Linux System Administration Recipes A Problem-Solution Approach

C H A P T E R 2■ ■ ■Centralizing Your Network:Kerberos, LDAP, and NFSA basic rule is to centralize whenever you can. A prime candidate for centralization is yourauthentication and identity setup, and the best way to do this (as discussed at the start of recipe 2-1) is tocombine LDAP for directory information and Kerberos for authentication. Most of this chapter dealswith setting up LDAP and Kerberos, including showing how to script your interactions with LDAP andhow to set up backup (slave) servers for both Kerberos and LDAP so that a master server failure won’t bedisastrous. You can also set up NFS to use LDAP to store automount maps, so the final recipes in thechapter cover how to do that, as well as giving a couple of other useful NFS tips.2-1. Setting Up Kerberos AuthenticationLinux offers plenty of options for authentication. The most basic is, of course, just to use the /etc/password and /etc/shadow files, but if you’re running any sort of centralized system, that’s not a solutionthat is that easy to maintain. NIS or NIS+ is another old option that is still in use in some places, but Sunis no longer developing or recommending it, since Sun is in favor of LDAP.LDAP is currently the most popular option for both directory lookup and authentication (theMicrosoft Active Directory software uses LDAP for its directory services), but although LDAP is excellentas a directory solution (storing information about your machines and users), it’s not so secure forauthentication. You can increase its security with TLS, but it still won’t provide the same level of authsecurity that Kerberos does.Kerberos, on the other hand, is explicitly designed to handle authentication and onlyauthentication, of both users and machines. The good news is that Kerberos and LDAP work very nicelytogether. If you’re starting from scratch, it’s easiest to set up Kerberos first (covered in this recipe) andthen LDAP (covered in the next). If you already have LDAP running, you should be able to follow the nextrecipe and make the appropriate changes.How Kerberos WorksBefore starting the setup, it’s worth taking a quick look at how Kerberos works. When a user logs in totheir machine, they request a ticket-granting ticket (TGT) from the key distribution center (KDC). TheKDC is usually your main Kerberos server; you can also set up multiple slave servers to spread the load21Download at WoweBook.Com