Find knowledge base article(s) by searching for keywords in the title e.g. type linux in the search box below
Find knowledge base article(s) by browsing the subject categories of articles
Technology quick references, cheatsheets, user manuals etc.
Shop Online through ShopifyLite
Tutorials on various IT applications.
Search Title    (UL:0 |SS:f)

Software >> OS >> Unix >> Linux >> RHEL >> 7 >> RHCE >> System configuration and management part 2

Configure a system to authenticate using Kerberos

 

### KDC Server setup (rhel7mgmt1.myexample.com)

## assume the following servers
## (1) KDC server - 192.168.0.30 : rhel7mgmt1.myexample.com
## (2) KDC client - 192.168.0.20 : rhel7client1.myexample.com
##
## in lieu of DNS, add the following to /etc/hosts file of all the machines

192.168.0.10  rhel7server1 rhel7server1.myexample.com
192.168.0.20  rhel7client1 rhel7client1.myexample.com
192.168.0.30  rhel7mgmt1   rhel7mgmt1.myexample.com

## on rhel7mgmt1

[root@rhel7mgmt1 ~]# yum -y install krb5-server krb5-workstation pam_krb5
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
...
Complete!


## edit kdc.conf

[root@rhel7mgmt1 ~]# cd /var/kerberos/krb5kdc

[root@rhel7mgmt1 krb5kdc]# vi kdc.conf


# - under [realm] change from EXAMPLE.COM => MYEXAMPLE.COM
# - to force krb5 only
# - uncomment master_key_type : master_key_type = aes256-cts
#   and add : default_principal_flags = +preauth
/var/kerberos/krb5kdc/kdc.conf

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88

[realms]
 MYEXAMPLE.COM = {
  # uncomment next 2 lines if we want to be compatible with Kerberos 5 ONLY
  master_key_type = aes256-cts
   default_principal_flags = +preauth
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
 }


## edit /etc/krb5.conf


[root@rhel7mgmt1 ~]# vi /etc/krb5.conf

# - replace all EXAMPLE.COM with MYEXAMPLE.COM
# - uncomment default realm
# - update entries in [realm] with your server details
# - update entries in [domain_realm] with your domain

/etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = MYEXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 MYEXAMPLE.COM = {
  kdc = rhel7mgmt1.myexample.com
  admin_server = rhel7mgmt1.myexample.com
 }

[domain_realm]
 .myexample.com = MYEXAMPLE.COM
 myexample.com = MYEXAMPLE.COM


## edit /var/kerberos/krb5kdc/kadm5.acl


[root@rhel7mgmt1 ~]# vi /var/kerberos/krb5kdc/kadm5.acl

# - change from EXAMPLE.COM to MYEXAMPLE.COM
 

/var/kerberos/krb5kdc/kadm5.acl
*/admin@MYEXAMPLE.COM    *


## create KDB database

[root@rhel7mgmt1 krb5kdc]# kdb5_util create -s -r MYEXAMPLE.COM
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'MYEXAMPLE.COM',
master key name 'K/M@MYEXAMPLE.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

## enable and then start the KDC services

[root@rhel7mgmt1 krb5kdc]# systemctl enable krb5kdc kadmin
Created symlink from /etc/systemd/system/multi-user.target.wants/krb5kdc.service to /usr/lib/systemd/system/krb5kdc.service.
Created symlink from /etc/systemd/system/multi-user.target.wants/kadmin.service to /usr/lib/systemd/system/kadmin.service.

[root@rhel7mgmt1 krb5kdc]# systemctl start krb5kdc

[root@rhel7mgmt1 krb5kdc]# systemctl start kadmin


## create an admin principal for this system
## root/admin => either root or admin

[root@rhel7mgmt1 krb5kdc]# kadmin.local
Authenticating as principal root/admin@MYEXAMPLE.COM with password.
kadmin.local:  addprinc root/admin
WARNING: no policy specified for root/admin@MYEXAMPLE.COM; defaulting to no policy
Enter password for principal "root/admin@MYEXAMPLE.COM":
Re-enter password for principal "root/admin@MYEXAMPLE.COM":
Principal "root/admin@MYEXAMPLE.COM" created.


