[7959] in Kerberos
Re: Confused on internet wide kerberos encryption
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Sat Sep 14 16:56:08 1996
Date: Sat, 14 Sep 1996 16:41:56 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: Nick Kralevich <nickkral@ferrari.autobahn.org>
Cc: kerberos@MIT.EDU
In-Reply-To: [7955]
Let's say I choose two computers at random, both of which are running
kerberos aware clients, but are not in the same relm. ...
How can I get an encrypted session from work to home, or visa
versa.
A number of people have responded "you need to use inter-realm
authentication." You *can* use inter-realm authentication, but you do
not need to.
I think what is confusing you is that a Kerberos realm has nothing to
do with the IP address or domain name of a host. Suppose you have a
machine called work.com at work, in the Kerberos realm WORK.COM, and a
machine home.org at home, in the Kerberos realm HOME.ORG. You can,
while logged in to home.org, obtain tickets for a user in the WORK.COM
realm. Unless the Kerberos server for WORK.COM has been specially
modified to limit access by IP address (the MIT distribution does not
support such functionality), it does not care where the initial ticket
request comes from. So, for example:
home% kinit nickrral@WORK.COM
Password for nickrral@WORK.COM: <enter password here>
home% telnet -ax work.com
<a Kerberos-authenticated and encrypted telnet session will result>
For this to work, all you need is a configuration file on home.org
that tells Kerberos programs (like kinit and telnet) the name of the
Kerberos server for the WORK.COM realm. In V4, that file was called
krb.conf. In recent versions of V5, that file is called krb5.conf.
It might look like this:
[realms]
ATHENA.MIT.EDU = {
kdc = KERBEROS.MIT.EDU
admin_server = KERBEROS.MIT.EDU
default_domain = MIT.EDU
}
WORK.COM = {
kdc = krb-server.work.com
}
and so forth (documentation for the krb5.conf file appears in the
current V5 releases).
In fact, your home machine home.org does not have to have its own
Kerberos realm HOME.ORG at all. It can, if you want. But kinit will
run as happily on a machine connected via SLIP/PPP through your ISP as
it will through a machine physically at your office on the ethernet.
So what, then, is inter-realm authentication for? If you really did
have a Kerberos realm called HOME.ORG, and you wanted Kerberos servers
(such as telnetd) in the WORK.COM domain to be able to inertact with
principals in the HOME.ORG realm, then you could have to set up
inter-realm authentication between HOME.ORG and WORK.COM. But if all
you want is to have your machine operate in the WORK.COM realm, you
just have to set on krb.conf or krb5.conf correctly.
Does this machine sense?
Barry
