Linux System Administration Recipes A Problem-Solution Approach

More documents

Recommendations

Info

CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFSand provide backup, as described in recipe 2-9. After getting the TGT request, the KDC looks up the user(referred to as the principal) in its database, retrieves their key, and then sends back a TGT encryptedwith that key. The client machine then uses the user’s password to decrypt the TGT, thus authorizing it.The important point here is that, like PGP encryption, this is an asymmetrical process. The passworddoesn’t get sent over the network: it’s just used locally. So, it’s not vulnerable to any kind of networkintercept, providing a massive security boost.After the TGT has been sent, it’s stored locally, and any Kerberized service will use it to ask for aservice-specific ticket. It proves who the user is, so they don’t need to enter their password again untilthe TGT expires (usually after ten hours) or is manually deleted. So, if your entire system is Kerberosauthenticated, you can log on once and then ssh to any system without having to reauthenticate. It’s notonly more secure but also easier to use!The process works very similarly for services or machines—except that a locally stored key is used toauthenticate nonpeople principals, instead of a password.■ Note If you want more information, there’s an excellent and very readable explanation of how Kerberos worksat http://web.mit.edu/kerberos/www/dialogue.html.2-1a. Server Installation and ConfigurationLog into the machine you want to use as your Kerberos server—let’s call it kerberos.example.com.Kerberos packages should be available for any major distribution (or you can of course compile fromsource, but I won’t cover that here). For Debian/Ubuntu, you’d use this:sudo apt-get install krb5-kdc krb5-admin-server libkrb5-dev krb5-config krb5-userkrb5-clients libkadm55■ Note This recipe uses the MIT version of Kerberos. The other main implementation available is Heimdal(originally developed as a non-U.S. version back when there were legal issues with the U.S.-based MIT versionbeing exported, which is no longer the case). MIT’s version is more widely used and slightly more active indevelopment terms. Windows and Java also come with their own versions of Kerberos, and other freeimplementations are available.During the installation of the packages, you’ll be asked for a couple of pieces of information. One isthe realm to use for krb5-config. This will usually be the uppercase version of the local DNS domain. So,for the example.com domain, the realm would be EXAMPLE.COM. You don’t need Kerberos v4 compatibility.If asked for the hostname of your server, this should be the fully qualified domain name (FQDN) of yourserver, so in this example it’s kerberos.example.com.Next you need to create your new realm using the krb5_newrealm command. You’ll be asked for amaster password. You should use a strong passphrase, and do not forget it because if you lose both thispassword and the stash file that Kerberos creates with it, you can’t decrypt your database again.22Download at WoweBook.Com
CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFS■ Note The important user who is created here is K/M@EXAMPLE.COM. Do not, when poking through your databaseat a later stage, think that you can’t remember creating this deliberately and therefore you should delete it,because that would break the database in a permanent and fairly catastrophic way.After this, most of the configuration is done in /etc/krb5.conf, which you should edit to looklike this:[libdefaults]default_realm EXAMPLE.COM[realms]EXAMPLE.COM = {kdc = kerberos.example.comadmin_server = kerberos.example.comdefault_domain = example.com}[domain_realm].example.com = EXAMPLE.COMexample.com = EXAMPLE.COM[login]krb4_convert = false[logging]kdc = FILE:/var/log/kerberos/krb5kdc.logadmin_server = FILE:/var/log/kerberos/kadmin.logdefault = FILE:/var/log/kerberos/krb5lib.logCheck that the /var/log/kerberos directory exists, and create it if it does not (it may or may not havebeen created by your package install). As mentioned, your realm should match your local domain. Inother words, if your domain is *.example.com, your default_realm will be EXAMPLE.COM.