## add user

kadmin.local:  addprinc krbtest
WARNING: no policy specified for krbtest@MYEXAMPLE.COM; defaulting to no policy
Enter password for principal "krbtest@MYEXAMPLE.COM":
Re-enter password for principal "krbtest@MYEXAMPLE.COM":
Principal "krbtest@MYEXAMPLE.COM" created.


## add kdc server into kerberos database

kadmin.local:  addprinc -randkey host/rhel7mgmt1.myexample.com
WARNING: no policy specified for host/rhel7mgmt1.myexample.com@MYEXAMPLE.COM; defaulting to no policy
Principal "host/rhel7mgmt1.myexample.com@MYEXAMPLE.COM" created.


## add a local copy stored in a keytab file - it will create /etc/krb5.keytab

kadmin.local:  ktadd host/rhel7mgmt1.myexample.com
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7mgmt1.myexample.com with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

kadmin.local:  quit


## edit ssh_config
## this is for testing SSH locally, this setting is for the SSH client side,
## not required if not doing SSH locally

[root@rhel7mgmt1 krb5kdc]# vi /etc/ssh/ssh_config


# uncomment GSSAPIAuthentication & set the value to yes
# uncomment GSSAPIDelegateCredentials & set the value to yes

   GSSAPIAuthentication yes
   GSSAPIDelegateCredentials yes


## edit sshd_config, ensure UseDNS and GSSAPIAuthentication are set to yes

UseDNS yes
GSSAPIAuthentication yes


## reload sshd and enable kerberos authentication

[root@rhel7mgmt1 krb5kdc]# systemctl reload sshd

[root@rhel7mgmt1 krb5kdc]# authconfig --enablekrb5 --update


## create a service for kerberos to ensure the required firewall ports are open

[root@rhel7mgmt1 ~]# cd /etc/firewalld/services

[root@rhel7mgmt1 services]# vi kerberos.xml

/etc/firewalld/services/kerberos.xml
<?xml version="1.0" encoding="utf-8"?>
<service>
  <short>Kerberos</short>
  <description>Kerberos network authentication protocol server</description>
  <port protocol="tcp" port="88"/>
  <port protocol="udp" port="88"/>
  <port protocol="tcp" port="749"/>
</service>


## apply the firewall rule

[root@rhel7mgmt1 services]# firewall-cmd --permanent --add-service=kerberos
success

[root@rhel7mgmt1 services]# firewall-cmd --reload
success


## create user and then test locally

 [root@rhel7mgmt1 services]# useradd krbtest

[root@rhel7mgmt1 services]# su - krbtest

[krbtest@rhel7mgmt1 ~]$ kinit
Password for krbtest@MYEXAMPLE.COM:

[krbtest@rhel7mgmt1 ~]$ klist
Ticket cache: KEYRING:persistent:1001:1001
Default principal: krbtest@MYEXAMPLE.COM

Valid starting       Expires              Service principal
06/17/2020 12:51:10  06/18/2020 12:51:07  krbtgt/MYEXAMPLE.COM@MYEXAMPLE.COM


## when you ssh in this session, you should be able to login without being further prompted for password
## for the kerberos authentication to work the source IP used to connect must resolve back to the hostname added as the host principal earlier


[krbtest@rhel7mgmt1 ~]$ ssh rhel7mgmt1.myexample.com
The authenticity of host 'rhel7mgmt1.myexample.com (192.168.0.30)' can't be established.
ECDSA key fingerprint is SHA256:vNpmvuXbPajqQUZz4J+wzqni3r6SN0oxJE70Uy6iabg.
ECDSA key fingerprint is MD5:6f:05:e9:4e:37:25:b5:99:e0:49:99:14:d4:1c:e5:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'rhel7mgmt1.myexample.com,192.168.0.30' (ECDSA) to the list of known hosts.
Last login: Wed Jun 17 12:51:03 2020
[krbtest@rhel7mgmt1 ~]$


back to Objectives

 

Configure a System to Authenticate Using Kerberos - Client Setup


### KDC Client Setup (rhel7client1.myexample.com)


## install the requied packages

[root@rhel7client1 ~]# yum -y install krb5-workstation pam_krb5
Loaded plugins: langpacks, product-id, search-disabled-repos, subscription-manager
...
Complete!


