我正在尝试按照 Ubuntu wiki 上的指南安装和设置 Kerberos。我正在运行 Ubuntu 14.04 (LTS) 64 位。我已设置 avahi-daemon 以提供 .local DNS 名称。然后我运行:
sudo apt-get install krb5-kdc krb5-admin-server
对话框要求我输入域以及服务器的主机名,我输入了这两个信息。但是,它似乎遇到了错误:
krb5kdc: cannot initialize realm myrealm - see log file for details
...fail!
唯一的问题是没有日志文件。似乎默认设置/etc/krb5.conf
实际上并未启用日志记录。无论如何,我向其中添加了以下内容:
[logging]
default = FILE:/var/log/krb5.log
然后尝试运行:
sudo dpkg-reconfigure krb5-kdc
它仍然会出错,但这一次,在/var/log/krb5.log
,我看到:
krb5kdc: No such file or directory - while initializing database for realm myrealm
但它实际上并没有告诉我缺少什么文件或目录。
这是我的krb5.conf
[libdefaults]
default_realm = myrealm
# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5.log
[realms]
myrealm = {
kdc = kerberos-myname-syd.local
admin_server = kerberos-myname-syd.local
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu:88
kdc = kerberos-1.mit.edu:88
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
<cut>
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
[login]
krb4_convert = true
krb4_get_tickets = false
~
~
这是我的/etc/krb5/kdc.conf
文件:
[kdcdefaults]
kdc_ports = 750,88
[realms]
myrealm = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
default_principal_flags = +preauth
}
对于正在发生的事情您有什么想法吗?
答案1
您需要先创建一个数据库:
kdb5_util create -s -r MYREALM
哪里与文件MYREALM
中的领域名称匹配/var/kerberos/krb5kdc/kdc.conf
。
答案2
我将执行完整的 apt-get remove --purge 并尝试按照本教程进行操作。 http://techpubs.spinlocksolutions.com/dklar/kerberos.html