Example - Setting up an MIT KDC Server

Follow this procedure to install and configure a Kerberos KDC server on a Red Hat Enterprise Linux host. The KDC server resides on the host named <kdc-server>.

  1. Log in to the Kerberos KDC Server system as a superuser:

    1. $ ssh root@<kdc-server>
    2. root@kdc-server$

  2. Install the Kerberos server packages:

    1. root@kdc-server$ yum install krb5-libs krb5-server krb5-workstation

  3. Define the Kerberos realm for your cluster by editting the /etc/krb5.conf configuration file. The following example configures a Kerberos server with a realm named REALM.DOMAIN residing on a host named hawq-kdc.

    1. [logging]
    2.  default = FILE:/var/log/krb5libs.log
    3.  kdc = FILE:/var/log/krb5kdc.log
    4.  admin_server = FILE:/var/log/kadmind.log
    6. [libdefaults]
    7.  default_realm = REALM.DOMAIN
    8.  dns_lookup_realm = false
    9.  dns_lookup_kdc = false
    10.  ticket_lifetime = 24h
    11.  renew_lifetime = 7d
    12.  forwardable = true
    13.  default_tgs_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
    14.  default_tkt_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
    15.  permitted_enctypes = aes128-cts des3-hmac-sha1 des-cbc-crc des-cbc-md5
    17. [realms]
    18.  REALM.DOMAIN = {
    19.   kdc = hawq-kdc:88
    20.   admin_server = hawq-kdc:749
    21.   default_domain = hawq-kdc
    22.  }
    24. [domain_realm]
    25.  .hawq-kdc = REALM.DOMAIN
    26.  hawq-kdc = REALM.DOMAIN
    28. [appdefaults]
    29.  pam = {
    30.     debug = false
    31.     ticket_lifetime = 36000
    32.     renew_lifetime = 36000
    33.     forwardable = true
    34.     krb4_convert = false
    35.    }

    The kdc and admin_server keys in the [realms] section specify the host (hawq-kdc) and port on which the Kerberos server is running. You can use an IP address in place of a host name.

    If your Kerberos server manages authentication for other realms, you would instead add the REALM.DOMAINM realm in the [realms] and [domain_realm] sections of the krb5.conf file. See the Kerberos documentation for detailed information about the krb5.conf configuration file.

  4. Note the Kerberos KDC server host name or IP address and the name of the realm in which your cluster resides. You will need this information in later procedures.

  5. Create a Kerberos KDC database by running the kdb5_util command:

    1. root@kdc-server$ kdb5_util create -s

    The kdb5_util create command creates the database in which the keys for the Kerberos realms managed by this KDC server are stored. The -s option instructs the command to create a stash file. Without the stash file, the KDC server will request a password every time it starts.

  6. Add an administrative user to the Kerberos KDC database with the kadmin.local utility. Because it does not itself depend on Kerberos authentication, the kadmin.local utility allows you to add an initial administrative user to the local Kerberos server. To add the user admin as an administrative user to the KDC database, run the following command:

    1. root@kdc-server$ kadmin.local -q "addprinc admin/admin"

    Most users do not need administrative access to the Kerberos server. They can use kadmin to manage their own principals (for example, to change their own password). For information about kadmin, see the Kerberos documentation.

  7. If required, edit the /var/kerberos/krb5kdc/kadm5.acl file to grant the appropriate permissions to admin.

  8. Start the Kerberos daemons:

    1. root@kdc-server$ /sbin/service krb5kdc start
    2. root@kdc-server$ /sbin/service kadmin start

  9. To start Kerberos automatically upon system restart:

    1. root@kdc-server$ /sbin/chkconfig krb5kdc on
    2. root@kdc-server$ /sbin/chkconfig kadmin on