Skip to Content
0 Votes

Wiki source code of KerberosAndLDAP

Version 31.1 by Sirius Rayner-Karlsson on 2024/05/09 05:52
Hide last authors
Sirius Rayner-Karlsson 31.1 1 (% data-xwiki-non-generated-content="java.util.List" %)
2 (((
3 " data-xwiki-parameter-name="title" class="xwiki-metadata-container">**Contents**
4 )))
5
6 (% data-xwiki-non-generated-content="java.util.List" %)
7 (((
8 " class="xwiki-metadata-container">
9
10 {{toc/}}
11 )))
12
Sirius Rayner-Karlsson 30.1 13 {{box cssClass="floatinginfobox" title="**Contents**"}}
Sirius Rayner-Karlsson 22.1 14 {{toc/}}
Sirius Rayner-Karlsson 30.1 15 {{/box}}
Sirius Rayner-Karlsson 22.1 16
Sirius Rayner-Karlsson 1.1 17 = Debian =
18
Sirius Rayner-Karlsson 26.1 19 The guide I followed was https://wiki.debian.org/LDAP/OpenLDAPSetup#Kerberos which while it worked required some minor tweaks. I obtained edit privileges for the Debian Wiki and updated the guide with the fixes that I found. I however have a Synology NAS and that can run an LDAP Server. So this guide differs from the upstream Debian Guide.
Sirius Rayner-Karlsson 23.1 20
Sirius Rayner-Karlsson 26.1 21 Assumption is that you have installed the LDAP Server package on your NAS and gone through initial configuration steps, so it has a domain, there is a DN you can bind as and so forth. It is also assumed you have a Debian system (12.5 or later, though this guide should work with 11.x and likely 10.x as well) that will become your KDC and KAdmin server.
Sirius Rayner-Karlsson 14.1 22
Sirius Rayner-Karlsson 26.1 23 Recommendation is that you create actual ##.ldif## files rather than use here-documents as used in this guide. It is far easier to make adjustments to things if you have a file to edit rather than having to type it all out again or paste it and then have to try and make edits to it without making mistakes.
Sirius Rayner-Karlsson 2.1 24
Sirius Rayner-Karlsson 26.1 25 **The guide is for illustration. Expectation is that you do not follow it verbatim but adapt it to your needs.**
Sirius Rayner-Karlsson 20.1 26
Sirius Rayner-Karlsson 23.1 27
Sirius Rayner-Karlsson 26.1 28 ===== Install packages: =====
29
Sirius Rayner-Karlsson 24.1 30 (% class="wikigeneratedid" %)
Sirius Rayner-Karlsson 26.1 31 The packages you need are [[krb5-kdc-ldap>>url:https://packages.debian.org/krb5-kdc-ldap]], [[krb5-admin-server>>url:https://packages.debian.org/krb5-admin-server]] for the actual KDC and [[schema2ldif>>url:https://packages.debian.org/schema2ldif]]  plus [[slapd>>https://packages.debian.org/search?keywords=slapd]] for adding the schema and ##slappasswd##. They are to be installed on your designated Debian host.
Sirius Rayner-Karlsson 24.1 32
Sirius Rayner-Karlsson 21.1 33 (% style="color:#400" %)
Sirius Rayner-Karlsson 13.1 34 ##{{{$ sudo apt install krb5-kdc-ldap krb5-admin-server schema2ldif}}}##
Sirius Rayner-Karlsson 3.1 35
Sirius Rayner-Karlsson 13.1 36
Sirius Rayner-Karlsson 26.1 37 ===== Load ##kerberos LDAP## schema: =====
Sirius Rayner-Karlsson 3.1 38
Sirius Rayner-Karlsson 27.1 39 Now you need to load the kerberos schema into the LDAP server on the Synology. And here you need to use the ##cn=config## DN.
Sirius Rayner-Karlsson 26.1 40
Sirius Rayner-Karlsson 21.1 41 (% style="color:#400" %)
Sirius Rayner-Karlsson 27.1 42 ##{{{$ zcat /usr/share/doc/krb5-kdc-ldap/kerberos.openldap.ldif.gz | ldapadd -H ldaps://nas.example.com/ -D cn=config -W}}}##
Sirius Rayner-Karlsson 16.1 43 ##{{{Enter LDAP Password:}}}##
Sirius Rayner-Karlsson 14.1 44 ##{{{adding new entry "cn=kerberos,cn=schema,cn=config"}}}##
45 ##{{{$}}}##
Sirius Rayner-Karlsson 3.1 46
47
Sirius Rayner-Karlsson 23.1 48 ===== Create Index on krbPrincipalName: =====
Sirius Rayner-Karlsson 14.1 49
Sirius Rayner-Karlsson 27.1 50 Having an index on the ##krbPrincipalName## improves performance and also suppresses some log messages if ##slapd## is configured to log more than default for the database(s) where you intend to store Kerberos data. As this is OpenLDAP on the Synology, it does not use ##mdb## format, it uses ##bdb##. If you install ##slapd## on Debian, it uses ##mdb## format. It is different database format, but the principle is the same. Again, as you are modifying config, the DN is ##cn=config##. Interestingly, it is still the main password you set for the Synology LDAP server.
