[24043] in Kerberos
Re: One DNS domain - three realms ?
daemon@ATHENA.MIT.EDU (Ken Raeburn)
Mon Jun 6 16:15:04 2005
In-Reply-To: <BAY12-F229743BDFC9A3EC17E7AA39CFB0@phx.gbl>
Mime-Version: 1.0 (Apple Message framework v622)
Content-Type: text/plain; charset=US-ASCII; format=flowed
Message-Id: <03da384d3e81ff59dfba25887b640766@mit.edu>
Content-Transfer-Encoding: 7bit
From: Ken Raeburn <raeburn@mit.edu>
Date: Mon, 6 Jun 2005 16:14:14 -0400
To: "Manel Euro" <euro_32@hotmail.com>
cc: kerberos@mit.edu
Errors-To: kerberos-bounces@mit.edu
On Jun 6, 2005, at 06:42, Manel Euro wrote:
> My company has the following situation:
>
> We have one large DNS domain sgi.nl and we are planning on creating
> three realms:
>
> SGI.NL
> A.SGI.NL
> B.SGI.NL
>
> When configuraing my kerberos clientes there is a [domains_realm] tab
> where should put my domains to realm maps.
Yes, this is where the mapping goes. But if machines in one DNS domain
are being mapped to three realms, you're going to have to list each
machine individually instead of simply mapping the entire domain:
[domain_realm]
host1.sgi.nl = SGL.NL
host2.sgi.nl = A.SGI.NL
host3.sgi.nl = B.SGI.NL
Or, rather, you could make one realm the default and just list all of
the machine in the other realms:
[domain_realm]
.sgi.nl = SGI.NL
host2.sgi.nl = A.SGI.NL
host3.sgi.nl = B.SGI.NL
Either way, this will be a bit of a headache if/when you add new
machines not in the default realm, as you'll need to update all the
config files.
There is also an option "dns_lookup_realm" in the "libdefaults" section
of the config file which, if turned on, will cause a DNS TXT record
_kerberos.<FQDN> to be checked and, if it's found, the result used as
the realm name for the host <FQDN>. However, this option is turned off
by default as it introduces a security risk.
Ken
________________________________________________
Kerberos mailing list Kerberos@mit.edu
https://mailman.mit.edu/mailman/listinfo/kerberos
