On Jun 13, 2005, at 10:33, fsoliv wrote:
I am studying a kerberos implementation for my company.
I am planning to configure three realms.
The realms are A.BASE.COM, B.BASE.COM and BASE.COM (hierarchical).
I hvae only *one* DNS domain base.com and I won't be changing that.
My question is, will the fact of having one dns domain affect the
kerberos service in any way? I won't be using the dns_lookup_realm
and dns_lookup_kdc.
I have read this thread
http://mailman.mit.edu/pipermail/kerberos/2005-June/007876.html where
it is stated that this configuration will be an administration
nightmare.
I think "a bit of a headache" was the phrase used, not "nightmare". :-)
If you can commit to having some centrally maintained files that are
distributed to the workstations or servers (perhaps via cron jobs,
package updates, whatever, maybe symlinked into a shared, trusted file
system), you only need to update the one file. In fact, if you've got
the location information stored somewhere (perhaps as which subnet the
machine's address is in, in your master zone file), you could
programmatically recreate the domain_realm section as needed and
distribute it.
My situation is different from the situation in this thread
in the sense that althought there are three realms only machines from
location A will be in realm A.BASE.COM, machines in location B will be
in realm B.BASE.COM and BASE.COM is only for hierarchical trust and
some services.
That mostly removes BASE.COM from consideration as far as determining
the realm of any given host. So, effectively it's one domain with two
realms that we care about, for purposes of this discussion. The
location is irrelevant, unless you're doing some per-location
centralized system management.
[domain_realm]
.base.com=A.BASE.COM
.base.com=B.BASE.COM
If you're thinking that the library would try each realm listed this
way, you're going to be disappointed. While the Kerberos specs allow
for services running on a single machine to have identities in multiple
realms, in our implementation, unless the realm is specified as part of
the principal name, the library will try to determine *one* realm for a
machine, and will use that; if the principal isn't found, you get an
error.
We also haven't yet implemented the KDC-based referral support that's
been proposed.
Is this possible? Do I need to create subdomains?
What, like you said you wouldn't do, at the start of your message? :-)
Only if you can't distribute updates to the domain_realm section as
needed.
Ken
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