Sirius Rayner-Karlsson 23.1 51
Sirius Rayner-Karlsson 21.1 52 (% style="color:#400" %)
Sirius Rayner-Karlsson 27.1 53 ##{{{$ ldapmodify -H ldaps://nas.example.com/ -D cn=config -W <<EOF}}}##
Sirius Rayner-Karlsson 15.1 54 ##{{{dn: olcDatabase={1}bdb,cn=config}}}##
55 ##{{{add: olcDbIndex}}}##
56 ##{{{olcDbIndex: krbPrincipalName eq,pres,sub}}}##
57 ##{{{EOF}}}##
Sirius Rayner-Karlsson 16.1 58 ##{{{Enter LDAP Password:}}}##
Sirius Rayner-Karlsson 15.1 59 ##{{{modifying entry "olcDatabase={1}bdb,cn=config"}}}##
60 ##{{{$}}}##
Sirius Rayner-Karlsson 3.1 61
62
Sirius Rayner-Karlsson 26.1 63 ===== Create principals kadmin and kdc: =====
Sirius Rayner-Karlsson 23.1 64
Sirius Rayner-Karlsson 27.1 65 Next, you create and configure two entries which will be used by the Kerberos servers to connect to OpenLDAP. As you will not run the Kerberos KDC and Admin Server on the same host as OpenLDAP, these steps are required. In order to keep things nicely separated, everything will be created under a separate ##organizationalUnit##. I diverge from the official Debian guide here as I do not agree with the DN they use. I also had to make changes to the DNs of ##kdc## and ##kadmin## due to ##pwdPolicy## applied by Synology to their LDAP server. The official guide will have you use placeholder passwords and that does not work with the Synology LDAP server. You need to generate them upfront with ##slappasswd -h {SSHA}##.
Sirius Rayner-Karlsson 4.1 66
Sirius Rayner-Karlsson 21.1 67 (% style="color:#400" %)
Sirius Rayner-Karlsson 25.1 68 ##{{{$ ldapadd -H ldap://nas.example.com/ -D uid=root,cn=users,dc=example,dc=com -W <<EOF}}}##
69 ##{{{dn: ou=kerberos,dc=example,dc=com}}}##
Sirius Rayner-Karlsson 15.1 70 ##{{{objectClass: organizationalUnit}}}##
71 ##{{{objectClass: top}}}##
72 ##{{{ou: kerberos}}}##
Sirius Rayner-Karlsson 27.1 73
74 (% style="color:#400" %)
75 ##{{{dn: cn=kdc,ou=kerberos,dc=example,dc=com}}}##
76 ##{{{cn: kdc}}}##
77 ##{{{sn: kdc}}}##
78 ##{{{objectClass: person}}}##
79 ##{{{objectClass: pwdPolicy}}}##
80 ##{{{pwdAttribute: userPassword}}}##
81 ##{{{pwdMinLength: 8}}}##
82 ##{{{pwdCheckQuality: 2}}}##
83 ##{{{pwdPolicySubentry: cn=kdc,ou=kerberos,dc=example,dc=com}}}##
84 ##{{{userPassword: {SSHA}<password-hash>}}}##
Sirius Rayner-Karlsson 15.1 85 ##{{{description: Kerberos KDC Account}}}##
Sirius Rayner-Karlsson 4.1 86
Sirius Rayner-Karlsson 21.1 87 (% style="color:#400" %)
Sirius Rayner-Karlsson 27.1 88 ##{{{dn: cn=kadmin,ou=kerberos,dc=example,dc=com}}}##
89 ##{{{cn: kadmin}}}##
Sirius Rayner-Karlsson 16.1 90 ##{{{sn: kadmin}}}##
91 ##{{{objectClass: person}}}##
92 ##{{{objectClass: pwdPolicy}}}##
93 ##{{{pwdAttribute: userPassword}}}##
94 ##{{{pwdMinLength: 8}}}##
95 ##{{{pwdCheckQuality: 2}}}##
Sirius Rayner-Karlsson 27.1 96 ##{{{pwdPolicySubentry: cn=kadmin,ou=kerberos,dc=example,dc=com}}}##
97 ##{{{userPassword: {SSHA}<password-hash>}}}##
98 ##{{{description: Kerberos KDC Account}}}##
99 ##{{{EOF}}}##
100 ##{{{Enter LDAP Password:}}}##
Sirius Rayner-Karlsson 16.1 101
Sirius Rayner-Karlsson 27.1 102 (% style="color:#400" %)
103 ##{{{adding new entry "ou=kerberos,dc=example,dc=com"}}}##
Sirius Rayner-Karlsson 17.1 104
Sirius Rayner-Karlsson 27.1 105 (% style="color:#400" %)
106 ##{{{adding new entry "cn=kdc,ou=kerberos,dc=example,dc=com"}}}##
Sirius Rayner-Karlsson 19.1 107
Sirius Rayner-Karlsson 27.1 108 (% style="color:#400" %)
109 ##{{{adding new entry "cn=kadmin,ou=kerberos,dc=example,dc=com"}}}##
110
Sirius Rayner-Karlsson 27.2 111
Sirius Rayner-Karlsson 27.1 112 Synology LDAP server did not like adding users with placeholder passwords, because Synology puts in place password policies. Hence changing this to a ##cn## instead of a ##uid##. It seems to have worked out fine as my KDC is fully functioning.
