Changes for page KerberosAndLDAP

Summary

• Page properties (1 modified, 0 added, 0 removed)

Details

Page properties

Content

...	...	@@ -1,4 +1,6 @@
	1	+{{box cssClass="floatinginfobox" title="**Contents**"}}
1	1	{{toc/}}
	3	+{{/box}}
2	2
3	3	= Debian =
4	4
...	...	@@ -94,5 +94,123 @@
94	94	(% style="color:#400" %)
95	95	##{{{adding new entry "cn=kadmin,ou=kerberos,dc=example,dc=com"}}}##
96	96
	99	+
97	97	Synology LDAP server did not like adding users with placeholder passwords, because Synology puts in place password policies. Hence changing this to a ##cn## instead of a ##uid##. It seems to have worked out fine as my KDC is fully functioning.
98	98
	102	+
	103	+===== Grant kdc and kadmin permissions: =====
	104	+
	105	+This switches back to the ##cn=config## DN as you are changing the permissions.
	106	+
	107	+$ ldapmodify -H ldaps:~/~/ds723.trudheim.com -W -D cn=config <<EOF
	108	+
	109	+dn: olcDatabase={1}bdb,cn=config
	110	+add: olcAccess
	111	+olcAccess: {0}to attrs=krbPrincipalKey
	112	+ by anonymous auth
	113	+ by dn.exact="cn=kdc,ou=kerberos,dc=trudheim,dc=com" write
	114	+ by dn.exact="cn=kadmin,ou=kerberos,dc=trudheim,dc=com" write
	115	+ by self write
	116	+ by * none
	117	+-
	118	+add: olcAccess
	119	+olcAccess: {1}to dn.subtree="cn=krbContainer,ou=kerberos,dc=example,dc=com"
	120	+ by dn.exact="cn=kdc,ou=kerberos,dc=trudheim,dc=com" write
	121	+ by dn.exact="cn=kadmin,ou=kerberos,dc=trudheim,dc=com" write
	122	+ by * none
	123	+
	124	+EOF
	125	+
	126	+Enter LDAP Password:
	127	+modifying entry "olcDatabase={1}bdb,cn=config"
	128	+
	129	+$
	130	+
	131	+
	132	+Note that we now reference our kdc and kadmin accounts and we grant them permission to the krbContainer which will house all our kerberos principals. Give both of them write access, because we do want to have the ability to track last login and lock accounts if there are login failures. We like security.
	133	+
	134	+
	135	+===== Create your krb5.conf: =====
	136	+
	137	+Over to adjusting /etc/krb5.conf so that it will point to the right thing later. It should look something like this:
	138	+
	139	+
	140	+{{{[libdefaults]
	141	+ default_realm = EXAMPLE.COM
	142	+ dns_lookup_realm = false
	143	+ dns_lookup_kdc = false
	144	+ ticket_lifetime = 24h
	145	+ forwardable = true
	146	+ proxiable = true
	147	+ rdns = false
	148	+
	149	+[realms]
	150	+ EXAMPLE.COM = {
	151	+ kdc = debian.example.com
	152	+ admin_server = debian.example.com
	153	+ default_domain = example.com
	154	+ }
	155	+ [domain_realm]
	156	+ .example.com = EXAMPLE.COM
	157	+ example.com = EXAMPLE.COM}}}
	158	+
	159	+Make sure your designated debian server have ports 88, 464 and 749 open, both for TCP and UDP, in its firewall. 88 is for the kdc, 464 and 749 is for kadmin.
	160	+
	161	+Next, we need to write up /etc/krb5kdc/kdc.conf. Something like this should work
	162	+
	163	+
	164	+[libdefaults]
	165	+
	166	+[realms]
	167	+ TRUDHEIM.COM = {
	168	+ database_module = openldap_ldapconf
	169	+ max_life = 7d
	170	+ max_renewable_life = 6d
	171	+ }
	172	+
	173	+[dbdefaults]
	174	+ ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,dc=trudheim,dc=com
	175	+
	176	+[dbmodules]
	177	+ openldap_ldapconf = {
	178	+ db_library = kldap
	179	+ disable_last_success = false
	180	+ disable_lockout = false
	181	+ ldap_conns_per_server = 5
	182	+ ldap_servers = ldaps:~/~/ds723.trudheim.com
	183	+ ldap_kdc_dn = "cn=kdc,ou=kerberos,dc=trudheim,dc=com"
	184	+ ldap_kadmind_dn = "cn=kadmin,ou=kerberos,dc=trudheim,dc=com"
	185	+ ldap_service_password_file = /etc/krb5kdc/service.keyfile
	186	+ }
	187	+
	188	+
	189	+Then you need to create ##/etc/krb5kdc/kadm5.acl and put in it##
	190	+
	191	+
	192	+##*/admin@EXAMPLE.COM *##
	193	+
	194	+
	195	+so that administrator principals can run kadmin. Now we are ready to create the domain. And that we do with
	196	+
	197	+
	198	+#
	199	+
	200	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com -r TRUDHEIM.COM create -subtrees dc=trudheim,dc=com -maxtktlife '7 Days' -maxrenewlife '6 Days' -s
	201	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	202	+Initializing database for realm 'TRUDHEIM.COM'
	203	+You will be prompted for the database Master Password.
	204	+It is important that you NOT FORGET this password.
	205	+Enter KDC database master key:
	206	+Re-enter KDC database master key to verify:
	207	+
	208	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kdc,ou=kerberos,dc=trudheim,dc=com
	209	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	210	+Password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
	211	+Re-enter password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
	212	+
	213	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kadmin,ou=kerberos,dc=trudheim,dc=com
	214	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	215	+Password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
	216	+Re-enter password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
	217	+
	218	+