Administrator's Guide - Kerio Software Archive

Chapter 24Kerberos AuthenticationThis chapter provides simple and well-organized guidelines to configuration of user authenticationat Kerberos.Kerberos is a client-to-server system which enables authentication and authorization of usersto increase security while using network resources. Kerberos is described by IETF RFC 4120.Kerio MailServer includes support for Kerberos V5.Note: The following logs may be helpful while solving configuration issues:• MS Windows — logs are located in the Start → Settings → Control Panel → AdministrativeTools → Event Viewer menu• Linux — logs can be found in the default directory /var/log/syslogHowever, this applies only to the Kerberos client. Logging of traffic at the server’s side canbe performed by adding the following configuration into the /etc/krb5.conf file:[logging]default = FILE:/var/log/krb5libs.logkdc = FILE:/var/log/krb5kdc.logadmin_server = FILE:/var/log/kadmind.logNote: Settings of logging at the server’s side is regards Kerberos MIT (US implementationof Kerberos applied in the Active Directory and the Apple Open Directory). Setting ofKerberos Heimdal logging (European implementation of Kerberos which can be found inseveral Linux distributions) may be different. 3• Mac OS X Server — logs in the Server Admin application (see chapter 24.4)• Kerio MailServer — logs can be found in the Logs section of the administration console.In this case, the Warning, Error and Debug logs are to be considered (User Authenticationmust be running). For detailed description on individual logs, refer to chapter 22.24.1 Kerio MailServer on Windows3Authentication against Active DirectoryFor authentication at the Active Directory, it is necessary to specify the Active Directory’sdomain name in Kerio MailServer. This can be set under domain settings in the Kerio AdministrationConsole (see figure 24.1).The Kerberos Heimdal’s client is also included in the Linux installation packages of Kerio MailServer. It is, however,not important which version is used on the server (Key Distribution Center) and which is used at the client (KerioMailServer in this case) since the protocol is the same and no problems should occur in the cooperation of the serverand the client side.264