Hi list,
i asked my questions yesterday the irc (#kerberos at freenode) but i
didn't get a full answer.
FIrst, i have a full working system. ;) I use Kerberos with a openLDAP backend.
At a review of my system i found several spelling errors (configs are
at the end of this mail) in the kdc.conf, so the kdc.conf isn't used
by my config. I removed the kdc.conf and my Kerberos is working well.
That all is working is fine, but i want to understand that points.
So my questions:
* Is the kdc.conf obsolete?
* Which config is the winner by a misconfiguration?
' Which parts had to be in both configs (not the specific points -
the topics)?
Thanks Con
__krb5.conf__
[libdefaults]
ticket_lifetime = "36000"
default_realm = EXAMPLE.COM
kdc_timesync = "1"
forwardable = "true"
forward = "true"
renewable = "true"
proxiable = "true"
ccache_type = 4
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
[realms]
EXAMPLE.COM = {
kdc = "kerberos.example.com:88"
master_kdc = "kerberos.example.com:88"
admin_server = "kerberos.example.com:749"
default_domain = "example.com"
database_module = ldap.example.com
}
[domain_realm]
.example.com = "EXAMPLE.COM"
example.com = "EXAMPLE.COM"
[dbmodules]
ldap.example.com = {
db_library = kldap
ldap_kerberos_container_dn = cn=krbcontainer,dc=example,dc=com
# the RO account
ldap_kdc_dn = cn=krb5-kdc-srv,ou=services,dc=example,dc=com
# this object needs to have read rights on
# the realm container, principal container and realm sub-trees
# the RW account
ldap_kadmind_dn = cn=krb5-adm-srv,ou=services,dc=example,dc=com
# this object needs to have read and write rights on
# the realm container, principal container and realm sub-trees
ldap_service_password_file = /etc/krb5kdc/service.keyfile
ldap_servers = ldaps://ldap.example.com
ldap_conns_per_server = 5
}
__kdc.conf__
[kdcdefaults]
kdc_ports = 750,88
default_real = EXAMPLE.COM ← spelling error: default realm
[realms]
EXAMPLE = { <--spellinge error: EXAMPLE.COM
database_name = /var/lib/krb5kdc/principal ← error: my
conffig resides in LDAP
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab ← error: i
didn't have this keytab, i found a howto
(http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5/doc/krb5-install/Create-a-kadmind-Keytab--optional-.html),
to create this keyfile. But this keytab is obsolate?
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/.k5.EXAMPLE.COM
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = aes256-cts:normal arcfour-hmac:normal
des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm
des:onlyrealm des:afs3
default_principal_flags = "+forwardable +preauth +renewable
+pwservice +service"
}
________________________________________________
Kerberos mailing list [email protected]
https://mailman.mit.edu/mailman/listinfo/kerberos
