Installation guide

Chapter 10. Kerberos 141
KDC from kerberos.example.com to the name of your Kerberos server. By convention,
all realm names are uppercase and all DNS hostnames and domain names are lowercase. For
full details on the formats of these files, see their respective man pages.
4. Create the database using the kdb5_util utility from a shell prompt:
/usr/kerberos/sbin/kdb5_util create -s
The create command creates the database that will be used to store keys for your Kerberos
realm. The -s switch forces creation of a stash file in which the master server key is stored. If
no stash file is present from which to read the key, the Kerberos server (krb5kdc) will prompt
the user for the master server password (which can be used to regenerate the key) every time it
starts.
5. Edit the /var/kerberos/krb5kdc/kadm5.acl file. This file is used by kadmind to deter-
mine which principals have access to the Kerberos database and their level of access. Most
organizations will be able to get by with a single line:
*/[e-mail] *
Most users will be represented in the database by a single principal (with a NULL, or empty,
instance, such as [e-mail]). With this configuration, users with a second principal
with an instance of admin (for example, joe/[e-mail]) will be able to wield full
power over the realm’s Kerberos database.
Once kadmind is started on the server, any user will be able to access its services by run-
ning kadmin on any of the clients or servers in the realm. However, only users listed in the
kadm5.acl file will be able to modify the database in any way, except for changing their own
passwords.
Note
The kadmin utility communicates with the kadmind server over the network, and they use
Kerberos to handle authentication. Of course, you need to create the first principal before you
can connect to the server over the network to administer it. Create the first principal with the
kadmin.local command, which is specifically designed to be used on the same host as the
KDC and does not use Kerberos for authentication.
Type the following kadmin.local command at the KDC terminal to create the first principal:
/usr/kerberos/sbin/kadmin.local -q "addprinc username/admin"
6. Start Kerberos using the following commands:
/sbin/service krb5kdc start
/sbin/service kadmin start
/sbin/service krb524 start
7. Add principals for your users using the addprinc command with kadmin. kadmin and kad-
min.local on the master KDC are a command line interfaces to the Kerberos administration
system. As such, many commands are available after launching the kadmin program. Please
see the kadmin man page for more information.
8. Verify that your server will issue tickets. First, run kinit to obtain a ticket and store it in
a credential cache file. Then use klist to view the list of credentials in your cache and use
kdestroy to destroy the cache and the credentials it contains.
Note
By default, kinit attempts to authenticate using the login user name of the account you used
when you first logged into your system (not the Kerberos server). If that system user name does
not correspond to a principal in the Kerberos database, you will receive an error message. If
that happens, supply kinit with the name of your principal as an argument on the command
line (kinit principal).