113
Sirius Rayner-Karlsson 27.2 114
115 ===== Grant kdc and kadmin permissions: =====
116
117 This switches back to the ##cn=config## DN as you are changing the permissions.
118
119 $ ldapmodify -H ldaps:~/~/ds723.trudheim.com -W -D cn=config <<EOF
120
121 dn: olcDatabase={1}bdb,cn=config
122 add: olcAccess
123 olcAccess: {0}to attrs=krbPrincipalKey
124 by anonymous auth
125 by dn.exact="cn=kdc,ou=kerberos,dc=trudheim,dc=com" write
126 by dn.exact="cn=kadmin,ou=kerberos,dc=trudheim,dc=com" write
127 by self write
128 by * none
129 -
130 add: olcAccess
131 olcAccess: {1}to dn.subtree="cn=krbContainer,ou=kerberos,dc=example,dc=com"
132 by dn.exact="cn=kdc,ou=kerberos,dc=trudheim,dc=com" write
133 by dn.exact="cn=kadmin,ou=kerberos,dc=trudheim,dc=com" write
134 by * none
135
136 EOF
137
138 Enter LDAP Password:
139 modifying entry "olcDatabase={1}bdb,cn=config"
140
141 $
142
143
144 Note that we now reference our kdc and kadmin accounts and we grant them permission to the krbContainer which will house all our kerberos principals. Give both of them write access, because we do want to have the ability to track last login and lock accounts if there are login failures. We like security.
145
Sirius Rayner-Karlsson 29.1 146
147 ===== Create your krb5.conf: =====
148
149 Over to adjusting /etc/krb5.conf so that it will point to the right thing later. It should look something like this:
150
151
152 {{{[libdefaults]
153 default_realm = EXAMPLE.COM
154 dns_lookup_realm = false
155 dns_lookup_kdc = false
156 ticket_lifetime = 24h
157 forwardable = true
158 proxiable = true
159 rdns = false
160
161 [realms]
162 EXAMPLE.COM = {
163 kdc = debian.example.com
164 admin_server = debian.example.com
165 default_domain = example.com
166 }
167 [domain_realm]
168 .example.com = EXAMPLE.COM
169 example.com = EXAMPLE.COM}}}
170
171 Make sure your designated debian server have ports 88, 464 and 749 open, both for TCP and UDP, in its firewall. 88 is for the kdc, 464 and 749 is for kadmin.
172
173 Next, we need to write up /etc/krb5kdc/kdc.conf. Something like this should work
174
175
176 [libdefaults]
177
178 [realms]
179 TRUDHEIM.COM = {
180 database_module = openldap_ldapconf
181 max_life = 7d
182 max_renewable_life = 6d
183 }
184
185 [dbdefaults]
186 ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,dc=trudheim,dc=com
187
188 [dbmodules]
189 openldap_ldapconf = {
190 db_library = kldap
191 disable_last_success = false
192 disable_lockout = false
193 ldap_conns_per_server = 5
194 ldap_servers = ldaps:~/~/ds723.trudheim.com
195 ldap_kdc_dn = "cn=kdc,ou=kerberos,dc=trudheim,dc=com"
196 ldap_kadmind_dn = "cn=kadmin,ou=kerberos,dc=trudheim,dc=com"
197 ldap_service_password_file = /etc/krb5kdc/service.keyfile
198 }
199
200
201 Then you need to create ##/etc/krb5kdc/kadm5.acl and put in it##
202
203
204 ##*/admin@EXAMPLE.COM *##
205
206
207 so that administrator principals can run kadmin. Now we are ready to create the domain. And that we do with
208
209
210 #
211
212 kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com -r TRUDHEIM.COM create -subtrees dc=trudheim,dc=com -maxtktlife '7 Days' -maxrenewlife '6 Days' -s
213 Password for "uid=root,cn=users,dc=trudheim,dc=com":
214 Initializing database for realm 'TRUDHEIM.COM'
215 You will be prompted for the database Master Password.
216 It is important that you NOT FORGET this password.
217 Enter KDC database master key:
218 Re-enter KDC database master key to verify:
219
220 kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kdc,ou=kerberos,dc=trudheim,dc=com
221 Password for "uid=root,cn=users,dc=trudheim,dc=com":
222 Password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
223 Re-enter password for "cn=kdc,ou=kerberos,dc=trudheim,dc=com":
224
225 kdb5_ldap_util -D uid=root,cn=users,dc=trudheim,dc=com -H ldaps:~/~/ds723.trudheim.com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=kadmin,ou=kerberos,dc=trudheim,dc=com
226 Password for "uid=root,cn=users,dc=trudheim,dc=com":
227 Password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
228 Re-enter password for "cn=kadmin,ou=kerberos,dc=trudheim,dc=com":
229
Sirius Rayner-Karlsson 27.2 230