[29437] in Kerberos
RE: Help: noaddresses help
daemon@ATHENA.MIT.EDU (Edgecombe, Jason)
Mon Mar 10 15:13:27 2008
Content-class: urn:content-classes:message
MIME-Version: 1.0
Date: Mon, 10 Mar 2008 09:07:38 -0400
Message-ID: <A01ABA2A211C644596549C5FF91C50E41DA78262@EXEVS02.its.uncc.edu>
In-Reply-To: <ee0555cc-5a3d-4804-84af-24daaf2e19df@s13g2000prd.googlegroups.com>
From: "Edgecombe, Jason" <jwedgeco@uncc.edu>
To: <jeetjoshi4u@gmail.com>, <kerberos@mit.edu>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Errors-To: kerberos-bounces@mit.edu
I part of the network is behind NAT, then using addressless tickets or
cross-realm authentication is the answer.
In the addressless case, your KDC must be seen from inside and outside
the NAT. I think in this case, the kdc must be dual-home on both
networks.
Put the following in the krb5.conf file in all client machines and put
the noaddresses line in the kdc config as well.
[libdefaults]
forwardable = true
noaddresses = true
In your case, all machine that people will ssh to from the gateway must
have host principals installed correctly to enable single sign-on.
If you pursue the cross-realm route, noaddresses may or may not be
necessary, but host principals are still necessary in addition to the
host principals.
Jason
Jason Edgecombe
Solaris & Linux Administrator
Mosaic Computing Group, College of Engineering
UNC-Charlotte
Phone: (704) 687-3514
-----Original Message-----
From: kerberos-bounces@mit.edu [mailto:kerberos-bounces@mit.edu] On
Behalf Of jeetjoshi4u@gmail.com
Sent: Friday, March 07, 2008 6:13 AM
To: kerberos@mit.edu
Subject: Re: Help: noaddresses help
Hello Everyone,
I am still searching for any solution on the situation
described.
Hoping for any help.
Thank you
Jeet
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
