Kerberos Server HowTo

Kerberos is a network authentication protocol which works on the basis of “tickets” to allow nodes communicating over a non-secure network to prove their identity to one another in a secure manner. (Source Kerberos_(protocol))

Please read about here Kerberos_(protocol) and especially Kerberos How-to.

• krb5-server
  • krb5-libs (dependency of krb5-server)

• krb5-client

opkg

opkg install krb5-server

Create the file /etc/krb5.conf with the following credentials. Example:

[libdefaults]
    default_realm = YOURDOMAIN.ORG
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = yes

[realms]
    YOURDOMAIN.ORG = {
        kdc = server_address_of_this_machine:88
        admin_server = server_address_of_this_machine:749
        default_domain = yourdomain.org
    }

[domain_realm]
    .yourdomain.org = YOURDOMAIN.ORG
    yourdomain.org = YOURDOMAIN.ORG

Replace YOURDOMAIN.ORG / yourdomain.org with the domain name of your domain the server should act for (names must be specified in UPPER- / lowercase as shown above). Replace server_address_of_this_machine with the host name/IP adress of this server you're setting up.

Start the server by issuing

/etc/init.d/krb5kdc start

This should create the /etc/krb5kdc/ directory with the following files

-rw-------    1 root     root         8192 Feb 13 11:17 principal
-rw-------    1 root     root         8192 Feb 13 09:12 principal.kadm5
-rw-------    1 root     root            0 Feb 13 09:12 principal.kadm5.lock
-rw-------    1 root     root            0 Feb 13 11:17 principal.ok

In case you don't get any error messages check your server by logging on with

kadmin.local

In case everything works well you will see the following message

root@bridge:~# kadmin.local
Authenticating as principal xxxxxxx/admin@YOURDOMAIN.ORG with password.
kadmin.local:

Perform the tests as described in the Kerberos How-to document on page 16/17.

To enable/disable automatic start on boot:

/etc/init.d/krb5kdc enable

this simply creates a symlink: /etc/rc.d/S60krb5kdc → /etc/init.d/krb5kdc

/etc/init.d/krb5kdc disable

this removes the symlink again

Be sure to backup_restore your kerberos files.

Adding the following paths will ensure that your KDC survives a system upgrade and is backed up when a backup is run.

/etc/krb5.conf
/etc/krb5kdc/.k5.[YOUR_REALM]
/etc/krb5kdc/kadm5.acl
/etc/krb5kdc/principal
/etc/krb5kdc/principal.kadm5
/etc/krb5kdc/principal.kadm5.lock
/etc/krb5kdc/principal.ok
/etc/krb5kdc/kdc.conf

WARNING: This backs up the stash file(.k5 file) which contains the unencrypted KDC database master key, if you don't want to include this in your backups and you've safely stored the KDC database master key elsewhere then you can omit this from backups and manually regenerate it post update/restore by running the following command:

krb5_util stash

• The Project Homepage: http://web.mit.edu/kerberos/
• Kerberos How-To: http://www.kerberos.org/software/adminkerberos.pdf
• Kerberos Tutorial: http://www.kerberos.org/software/tutorial.html