Changes for page KerberosAndLDAP

Summary

• Page properties (1 modified, 0 added, 0 removed)

Details

Page properties

Content

...	...	@@ -1,5 +1,19 @@
	1	+(% data-xwiki-non-generated-content="java.util.List" %)
	2	+(((
	3	+" data-xwiki-parameter-name="title" class="xwiki-metadata-container">**Contents**
	4	+)))
	5	+
	6	+(% data-xwiki-non-generated-content="java.util.List" %)
	7	+(((
	8	+" class="xwiki-metadata-container">
	9	+
1	1	{{toc/}}
	11	+)))
2	2
	13	+{{box cssClass="floatinginfobox" title="**Contents**"}}
	14	+{{toc/}}
	15	+{{/box}}
	16	+
3	3	= Debian =
4	4
5	5	The guide I followed was https://wiki.debian.org/LDAP/OpenLDAPSetup#Kerberos which while it worked required some minor tweaks. I obtained edit privileges for the Debian Wiki and updated the guide with the fixes that I found. I however have a Synology NAS and that can run an LDAP Server. So this guide differs from the upstream Debian Guide.
...	...	@@ -129,4 +129,88 @@
129	129
130	130	Note that we now reference our kdc and kadmin accounts and we grant them permission to the krbContainer which will house all our kerberos principals. Give both of them write access, because we do want to have the ability to track last login and lock accounts if there are login failures. We like security.
131	131
	146	+
	147	+===== Create your krb5.conf: =====
	148	+
	149	+Over to adjusting /etc/krb5.conf so that it will point to the right thing later. It should look something like this:
	150	+
	151	+
	152	+{{{[libdefaults]
	153	+ default_realm = EXAMPLE.COM
	154	+ dns_lookup_realm = false
	155	+ dns_lookup_kdc = false
	156	+ ticket_lifetime = 24h
	157	+ forwardable = true
	158	+ proxiable = true
	159	+ rdns = false
	160	+
	161	+[realms]
	162	+ EXAMPLE.COM = {
	163	+ kdc = debian.example.com
	164	+ admin_server = debian.example.com
	165	+ default_domain = example.com
	166	+ }
	167	+ [domain_realm]
	168	+ .example.com = EXAMPLE.COM
	169	+ example.com = EXAMPLE.COM}}}
	170	+
	171	+Make sure your designated debian server have ports 88, 464 and 749 open, both for TCP and UDP, in its firewall. 88 is for the kdc, 464 and 749 is for kadmin.
	172	+
	173	+Next, we need to write up /etc/krb5kdc/kdc.conf. Something like this should work
	174	+
	175	+
	176	+[libdefaults]
	177	+
	178	+[realms]
	179	+ TRUDHEIM.COM = {
	180	+ database_module = openldap_ldapconf
	181	+ max_life = 7d
	182	+ max_renewable_life = 6d
	183	+ }
	184	+
	185	+[dbdefaults]
	186	+ ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,dc=trudheim,dc=com
	187	+
	188	+[dbmodules]
	189	+ openldap_ldapconf = {
	190	+ db_library = kldap
	191	+ disable_last_success = false
	192	+ disable_lockout = false
	193	+ ldap_conns_per_server = 5
	194	+ ldap_servers = ldaps:~/~/ds723.trudheim.com
	195	+ ldap_kdc_dn = "cn=kdc,ou=kerberos,dc=trudheim,dc=com"
	196	+ ldap_kadmind_dn = "cn=kadmin,ou=kerberos,dc=trudheim,dc=com"
	197	+ ldap_service_password_file = /etc/krb5kdc/service.keyfile
	198	+ }
	199	+
	200	+
	201	+Then you need to create ##/etc/krb5kdc/kadm5.acl and put in it##
	202	+
	203	+
	204	+##*/admin@EXAMPLE.COM *##
	205	+
	206	+
	207	+so that administrator principals can run kadmin. Now we are ready to create the domain. And that we do with
	208	+
	209	+
	210	+#
	211	+
	212	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com -r TRUDHEIM.COM create -subtrees dc=trudheim,dc=com -maxtktlife '7 Days' -maxrenewlife '6 Days' -s
	213	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	214	+Initializing database for realm 'TRUDHEIM.COM'
	215	+You will be prompted for the database Master Password.
	216	+It is important that you NOT FORGET this password.
	217	+Enter KDC database master key:
	218	+Re-enter KDC database master key to verify:
	219	+
	220	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kdc,ou=kerberos,dc=trudheim,dc=com
	221	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	222	+Password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
	223	+Re-enter password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
	224	+
	225	+kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kadmin,ou=kerberos,dc=trudheim,dc=com
	226	+Password for "uid=root,cn=users,dc=trudheim,dc=com":
	227	+Password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
	228	+Re-enter password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
	229	+
132	132