Table of Contents

Kerberos Server HowTo

Kerberos is a network authentication protocol which works on the basis of “tickets” to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. (Source Kerberos_(protocol))

Preparation

Prerequisites

Please read about here Kerberos_(protocol) and especially Kerberos How-to.

Required Packages

Server (OpenWrt)

Client (OpenWrt)

Installation

opkg 

opkg install krb5-server

Configuration

Server configuration

Create the file /etc/krb5.conf with the following credentials. Example: 

[libdefaults]
    default_realm = YOURDOMAIN.ORG
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = yes

[realms]
    YOURDOMAIN.ORG = {
        kdc = server_address_of_this_machine:88
        admin_server = server_address_of_this_machine:749
        default_domain = yourdomain.org
    }

[domain_realm]
    .yourdomain.org = YOURDOMAIN.ORG
    yourdomain.org = YOURDOMAIN.ORG

Replace YOURDOMAIN.ORG / yourdomain.org with the domain name of your domain the server should act for (names must be specified in UPPER- / lowercase as shown above). Replace server_address_of_this_machine with the host name/IP adress of this server you're setting up.

Starting the server

Start the server by issuing 

/etc/init.d/krb5kdc start

This should create the /etc/krb5kdc/ directory with the following files 

-rw-------    1 root     root         8192 Feb 13 11:17 principal
-rw-------    1 root     root         8192 Feb 13 09:12 principal.kadm5
-rw-------    1 root     root            0 Feb 13 09:12 principal.kadm5.lock
-rw-------    1 root     root            0 Feb 13 11:17 principal.ok

In case you don't get any error messages check your server by logging on with 

kadmin.local

In case everything works well you will see the following message 

root@bridge:~# kadmin.local
Authenticating as principal xxxxxxx/admin@YOURDOMAIN.ORG with password.
kadmin.local:

Testing the server

Perform the tests as described in the Kerberos How-to document on page 16/17.

Start on boot

To enable/disable automatic start on boot:

/etc/init.d/krb5kdc enable

this simply creates a symlink: /etc/rc.d/S60krb5kdc → /etc/init.d/krb5kdc

/etc/init.d/krb5kdc disable

this removes the symlink again

Backup

Be sure to backup_restore your kerberos files.

Adding the following paths will ensure that your KDC survives a system upgrade and is backed up when a backup is run. 

/etc/krb5.conf
/etc/krb5kdc/.k5.[YOUR_REALM]
/etc/krb5kdc/kadm5.acl
/etc/krb5kdc/principal
/etc/krb5kdc/principal.kadm5
/etc/krb5kdc/principal.kadm5.lock
/etc/krb5kdc/principal.ok
/etc/krb5kdc/kdc.conf

WARNING: This backs up the stash file(.k5 file) which contains the unencrypted KDC database master key, if you don't want to include this in your backups and you've safely stored the KDC database master key elsewhere then you can omit this from backups and manually regenerate it post update/restore by running the following command: 

krb5_util stash

Notes