[33482] in Kerberos
kdc.conf and krb5.conf
daemon@ATHENA.MIT.EDU (Frank Dornheim)
Thu Jun 16 04:53:16 2011
MIME-Version: 1.0
Date: Thu, 16 Jun 2011 10:53:09 +0200
Message-ID: <BANLkTi=JfCfSkuvMeU5E3yvJupOoB+M1iA@mail.gmail.com>
From: Frank Dornheim <conloos@googlemail.com>
To: kerberos@mit.edu
Content-Type: text/plain; charset="utf-8"
Errors-To: kerberos-bounces@mit.edu
Content-Transfer-Encoding: 8bit
Hi list,
i asked my questions yesterday the irc (#kerberos at freenode) but ididn't get a full answer.
FIrst, i have a full working system. ;) I use Kerberos with a openLDAP backend.
At a review of my system i found several spelling errors (configs areat the end of this mail) in the kdc.conf, so the kdc.conf isn't usedby my config. I removed the kdc.conf and my Kerberos is working well.
That all is working is fine, but i want to understand that points.
So my questions:
* Is the kdc.conf obsolete? * Which config is the winner by a misconfiguration? ' Which parts had to be in both configs (not the specific points -the topics)?
Thanks Con
__krb5.conf__
[libdefaults] ticket_lifetime = "36000" default_realm = EXAMPLE.COM kdc_timesync = "1" forwardable = "true" forward = "true" renewable = "true" proxiable = "true" ccache_type = 4
# The following encryption type specification will be used by MIT Kerberos# if uncommented. In general, the defaults in the MIT Kerberos code are# correct and overriding these specifications only serves to disable new# encryption types as they are added, creating interoperability problems.## Thie only time when you might need to uncomment these lines and change# the enctypes is if you have local software that will break on ticket# caches containing ticket encryption types it doesn't know about (such as# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1# default_tkt_enctypes = des3-hmac-sha1# permitted_enctypes = des3-hmac-sha1
[realms] EXAMPLE.COM = { kdc = "kerberos.example.com:88" master_kdc = "kerberos.example.com:88" admin_server = "kerberos.example.com:749" default_domain = "example.com" database_module = ldap.example.com }
[domain_realm] .example.com = "EXAMPLE.COM" example.com = "EXAMPLE.COM"
[dbmodules] ldap.example.com = { db_library = kldap ldap_kerberos_container_dn = cn=krbcontainer,dc=example,dc=com
# the RO account ldap_kdc_dn = cn=krb5-kdc-srv,ou=services,dc=example,dc=com # this object needs to have read rights on # the realm container, principal container and realm sub-trees # the RW account ldap_kadmind_dn = cn=krb5-adm-srv,ou=services,dc=example,dc=com # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees
ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldaps://ldap.example.com ldap_conns_per_server = 5 }
__kdc.conf__
[kdcdefaults] kdc_ports = 750,88 default_real = EXAMPLE.COM ← spelling error: default realm
[realms] EXAMPLE = { <--spellinge error: EXAMPLE.COM database_name = /var/lib/krb5kdc/principal ← error: myconffig resides in LDAP admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab ← error: ididn't have this keytab, i found a howto(http://web.mit.edu/kerberos/krb5-1.5/krb5-1.5/doc/krb5-install/Create-a-kadmind-Keytab--optional-.html),to create this keyfile. But this keytab is obsolate? acl_file = /etc/krb5kdc/kadm5.acl key_stash_file = /etc/krb5kdc/.k5.EXAMPLE.COM kdc_ports = 750,88 max_life = 10h 0m 0s max_renewable_life = 7d 0h 0m 0s master_key_type = des3-hmac-sha1 supported_enctypes = aes256-cts:normal arcfour-hmac:normaldes3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealmdes:onlyrealm des:afs3 default_principal_flags = "+forwardable +preauth +renewable+pwservice +service" }
________________________________________________Kerberos mailing list Kerberos@mit.eduhttps://mailman.mit.edu/mailman/listinfo/kerberos
