How to install and
configure kerbores for ssh authentication
Time should be in
synchoroes between server and clients . Ticket is time based .
All variables are
case senstive
In server :
Server Hostname :
master
1.
Install krb packages
yum install
krb5-server krb5-libs krb5-auth-dialog
yum install
krb5-pkinit-openssl
2.
Edit kdc.conf & kadm5.acl files
Location
: /var/kerberos/krb5kdc/
Currently
only kdc.conf & kadm5.acl files located here
cd
/var/kerberos/krb5kdc/
vi kdc.conf
Change
EXAMPLE.COM to your relam
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
COMPANY.COM= {
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal
des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal
des-cbc-md5:normal des-cbc-crc:normal
}
3.
vi
kadm5.acl
Edit
*/admin@COMPANY.COM *
*/admin@COMPANY.COM *
4.
Edit krb5.conf
Location
: /etc/
vi /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = COMPANY.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
COMPANY.COM = {
kdc = master.COMPANY.COM
admin_server = master.COMPANY.COM
}
[domain_realm]
.COMPANY.COM = COMPANY.COM
COMPANY.COM = COMPANY.COM
5.
Create Kerbores Database
cd /var/kerberos/krb5kdc/
kdb5_util create -s -r COMPANY.COM
Provide
username/password
Loading random
data
Initializing
database '/var/kerberos/krb5kdc/principal' for realm 'COMPANY.COM',
master key name
'K/M@COMPANY.COM'
You will be
prompted for the database Master Password.
It is important
that you NOT FORGET this password.
Enter KDC
database master key:
Re-enter KDC
database master key to verify:
kdb5_util: File
exists while creating database '/var/kerberos/krb5kdc/principal'
This
action will create new files
principal
,principal.kadm5 etc
6.
start krb5kdc service
service krb5kdc start
Starting
Kerberos 5 KDC: [ OK ]
7.
Access kadmin.local
kadmin.local
Authenticating
as principal root/admin@COMPANY.COM with password.
kadmin.local:
8.
In the kadmin.local add principal
a.
kadmin.local: listprincs
This
will list it
b.
kadmin.local: addprinc root/admin
This will add principal root to admin group
Add
Host Names
c.
kadmin.local: addprinc -randkey hosts/master.COMPANY.COM
d.
kadmin.local: ktadd hosts/master.COMPANY.COM
Add
oracle user
e.
kadmin.local: addprinc oracle
9
. To get user token during login , then kerbores authentication
should be enabled
authconfig-tui
OR
setup
(Then
select authentication option)
Select
Kerberos option
Next and provide the kerbores server OPTION ( by default it will load from /etc/krb5. File
10.
Verify login action (Existing user oracle)
a.
ssh -l oracle master
b.
kinit
Password
for oracle@COMPANY.COM:
c.
klist
Ticket cache: FILE:/tmp/krb5cc_500
Default principal: oracle@COMPANY.COM
Valid starting Expires Service principal
07/06/16 23:35:47 07/07/16 23:35:47
krbtgt/COMPANY.COM@COMPANY.COM
renew until 07/06/16 23:35:47
11.
Add the user with out password
a.
adduser sterin
b.
Add in Kerberos DB
kadmin.local
kadmin.local: addprinc sterin
Provide
username and password
c.
Login using ssh
ssh -l sterin master
Now
password is not stored in /etc/passwd of linux server, it will take
from Kerberos DB
sterin@master's
password:
[sterin@master
~]$ klist
Ticket cache:
FILE:/tmp/krb5cc_501_Oc6cOn
Default
principal: sterin@COMPANY.COM
Valid starting
Expires Service principal
07/07/16 00:45:54
07/08/16 00:45:54 krbtgt/COMPANY.COM@COMPANY.COM
renew until
07/07/16 00:45:54
12.
Check local user not in Kerberos DB
adduser notinkb
passwd notinkb
Changing
password for user notinkb.
New
password:
BAD
PASSWORD: it is based on a dictionary word
Retype
new password:
passwd:
all authentication tokens updated successfully.
ssh -l notinkb master
kinit
kinit: Client
not found in Kerberos database while getting initial credentials
To enable service in every restart
/sbin/chkconfig --add krb5kdc
/sbin/chkconfig krb5kdc on
In
client
hostname
client1.company.com
yum install krb5-workstation krb5-libs krb5-auth-dialog
2.
Change the authentication ,by running setup command
Select Kerberos
provide server details
3. Now try with user
4.klist will show the ticker details
