Linux System Administration Recipes A Problem-Solution Approach

CHAPTER 2 ■ CENTRALIZING YOUR NETWORK: KERBEROS, LDAP, AND NFSYou should be challenged for the admin user’s password after the first command. Then the secondwill show you a list of authorized tickets, and you’ll see that you have an authorized principal krbadm inthere.2-1b. Kerberos Client SetupFor Debian/Ubuntu, use this:sudo apt-get install krb5-user ntpdatekrb5-user provides the klist and kinit utilities. ntpdate is needed because the time on the serverand client must match for the authentication to succeed (so that an attacker can’t use an out-of-daterequest).Edit /etc/krb5.conf to make sure that the following entries are correctly set—it should match yourserver setup values:[libdefaults]default_realm = EXAMPLE.COM[realms]EXAMPLE.COM = {kdc = kerberos.example.comadmin_server = kerberos.example.com}[domain_realm]example.com = EXAMPLE.COM.example.com = EXAMPLE.COM2-2. Setting Up Kerberos SSH and LogonThis recipe explains how to set up both the server and clients to use Kerberos for console or gdm logonand for SSH logon. Server here refers to any machine that you’re using ssh to connect to, and client refersto any machine that you’re using ssh from. We’ll use PAM to handle both ssh and local login. ForDebian/Ubuntu, run this:sudo apt-get install libpam-krb5 openssh-server libsasl2-dev libsasl2-modules-gssapi-mitEdit /etc/pam.d/common-auth and /etc/pam.d/common-session to use pam_krb5.so.1 (replace any existing lines):# /etc/pam.d/common-authauth sufficient pam_krb5.so use_first_pass ignore_root forwardableauth required pam_unix.so nullok_secure try_first_pass# /etc/pam.d/common-sessionsession sufficient pam_unix.sosession sufficient pam_krb5.so ignore_root26Download at WoweBook.Com