（转）RedHat/CentOS安装和配置kerberos

RedHat/CentOS安装和配置kerberos

需要在kerberos server和客户端都先安装ntp (Internet时间协议，保证服务器和客户机时间同步 )

1  kerberos 服务器端

1.1. install /start ntp
   #sudo yum install ntp
   #sudo service ntpd start 
1.2. install kerberos server:
   #yum install krb5-server krb5-libs krb5-auth-dialog
可选： install kerberos client:
# yum install krb5-workstation

1.3 Edit /etc/krb5.conf and /var/kerberos/krb5kdc/kdc.conf
   # sudo vi /etc/krb5.conf
 Replacing EXAMPLE.COM with your domain name.
 Replace the kerberos.example.com with your  kdc server.
  # sudo vi /var/kerberos/krb5kdc/kdc.conf
 Replacing EXAMPLE.COM with your domain name.
1.4. create the databse using kdb5_util utility.
  # sudo /usr/sbin/kdb5_util create -s
1.5. Edit  /var/kerberos/krb5kdc/kadm5.acl file
  # sudo vi  /var/kerberos/krb5kdc/kadm5.acl file
 such as:将 */admin@EXAMPLE.COM  *  改为*/admin@MYCOMPANY.COM
1.6. use kadmin.local to add  admin user:
 #kadmin.local
 #addprinc steve/admin
 #addprinc tony/admin
1.7. start kerberos:
 # /sbin/service krb5kdc start
 # /sbin/service kadmin start
1.8. now you can use kadmin to manage principal:
 #kadmin -q "addprinc  user1/admin"
 This way you actaully use client mode to connect to kdc and do admin level task
1.9. verify KDC ok.
#kinit tony/admin

#klist

2 各个客户机端

2.1. install kerberos client
  #yum install krb5-workstation
2.2. edit /etc/krb5.conf
   #sudo vi /etc/krb5.conf
   Replace the EXAMPLE.com with your domain name
   replace the kerberos.example.com with your  kdc server
2.3. authenticate the admin user with kerberos
  #kinit steve/admin
 
  view the principls from client machine:
  #sudo kadmin
  #list_principals

3 用kerberos进行OS 级本地认证和远程登录

-----------------enable kerbose local authentication----------
1. install pAM
sudo apt-get install libpam-krb5

2. view conf file:
 sudo cat /etc/pam.d/common-auth

------------configure the client can remote login using kerborse-----------
1. create another principal such as:
service/clienthost@realm

2.  add the keytab for such principal
kadmin : ktadd -k /etc/service.keytab  service/clienthost@realm

save the keytab to /etc/krb5.keytab

管理keytab

服务principal的credential需要保存在keytab文件中。

1.获取keytab

进入kadmin

1.1 用ktadd :  

ktadd -k  $<keytab_file_name>   service/servicehost@realm  或者 #ktadd -k $<keytab_file_name>  service/servicehost

比如：

# ktadd -k /etc/myservice.keytab  myservice/servicehost

1.2 用xst

xst -k $<keytab_file_name> $service/servicehost

2. 查看keytab

klist -k -t $<keytab_file_name>