RedHat/CentOS安装和配置kerberos

需要在kerberos server和客户端都先安装ntp (Internet时间协议，保证服务器和客户机时间同步 )

1  kerberos 服务器端

1.1. install /start ntp

   #sudo yum install ntp

   #sudo service ntpd start 

1.2. install kerberos server:

   #yum install krb5-server krb5-libs krb5-auth-dialog

可选： install kerberos client:

# yum install krb5-workstation 

1.3 Edit /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.conf

   # sudo vi /etc/krb5.conf

 Replacing EXAMPLE.COM with your domain name.

 Replace the kerberos.example.com with your  kdc server.

  # sudo vi /var/kerberos/krb5kdc/kdc.conf

 Replacing EXAMPLE.COM with your domain name.

1.4. create the databse using kdb5_util utility.

  # sudo /usr/sbin/kdb5_util create -s

1.5. Edit  /var/kerberos/krb5kdc/kadm5.acl file

  # sudo vi  /var/kerberos/krb5kdc/kadm5.acl file

 such as:将 */admin@EXAMPLE.COM  *  改为*/admin@MYCOMPANY.COM

1.6. use kadmin.local to add  admin user:

 #kadmin.local

 #addprinc steve/admin

 #addprinc tony/admin

1.7. start kerberos:

 # /sbin/service krb5kdc start

 # /sbin/service kadmin start

1.8. now you can use kadmin to manage principal:

 #kadmin -q "addprinc  user1/admin"

 This way you actaully use client mode to connect to kdc and do admin level task

1.9. verify KDC ok.

#kinit tony/admin

#klist

2 各个客户机端

2.1. install kerberos client

  #yum install krb5-workstation

2.2. edit /etc/krb5.conf

   #sudo vi /etc/krb5.conf

   Replace the EXAMPLE.com with your domain name

   replace the kerberos.example.com with your  kdc server

2.3. authenticate the admin user with kerberos

  #kinit steve/admin

 

  view the principls from client machine:

  #sudo kadmin

  #list_principals

3 用kerberos进行OS 级本地认证和远程登录

 

-----------------enable kerbose local authentication----------

1. install pAM

sudo apt-get install libpam-krb5

2. view conf file:

 sudo cat /etc/pam.d/common-auth

------------configure the client can remote login using kerborse-----------

1. create another principal such as:

service/clienthost@realm

2.  add the keytab for such principal

kadmin : ktadd -k /etc/service.keytab  service/clienthost@realm

save the keytab to /etc/krb5.keytab

 

 

管理keytab

服务principal的credential需要保存在keytab文件中。

1.获取keytab

进入kadmin

1.1 用ktadd :  

ktadd -k  $<keytab_file_name>   service/servicehost@realm  或者 #ktadd -k $<keytab_file_name>  service/servicehost

比如：

# ktadd -k /etc/myservice.keytab  myservice/servicehost

1.2 用xst

xst -k $<keytab_file_name> $service/servicehost

 2. 查看keytab

klist -k -t $<keytab_file_name>