-krb5
2. view conf file:
sudo cat /etc/pam.d/common-auth
------------configure the client can remote login using kerborse-----------
1. create another principal such as:
service/clienthost@realm
2. add the keytab for such principal
kadmin : ktadd -k /etc/service.keytab service/clienthost@realm
save the keytab to /etc/krb5.keytab
管理keytab
服务principal的credential需要保存在keytab文件中。
1.获取keytab
进入kadmin
1.1 用ktadd :
ktadd -k $<keytab_file_name> service/servicehost@realm 或者 #ktadd -k $<keytab_file_name> service/servicehost
比如：
# ktadd -k /etc/myservice.keytab myservice/servicehost
1.2 用xst
xst -k $<keytab_file_name> $service/servicehost
2. 查看keytab
klist -k -t $<keytab_file_name>