Skip to Content
0 Votes

Changes for page KerberosAndLDAP

Last modified by Sirius Rayner-Karlsson on 2024/05/09 10:54
From version 29.1
edited by Sirius Rayner-Karlsson
on 2024/05/07 13:43
Change comment: There is no comment for this version
To version 27.2
edited by Sirius Rayner-Karlsson
on 2024/05/07 10:54
Change comment: There is no comment for this version

Summary

Details

Page properties
Content
... ... @@ -129,88 +129,4 @@
129 129  
130 130  Note that we now reference our kdc and kadmin accounts and we grant them permission to the krbContainer which will house all our kerberos principals. Give both of them write access, because we do want to have the ability to track last login and lock accounts if there are login failures. We like security.
131 131  
132 -
133 -===== Create your krb5.conf: =====
134 -
135 -Over to adjusting /etc/krb5.conf so that it will point to the right thing later. It should look something like this:
136 -
137 -
138 -{{{[libdefaults]
139 - default_realm = EXAMPLE.COM
140 - dns_lookup_realm = false
141 - dns_lookup_kdc = false
142 - ticket_lifetime = 24h
143 - forwardable = true
144 - proxiable = true
145 - rdns = false
146 -
147 -[realms]
148 - EXAMPLE.COM = {
149 - kdc = debian.example.com
150 - admin_server = debian.example.com
151 - default_domain = example.com
152 - }
153 - [domain_realm]
154 - .example.com = EXAMPLE.COM
155 - example.com = EXAMPLE.COM}}}
156 -
157 -Make sure your designated debian server have ports 88, 464 and 749 open, both for TCP and UDP, in its firewall. 88 is for the kdc, 464 and 749 is for kadmin.
158 -
159 -Next, we need to write up /etc/krb5kdc/kdc.conf. Something like this should work
160 -
161 -
162 -[libdefaults]
163 -
164 -[realms]
165 - TRUDHEIM.COM = {
166 - database_module = openldap_ldapconf
167 - max_life = 7d
168 - max_renewable_life = 6d
169 - }
170 -
171 -[dbdefaults]
172 - ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,dc=trudheim,dc=com
173 -
174 -[dbmodules]
175 - openldap_ldapconf = {
176 - db_library = kldap
177 - disable_last_success = false
178 - disable_lockout = false
179 - ldap_conns_per_server = 5
180 - ldap_servers = ldaps:~/~/ds723.trudheim.com
181 - ldap_kdc_dn = "cn=kdc,ou=kerberos,dc=trudheim,dc=com"
182 - ldap_kadmind_dn = "cn=kadmin,ou=kerberos,dc=trudheim,dc=com"
183 - ldap_service_password_file = /etc/krb5kdc/service.keyfile
184 - }
185 -
186 -
187 -Then you need to create ##/etc/krb5kdc/kadm5.acl and put in it##
188 -
189 -
190 -##*/admin@EXAMPLE.COM *##
191 -
192 -
193 -so that administrator principals can run kadmin. Now we are ready to create the domain. And that we do with
194 -
195 -
196 -#
197 -
198 -kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com -r TRUDHEIM.COM create -subtrees dc=trudheim,dc=com -maxtktlife '7 Days' -maxrenewlife '6 Days' -s
199 -Password for "uid=root,cn=users,dc=trudheim,dc=com":
200 -Initializing database for realm 'TRUDHEIM.COM'
201 -You will be prompted for the database Master Password.
202 -It is important that you NOT FORGET this password.
203 -Enter KDC database master key:
204 -Re-enter KDC database master key to verify:
205 -
206 -kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kdc,ou=kerberos,dc=trudheim,dc=com
207 -Password for "uid=root,cn=users,dc=trudheim,dc=com":
208 -Password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
209 -Re-enter password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
210 -
211 -kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kadmin,ou=kerberos,dc=trudheim,dc=com
212 -Password for "uid=root,cn=users,dc=trudheim,dc=com":
213 -Password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
214 -Re-enter password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
215 -
216 216