[2519] in Kerberos
Re: What's the use of .klogin ??
daemon@ATHENA.MIT.EDU (Shawn Mamros)
Wed Jan 20 23:23:49 1993
Date: 20 Jan 93 22:20:41 GMT
From: mamros@athena.lkg.dec.com (Shawn Mamros)
Reply-To: mamros@athena.lkg.dec.com (Shawn Mamros)
To: kerberos@shelby.Stanford.EDU
For cross-realm authentication to work in Kerberos V4 (which is what I
assume you're using, since you're working with ~/.klogin instead of
~/.k5login), you need to do some work up front. Let's say you're on
Host1 in Realm1, and you want to rlogin to Host2 in Realm2. Here's
what needs to happen:
1) The two machines need to be able to recognize which machine belongs
to which realm. This is done through the /etc/krb.realms file on both
machines (see the krb.realms(5) man page).
2) Host1 needs to know the location of the Kerberos server(s) for Realm2.
This is done through the /etc/krb.conf file on Host1 (see the krb.conf(5)
man page). It might be nice to also have Host2 know the location of
the Kerberos server(s) for Realm1; it's probably mandatory to do so if
you're using the encrypted session option to rlogin.
3) The Kerberos servers in the two realms need to share a common key
so that they can "trust" each other. To do so, you need to have the
Kerberos administrators in both realms coordinate with each other.
The admin for Realm1 needs to create a Kerberos principal for
krbtgt.Realm2@Realm1 (substitute real realm names for Realm1 and Realm2),
and the admin for Realm2 needs to create a Kerberos principal for
krbtgt.Realm1@Realm2. BOTH PRINCIPALS MUST USE THE SAME KEY (password)
FOR THIS TO WORK - that's the shared secret.
Once this is done, then all you should need is a principal for
"rcmd.host2@Realm2" created in Realm2 and a key for that principal placed
in /etc/srvtab on Host2.
Good luck...
-Shawn Mamros
E-mail to: mamros@athena.lkg.dec.com
