☰

Kerberos 主机身份验证

tag-icon • tag-icon linux security authentication kerberos
Kerberos 主机身份验证

我已经设置了一个具有以下配置的 Kerberos 服务器

krb5.conf：

[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
  default_realm = DOMAIN.NET
  dns_lookup_realm = true
  dns_lookup_kdc = true
  ticket_lifetime = 24h
  renew_lifetime = 7d
  forwardable = true
[realms]
  DOMAIN.NET= {
  kdc = server.priv.domain.net
  admin_server = server.priv.domain.net
 }

[domain_realm]
 .domain.net = DOMAIN.NET
  domain.net = DOMAIN.NET

密钥管理中心

[kdcdefaults]
kdc_listen = 88
kdc_tcp_listen = 88

[realms]
DOMAIN.NET = {
    database_name = /usr/local/var/krb5kdc/principal
    acl_file = /usr/local/var/krb5kdc/kadm5.acl
    key_stash_file = /usr/local/var/krb5kdc/.k5.DOMAIN.NET
    kdc_listen = 88
    kdc_tcp_listen = 88
    max_life = 10h 0m 0s
    max_renewable_life = 7d 0h 0m 0s

我认为，kerberos 接受来自主机的身份验证请求，该主机具有从 kerberos 服务器发出的密钥表。但在我看来，它从任何地方提供身份验证，即使没有设置主机主体和密钥表。有人能给出建议吗？

谢谢，

磷

答案1

假设您的主机的主体已在服务器上创建，则需要ktadd从kadminshell运行

ktadd -k /etc/krb5.keytab host/blah.DOMAIN.NET

退出kadminshell并运行klist以验证您是否已获得Kerberos票证。

[1] -https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/6/html/Managing_Smart_Cards/Configuring_a_Kerberos_5_Client.html

相关内容