## edit /etc/krb5.conf and use the same config as the server

/etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 dns_lookup_realm = false
 ticket_lifetime = 24h
 renew_lifetime = 7d
 forwardable = true
 rdns = false
 default_realm = MYEXAMPLE.COM
 default_ccache_name = KEYRING:persistent:%{uid}

[realms]
 MYEXAMPLE.COM = {
  kdc = rhel7mgmt1.myexample.com
  admin_server = rhel7mgmt1.myexample.com
 }

[domain_realm]
 .myexample.com = MYEXAMPLE.COM
 myexample.com = MYEXAMPLE.COM


## connect to kadmin server and then add the host principal for this client

[root@rhel7client1 ~]# kadmin
Authenticating as principal root/admin@MYEXAMPLE.COM with password.
Password for root/admin@MYEXAMPLE.COM:

kadmin:  addprinc -randkey host/rhel7client1.myexample.com
WARNING: no policy specified for host/rhel7client1.myexample.com@MYEXAMPLE.COM; defaulting to no policy
Principal "host/rhel7client1.myexample.com@MYEXAMPLE.COM" created.

kadmin:  ktadd host/rhel7client1.myexample.com
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type arcfour-hmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type camellia256-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type camellia128-cts-cmac added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type des-hmac-sha1 added to keytab FILE:/etc/krb5.keytab.
Entry for principal host/rhel7client1.myexample.com with kvno 2, encryption type des-cbc-md5 added to keytab FILE:/etc/krb5.keytab.

kadmin:  quit


## edit /etc/ssh/ssh_config

[root@rhel7client1 ~]# vi /etc/ssh/ssh_config


# uncomment GSSAPIAuthentication & set the value to yes
# uncomment GSSAPIDelegateCredentials & set the value to yes

   GSSAPIAuthentication yes
   GSSAPIDelegateCredentials yes


## enable authentication using kerberos

[root@rhel7client1 ~]# authconfig --enablekrb5 --update


## create the user

[root@rhel7client1 ~]# useradd krbtest


## verify kerberos authentication for the krbtest user from this Kerberos client

[root@rhel7client1 ~]# su - krbtest

[krbtest@rhel7client1 ~]$ kinit
Password for krbtest@MYEXAMPLE.COM:

[krbtest@rhel7client1 ~]$ klist
Ticket cache: KEYRING:persistent:1001:1001
Default principal: krbtest@MYEXAMPLE.COM

Valid starting       Expires              Service principal
06/17/2020 13:22:16  06/18/2020 13:22:12  krbtgt/MYEXAMPLE.COM@MYEXAMPLE.COM

[krbtest@rhel7client1 ~]$ ssh rhel7mgmt1.myexample.com
The authenticity of host 'rhel7mgmt1.myexample.com (192.168.0.30)' can't be established.
ECDSA key fingerprint is SHA256:vNpmvuXbPajqQUZz4J+wzqni3r6SN0oxJE70Uy6iabg.
ECDSA key fingerprint is MD5:6f:05:e9:4e:37:25:b5:99:e0:49:99:14:d4:1c:e5:cc.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'rhel7mgmt1.myexample.com,192.168.0.30' (ECDSA) to the list of known hosts.
Last login: Wed Jun 17 12:52:16 2020 from rhel7mgmt1.myexample.com
 [krbtest@rhel7mgmt1 ~]$

back to Objectives

 

 
[ © 2008-2021 myfaqbase.com - A property of WPDC Consulting ]