oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

move afs stuff to applications

Browse Source 
add link to applications


git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@12197 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2003-05-04 13:32:37 +00:00
parent 7808246621
commit 53816ab022
1 changed files with 1 additions and 69 deletions
Download Patch File Download Diff File Expand all files Collapse all files

70
doc/misc.texi
View File

@@ -1,6 +1,6 @@
@c $Id$ @c $Id$
@node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top @node Things in search for a better place, Kerberos 4 issues, Applications, Top
@chapter Things in search for a better place @chapter Things in search for a better place
@section Making things work on Ciscos @section Making things work on Ciscos
@@ -56,71 +56,3 @@ protocol.
A working solution would be to hook up a machine with a real operating A working solution would be to hook up a machine with a real operating
system to the console of the Cisco and then use it as a backwards system to the console of the Cisco and then use it as a backwards
terminal server. terminal server.
@section Making things work on Transarc/OpenAFS AFS
@subsection How to get a KeyFile
@file{ktutil -k AFSKEYFILE:KeyFile get afs@@MY.REALM}
or you can extract it with kadmin
@example
kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@@My.CELL.NAME
@end example
You have to make sure you have a @code{des-cbc-md5} encryption type since that
is the key that will be converted.
@subsection How to convert a srvtab to a KeyFile
You need a @file{/usr/vice/etc/ThisCell} containing the cellname of you
AFS-cell.
@file{ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile}.
If keyfile already exists, this will add the new key in afs-srvtab to
KeyFile.
@section Using 2b tokens with AFS
@subsection What is 2b ?
2b is the name of the proposal that was implemented to give basic
Kerberos 5 support to AFS in rxkad. Its not real Kerberos 5 support
since it still uses fcrypt for data encryption and not Kerberos
encryption types.
Its only possible (in all cases) to do this for DES encryption types because
only then the token (the AFS equivalent of a ticket) will be be smaller
than the maximum size that can fit in the token cache in
OpenAFS/Transarc client. Its so tight fit that some extra wrapping on the ASN1/DER encoding is removed from the Kerberos ticket.
2b uses a Kerberos 5 EncTicketPart instead of a Kerberos 4 ditto for
the part of the ticket that is encrypted with the service's key. The
client doesn't know what's inside the encrypted data so to the client it doesn't matter.
To differentiate between Kerberos 4 tickets and Kerberos 5 tickets 2b
uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens.
Its a requirement that all AFS servers that support 2b also support
native Kerberos 5 in rxkad.
@subsection Configuring Heimdal to use 2b tokens
Support for 2b tokens are turned on for specific principals by adding
them to the string list option @code{[kdc]use_2b} in the kdc's
@file{krb5.conf} file.
@example
[kdc]
use_2b = @{
afs@@SU.SE = yes
afs/it.su.se@@SU.SE = yes
@}
@end example
@subsection Configuring AFS clients
There is no need to configure AFS clients. The only software that
needs to be installed/upgrade is a Kerberos 5 enabled @file{afslog}.