Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 7 ■ WORKING WITH APACHE■ Note The only key that should be in this keytab is the Apache one, since the keyfile is slightly less securebecause it is owned and readable by the Apache2 user (www-data in the case of Debian/Ubuntu) rather than byroot. (Obviously, this is necessary for it to be usable by the web server, but you don’t want to expose other keys tothat slight insecurity.)Next, you need to set up the configuration file to use this as the authentication option. Let’s sayyou’re setting up a request-tracking system in the directory $APACHEROOT/rt and that this is the only partof the web site that you want to have Kerberos authentication for. Add this section to your site config file:# KerberisationAuthType KerberosV5AuthName "Request Tracker"KrbAuthRealm EXAMPLE.COMKrb5Keytab /etc/apache2/apache2.keytabRequire valid-userThe KrbAuthRealm should be whatever you set up as your authentication realm when you weresetting up Kerberos (see recipe 2-1). It’ll probably be your domain. Krb5Keytab should be set to whereveryou saved your Apache2 keytab.■ Note You can change that Require to various other values. To restrict access to specific users, use this:Require user principal1@EXAMPLE.COM principal2@EXAMPLE.COMThat’s it! Reload Apache with /etc/init.d/apache2 reload, and go to http://example.com/rt in yourbrowser. You should be challenged for your username and password. If you have any problems, checkthe Apache2 logs (/var/log/apache2/error_log) for error messages. In particular, make sure that theApache user can read the keytab file.■ Note You can also use this syntax in an .htaccess file in a particular directory. See recipe 7-5 for a discussionof how to use htaccess.170Download at WoweBook.Com