■ Note The capitalization is required here. The realm mapping means that your DNS domain and your Kerberosdomain don’t need to be identical (you can, for example, use subdomains).If you want to set up a slave Kerberos server as well as the master (see recipe2-8), you can have multiple KDC lines within the [realms] section. The KDC responds to TGT requests; itreads the database and generates encrypted TGTs. However, you have only a single admin_server, whichacts as the master KDC. This is the server that handles edits to the database (adding principals—users,machines, or services—and changing passwords, policies, and so on).The [logging] section is optional, but it will make debugging easier, and it shouldn’t affectperformance.Once you’re done editing, start the Kerberos admin server and the KDC:# /etc/init.d/krb5-admin-server start; /etc/init.d/krb5-kdc start23Download at WoweBook.Com
Page 2: Download at WoweBook.Com
Page 5 and 6: Download at WoweBook.Comiii
Page 7 and 8: Contents■About the Author .......
Page 9 and 10: ■ CONTENTS3-7. Writing a Nagios P
Page 11 and 12: ■ CONTENTS■Chapter 8: Using the
Page 13 and 14: ■ CONTENTSAbout the Author■Juli
Page 15 and 16: ■ CONTENTSAcknowledgmentsMany tha
Page 17 and 18: ■ CONTENTSIntroductionThis book i
Page 19 and 20: ■ INTRODUCTIONDownloading the Cod
Page 21 and 22: C H A P T E R 1■ ■ ■Saving Yo
Page 23 and 24: CHAPTER 1 ■ SAVING YOURSELF EFFOR
Page 41: C H A P T E R 2■ ■ ■Centraliz
Page 45 and 46: CHAPTER 2 ■ CENTRALIZING YOUR NET
Page 83 and 84: C H A P T E R 3■ ■ ■Monitorin
Page 85 and 86: CHAPTER 3 ■ MONITORING AND UPDATI
Page 93 and 94:
CHAPTER 3 ■ MONITORING AND UPDATI
Page 95 and 96:
Page 97 and 98:
Page 99 and 100:
Page 101 and 102:
Page 103 and 104:
Page 105 and 106:
Page 107 and 108:
Page 109 and 110:
Page 111 and 112:
Page 113 and 114:
Page 115 and 116:
C H A P T E R 4■ ■ ■Taking Ba
Page 117 and 118:
CHAPTER 4 ■ TAKING BACKUPS AND MA
Page 119 and 120:
Page 121 and 122:
Page 123 and 124:
Page 125 and 126:
Page 127 and 128:
Page 129 and 130:
Page 131 and 132:
Page 133 and 134:
Page 135 and 136:
Page 137 and 138:
Page 139 and 140:
C H A P T E R 5■ ■ ■Working w
Page 141 and 142:
CHAPTER 5 ■ WORKING WITH FILESYST
Page 143 and 144:
Page 145 and 146:
Page 147 and 148:
Page 149 and 150:
Page 151 and 152:
Page 153 and 154:
Page 155 and 156:
C H A P T E R 6■ ■ ■Securing
Page 157 and 158:
CHAPTER 6 ■ SECURING YOUR SYSTEMS
Page 159 and 160:
Page 161 and 162:
Page 163 and 164:
Page 165 and 166:
Page 167 and 168:
Page 169 and 170:
Page 171 and 172:
Page 173 and 174:
Page 175 and 176:
Page 177 and 178:
Page 179 and 180:
CHAPTER 7 ■ WORKING WITH APACHEOn
Page 181 and 182:
CHAPTER 7 ■ WORKING WITH APACHEdi
Page 183 and 184:
CHAPTER 7 ■ WORKING WITH APACHE4.
Page 185 and 186:
CHAPTER 7 ■ WORKING WITH APACHE
Page 187 and 188:
CHAPTER 7 ■ WORKING WITH APACHEAl
Page 189 and 190:
CHAPTER 7 ■ WORKING WITH APACHE
Page 191 and 192:
C H A P T E R 8■ ■ ■Making Be
Page 193 and 194:
CHAPTER 8 ■ USING THE COMMAND LIN
Page 195 and 196:
Page 197 and 198:
Page 199 and 200:
Page 201 and 202:
Page 203 and 204:
Page 205 and 206:
Page 207 and 208:
CHAPTER 9 ■ WORKING WITH TEXT IN
Page 209 and 210:
Page 211 and 212:
Page 213 and 214:
Page 215 and 216:
Page 217 and 218:
Page 219 and 220:
Page 221 and 222:
Page 223 and 224:
C H A P T E R 10■ ■ ■Things G
Page 225 and 226:
CHAPTER 10 ■ THINGS GO IN, THINGS
Page 227 and 228:
Page 229 and 230:
Page 231 and 232:
Page 233 and 234:
C H A P T E R 11■ ■ ■Tracking
Page 235 and 236:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 237 and 238:
CHAPTER 11 ■ TRACKING DOWN BUGS01
Page 239 and 240:
CHAPTER 11 ■ TRACKING DOWN BUGS
Page 241 and 242:
Page 243 and 244:
Page 245 and 246:
CHAPTER 11 ■ TRACKING DOWN BUGSTh
Page 247 and 248:
CHAPTER 11 ■ TRACKING DOWN BUGSAn
Page 249 and 250:
CHAPTER 11 ■ TRACKING DOWN BUGS#
Page 251 and 252:
C H A P T E R 12■ ■ ■Managing
Page 253 and 254:
CHAPTER 12 ■ MANAGING TIME AND PE
Page 255 and 256:
Page 257 and 258:
Page 259 and 260:
Page 261 and 262:
Page 263 and 264:
Page 265 and 266:
Page 267 and 268:
APPENDIX■ ■ ■Perl TipsSee rec
Page 269 and 270:
APPENDIX ■ PERL TIPS• Date::Par
Page 271 and 272:
APPENDIX ■ PERL TIPSPerl Syntax N
Page 273 and 274:
■ ■ ■Index■Symbols$CDPATH,
Page 275 and 276:
■ INDEXenscript option (printing)
Page 277 and 278:
■ INDEX■NNagiosadding hosts to,
Page 279 and 280:
■ INDEXsyslogcentralized logging
Page 281 and 282:
Download at WoweBook.Com
show all

Linux System Administration Recipes A Problem-Solution Approach

You also want an ePaper? Increase the reach of your titles

Delete template?

Save as template?