基礎
系統 Centos 7
目標
mac ==> Kerberos 驗證權限,獲取ticket
服務器端安裝
安裝軟件
sudo yum install krb5-server krb5-libs pam_krb5 -y
修改配置文件
krb5.conf
kerberos的配置文件 下面是配置文件詳解
配置文件參考文檔
提前設置後配置文件中用到的域名解析.
kerberos.yufuid.org ==> 10.0.12.12
sudo vim /etc/krb5.conf
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h \ticket過期時間
renew_lifetime = 7d \可續期的時間,時間內不需要輸入權限,即可續簽票證.windows,mac可在用戶無感知情況下,完成續期
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = YUFUID.ORG \ 這裏需要和下方realms中相同.字段無具體意義,只需要相同即可.
default_ccache_name = KEYRING:persistent:%{uid}
dns_lookup_kdc = false
[realms]
YUFUID.ORG = { \ 修改次字段,字段無具體意義,只需要相同即可.
kdc = kerberos.yufuid.org \填寫kdc的服務器地址,我們的demo中kerberos和kdc安裝在一臺服務器上,填寫此臺服務器ip或者域名.
admin_server = kerberos.yufuid.org \填寫此臺服務器ip或者域名
}
[domain_realm]
.yufuid.org = YUFUID.ORG \ 標準寫法,前方是後期需要接入kerberos認證資源的域名.例如: appservice1.yufuid.org需要通過 kerberos進行ssh認證.
yufuid.org = YUFUID.ORG
kdc.conf
kdc是kerberos的數據庫,主要存儲認證信息
sudo vim /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
YUFUID.ORG = { \ 修改次字段,字段無具體意義,只需要相同即可.
#master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes256-cts:normal aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal camellia256-cts:normal camellia128-cts:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
創建數據庫
使用之前realms中的標籤字段
創建時設置kdb數據庫密碼
$ kdb5_util create -s -r YUFUID.ORG
Loading random data
Initializing database ‘/var/kerberos/krb5kdc/principal’ for realm ‘YUFUID.COM’,
master key name ‘K/[email protected]’
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
kdb5_util: Permission denied while creating database ‘/var/kerberos/krb5kdc/principal’
修改acl
設置可以訪問kdb的用戶和來源主機
sudo vim /var/kerberos/krb5kdc/kadm5.acl
*/[email protected] *
初始化數據庫
使用本地管理員進入kdc,創建nanzhang 的用戶
kerberos常用命令
kadmin.local
Authenticating as principal root/[email protected] with password.
kadmin.local: addprinc nanzhang
WARNING: no policy specified for [email protected]; defaulting to no policy
Enter password for principal “[email protected]”:
Re-enter password for principal “[email protected]”:
Principal “[email protected]” created.
創建管理員賬戶
kadmin.local: addprinc root/admin
WARNING: no policy specified for root/[email protected]; defaulting to no policy
Enter password for principal “root/[email protected]”:
Re-enter password for principal “root/[email protected]”:
Principal “root/[email protected]” created.
查看nanzhang和管理員 用戶
kadmin.local: listprincs
K/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kadmin/[email protected]
kiprop/[email protected]
krbtgt/[email protected]
[email protected]
root/[email protected]
kadmin.local:
啓動kerberos服務
sudo systemctl restart krb5kdc.service
sudo systemctl restart kadmin.service
sudo systemctl enable krb5kdc.service
sudo systemctl enable kadmin.service
到此服務器端配置完畢
mac客戶端安裝
mac版本
10.14.3
修改mac下的ker配置
配置文件內容和服務器/etc/krb5.conf相同,但是沒有這一行 "includedir /etc/krb5.conf.d/
"
vim /Library/Preferences/edu.mit.Kerberos
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h \ticket過期時間
renew_lifetime = 7d \可續期的時間,時間內不需要輸入權限,即可續簽票證.windows,mac可在用戶無感知情況下,完成續期
forwardable = true
rdns = false
pkinit_anchors = /etc/pki/tls/certs/ca-bundle.crt
default_realm = YUFUID.ORG \ 這裏需要和下方realms中相同.字段無具體意義,只需要相同即可.
default_ccache_name = KEYRING:persistent:%{uid}
dns_lookup_kdc = false
[realms]
YUFUID.ORG = { \ 修改次字段,字段無具體意義,只需要相同即可.
kdc = kerberos.yufuid.org \填寫kdc的服務器地址,我們的demo中kerberos和kdc安裝在一臺服務器上,填寫此臺服務器ip或者域名.
admin_server = kerberos.yufuid.org \填寫此臺服務器ip或者域名
}
[domain_realm]
.yufuid.org = YUFUID.ORG \ 標準寫法,前方是後期需要接入kerberos認證資源的域名.例如: appservice1.yufuid.org需要通過 kerberos進行ssh認證.
yufuid.org = YUFUID.ORG
通過認證,測試mac端訪問kerberos服務器端
通過iterm
Sam-MacBook-Air:~ Sam$ kinit nanzhang
[email protected]’s password:
Sam-MacBook-Air:~ Sam$ klist
Credentials cache: API:4C347D78-DC4B-435E-B4EC-1372A0919F46
Principal: [email protected]
Issued Expires Principal
Jun 18 14:28:51 2019 Jun 19 14:28:46 2019 krbtgt/[email protected]