Linux Security Cookbook

4.13. Adding Hosts to a Kerberos Realm

Problem

You want to add a new host to an existing MIT Kerberos-5 realm.

Solution

Copy /etc/krb5.conf from your KDC (or any other realm host) to the new host. Then run kadmin on the new host, say, samaritan:

samaritan# kadmin -p pat/admin
Authenticating as principal pat/[e-mail] with password.
Enter password: ********
kadmin: ank -randkey -policy hosts host/samaritan.dogood.org
kadmin: ktadd -k /etc/krb5.keytab host/samaritan.dogood.org
kadmin: quit

Discussion

Assume the Kerberos realm we set up previously, DOGOOD.ORG [Recipe 4.11], and suppose your new host is samaritan.dogood.org. Once the DOGOOD.ORG realm configuration file (/etc/krb5.conf) has been copied from the KDC to samaritan, we can take advantage of the kadmin protocol we set up on the KDC to administer the Kerberos database remotely, directly from samaritan. We add a host principal for our new machine and store the host’s secret key in the local keytab file. (kadmin can find the Kerberos admin server from the krb5.conf file we just installed.)

samaritan# kadmin -p pat/admin
Authenticating as principal pat/[e-mail] with password.
Enter password: ********

kadmin:  ank -randkey -policy hosts host/samaritan.dogood.org
Principal "host/[e-mail]" created.

kadmin:  ktadd -k /etc/krb5.keytab host/samaritan.dogood.org Entry for principal host/samaritan.dogood.org with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5.keytab. ...