Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFS■ Note The important user who is created here is K/M@EXAMPLE.COM. Do not, when poking through your databaseat a later stage, think that you can’t remember creating this deliberately and therefore you should delete it,because that would break the database in a permanent and fairly catastrophic way.After this, most of the configuration is done in /etc/krb5.conf, which you should edit to looklike this:[libdefaults]default_realm EXAMPLE.COM[realms]EXAMPLE.COM = {kdc = kerberos.example.comadmin_server = kerberos.example.comdefault_domain = example.com}[domain_realm].example.com = EXAMPLE.COMexample.com = EXAMPLE.COM[login]krb4_convert = false[logging]kdc = FILE:/var/log/kerberos/krb5kdc.logadmin_server = FILE:/var/log/kerberos/kadmin.logdefault = FILE:/var/log/kerberos/krb5lib.logCheck that the /var/log/kerberos directory exists, and create it if it does not (it may or may not havebeen created by your package install). As mentioned, your realm should match your local domain. Inother words, if your domain is *.example.com, your default_realm will be EXAMPLE.COM.■ Note The capitalization is required here. The realm mapping means that your DNS domain and your Kerberosdomain don’t need to be identical (you can, for example, use subdomains).If you want to set up a slave Kerberos server as well as the master (see recipe2-8), you can have multiple KDC lines within the [realms] section. The KDC responds to TGT requests; itreads the database and generates encrypted TGTs. However, you have only a single admin_server, whichacts as the master KDC. This is the server that handles edits to the database (adding principals—users,machines, or services—and changing passwords, policies, and so on).The [logging] section is optional, but it will make debugging easier, and it shouldn’t affectperformance.Once you’re done editing, start the Kerberos admin server and the KDC:# /etc/init.d/krb5-admin-server start; /etc/init.d/krb5-kdc start23Download at WoweBook.Com