Linux Security Cookbook

4.11. Getting Started with Kerberos

Problem

You want to set up an MIT Kerberos-5 Key Distribution Center (KDC).

Solution

1. Confirm that Kerberos is installed; if not, install the necessary Red Hat packages:

   $ rpm -q krb5-server krb5-workstation

2. Add /usr/kerberos/bin and /usr/kerberos/sbin to your search path.

3. Choose a realm name (normally your DNS domain), and in the following files:

   /etc/krb5.conf

   /var/kerberos/krb5kdc/kdc.conf

   /var/kerberos/krb5kdc/kadm5.acl

   replace all occurrences of EXAMPLE.COM with your realm and domain.

4. Create the KDC principal database, and choose a master password:

   # kdb5_util create

5. Start the KDC:

   # krb5kdc [-m]

6. Set up a Kerberos principal for yourself with administrative privileges, and a host principal for the KDC host. (Note the prompt is “kadmin.local:”.) Suppose your KDC host is kirby.dogood.org:

   # kadmin.local [-m]
   kadmin.local: addpol users
   kadmin.local: addpol admin
   kadmin.local: addpol hosts
   kadmin.local: ank -policy users 
                        username
   kadmin.local: ank -policy admin 
                        username
                        /admin
   kadmin.local: ank -randkey -policy hosts host/kirby.dogood.org
   kadmin.local: ktadd -k /var/kerberos/krb5kdc/kadm5.keytab \
                 kadmin/admin kadmin/changepw
   kadmin.local: quit

7. Start up the kadmin service:

   # kadmind [-m]

8. Test by obtaining your own Kerberos user credentials, and listing them:

   $ kinit
   $ klist

9. Test the Kerberos administrative system (note the prompt is “kadmin:”):

   $ kadmin
   kadmin: listprincs
   kadmin: quit

Discussion

When choosing a realm name, normally you should use the ...