Red Hat Enterprise Linux 5 Administration Unleashed

Enabling Kerberos 283In the ACL file, the * wildcard can be used when specifying the principal such as*/admin@EXAMPLE.COM for all admin instances of valid users.Table 12.2 shows the available permissions. Uppercase letters are used for negative permissions.To specify more than one permission, do not separate them by any spaces or punctuationsuch as ad.TABLE 12.2 Kerberos ACL PermissionsPermission DescriptionaAllow the user to add principals or policies.ADo not allow the user to add principals or policies.dAllow the user to delete principals or policies.DDo not allow the user to delete principals or policies.mAllow the user to modify principals or policies.MDo not allow the user to modify principals or policies.cAllow the user to change the passwords for principals.CDo not allow the user to change the passwords for principals.iAllow the user to query the database.IDo not allow the user to query the database.lAllow the user to list principals or policies.LDo not allow the user to list principals or policies.sAllow the user to explicitly set the key for a principal.SDo not allow the user to explicitly set the key for a principal.* All permissions.x All permissions. The same as *.12The is only applicable if the permission has a target and is thereforeoptional. For example, a principal can be granted the ability to change passwords butonly for specific users provided as the . Each component of the can be referenced in the with the * wildcard suchas *1 for the first component of the principal.The restrict, add, or modify actions granted and are also optional. Theyare in the format + or -. The same options used when adding or modifyinga principal can be used as restrictions when adding ACLs. They are listed in Table 12.1.Starting and Stopping the Kerberos ServerTo start the Kerberos server, execute the following as root to start the appropriatedaemons:service krb5kdc startservice kadmin startBe sure to configure the system to start these services at boot time:chkconfig krb5kdc on