oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

spelling, From Måns Nilsson

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@16329 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Love Hörnquist Åstrand
2005-12-01 14:56:28 +00:00
parent b8044b7a33
commit 5b8d57d256
1 changed files with 79 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files

154
doc/setup.texi
View File

@@ -42,10 +42,10 @@ There is a sample @file{krb5.conf} supplied with the distribution.
The configuration file is a hierarchical structure consisting of The configuration file is a hierarchical structure consisting of
sections, each containing a list of bindings (either variable sections, each containing a list of bindings (either variable
assignments or subsections). A section starts with assignments or subsections). A section starts with
@samp{[@samp{section-name}]}. A binding consists of a left hand side, an equal @samp{[@samp{section-name}]}. A binding consists of a left hand side, an equal sign
(@samp{=}) and a right hand side (the left hand side tag must be (@samp{=}) and a right hand side (the left hand side tag must be
separated from the equal with some whitespace). Subsections has a separated from the equal sign with some whitespace). Subsections have a
@samp{@{} as the first non-whitespace character after the equal. All @samp{@{} as the first non-whitespace character after the equal sign. All
other bindings are treated as variable assignments. The value of a other bindings are treated as variable assignments. The value of a
variable extends to the end of the line. variable extends to the end of the line.
@@ -190,14 +190,14 @@ kadmin/changepw@@MY.REALM 1:0:1:f48c8af2b340e9fb:-:0:7:e3e6088 ...
All modifications of principals are done with with kadmin. All modifications of principals are done with with kadmin.
A principal have several attributes and lifetimes associated with it. A principal has several attributes and lifetimes associated with it.
Principals are added, renamed, modified, and deleted with the kadmin Principals are added, renamed, modified, and deleted with the kadmin
commands @samp{add}, @samp{rename}, @samp{modify}, @samp{delete}. commands @samp{add}, @samp{rename}, @samp{modify}, @samp{delete}.
Both interactive editing and command switches can be used (use --help Both interactive editing and command line flags can be used (use --help
to list the available options). to list the available options).
There are different kind of types for the fields in the database, There are different kinds of types for the fields in the database;
attributes, absolute time times and relative times. attributes, absolute time times and relative times.
@subsection Attributes @subsection Attributes
@@ -222,7 +222,7 @@ kadmin> get me
@subsection Absolute times @subsection Absolute times
The format for absolute times are any of the following The format for absolute times are any of the following:
@smallexample @smallexample
never never
@@ -234,7 +234,7 @@ YYYY-mm-dd HH:MM:SS
@subsection Relative times @subsection Relative times
The format for relative times are any of the following combined The format for relative times are any of the following combined:
@smallexample @smallexample
N year N year
@@ -274,8 +274,10 @@ Version Type Principal
@section Serving Kerberos 4/524/kaserver @section Serving Kerberos 4/524/kaserver
Heimdal can be configured to support 524, Kerberos 4 or kaserver. All Heimdal can be configured to support 524, Kerberos 4 or kaserver. All
these services turned off by default. Kerberos 4 support also these services are turned off by default. Kerberos 4 is always
depends on if Kerberos 4 support being compiled in with Heimdal. supported by the KDC, but the Kerberos 4 client support also depends
on Kerberos 4 support having been included at compile-time, using
@kbd{--with-krb4=dir}.
@subsection 524 @subsection 524
@@ -292,9 +294,10 @@ tokens with AFS in @xref{Things in search for a better place}.
@subsection Kerberos 4 @subsection Kerberos 4
Kerberos 4 is the predecessor to to Kerberos 5. It only supports single Kerberos 4 is the predecessor to to Kerberos 5. It only supports
DES@. You should only enable Kerberos 4 support if you have a need for single DES@. You should only enable Kerberos 4 support if you have
for compatibility with an installed base of Kerberos 4 clients/servers. needs for compatibility with an installed base of Kerberos 4
clients/servers.
Kerberos 4 can be turned on by adding this to the configuration file Kerberos 4 can be turned on by adding this to the configuration file
@@ -305,11 +308,11 @@ Kerberos 4 can be turned on by adding this to the configuration file
@subsection kaserver @subsection kaserver
Kaserver is a Kerberos 4 that is used in AFS@. The protocol have some extra Kaserver is a Kerberos 4 that is used in AFS@. The protocol has some
features over plain Kerberos 4, but like Kerberos 4, only use single extra features over plain Kerberos 4, but like Kerberos 4, only uses
DES@. single DES@.
You should only enable Kaserver support if you have a need for for You should only enable Kaserver support if you have needs for
compatibility with an installed base of AFS machines. compatibility with an installed base of AFS machines.
Kaserver can be turned on by adding this to the configuration file Kaserver can be turned on by adding this to the configuration file
@@ -334,27 +337,27 @@ kerberos-adm stream tcp nowait root /usr/heimdal/libexec/kadmind kadmin
You might need to add @samp{kerberos-adm} to your @file{/etc/services} You might need to add @samp{kerberos-adm} to your @file{/etc/services}
as @samp{749/tcp}. as @samp{749/tcp}.
Access to the administration server is controlled by an ACL file, (default Access to the administration server is controlled by an ACL file,
@file{/var/heimdal/kadmind.acl}.) The lines in the access file, have the (default @file{/var/heimdal/kadmind.acl}.) The file has the following
following syntax: syntax:
@smallexample @smallexample
principal [priv1,priv2,...] [glob-pattern] principal [priv1,priv2,...] [glob-pattern]
@end smallexample @end smallexample
The matching is from top to bottom for matching principals (and if given, The matching is from top to bottom for matching principals (and if given,
glob-pattern). When there is a match, the access rights of that line are glob-pattern). When there is a match, the access rights of that line are
used. applied.
The privileges you can assign to a principal are: @samp{add}, The privileges you can assign to a principal are: @samp{add},
@samp{change-password} (or @samp{cpw} for short), @samp{delete}, @samp{change-password} (or @samp{cpw} for short), @samp{delete},
@samp{get}, @samp{list}, and @samp{modify}, or the special privilege @samp{get}, @samp{list}, and @samp{modify}, or the special privilege
@samp{all}. All of these roughly corresponds to the different commands @samp{all}. All of these roughly correspond to the different commands
in @command{kadmin}. in @command{kadmin}.
If a @var{glob-pattern} is given on a line, it restricts the access rights for If a @var{glob-pattern} is given on a line, it restricts the access
the principal to only apply for the subjects that match the pattern. rights for the principal to only apply for subjects that match the
The patterns are of the same type as those used in shell globbing, see pattern. The patterns are of the same type as those used in shell
@url{none,,fnmatch(3)}. globbing, see @url{none,,fnmatch(3)}.
In the example below @samp{lha/admin} can change every principal in the In the example below @samp{lha/admin} can change every principal in the
database. @samp{jimmy/admin} can only modify principals that belong to database. @samp{jimmy/admin} can only modify principals that belong to
@@ -383,13 +386,13 @@ You might need to add @samp{kpasswd} to your @file{/etc/services} as
It is important that users have good passwords, both to make it harder It is important that users have good passwords, both to make it harder
to guess them and to avoid off-line attacks (although to guess them and to avoid off-line attacks (although
pre-authentication provides pre-authentication provides some defense against off-line attacks).
some defense against off-line attacks). To ensure that the users choose To ensure that the users choose good passwords, you can enable
good passwords, you can enable password quality controls in password quality controls in @command{kpasswdd} and @command{kadmind}.
@command{kpasswdd} and @command{kadmind}. The controls themselves are The controls themselves are done in a shared library or an external
done in a shared library or an external program that is used by program that is used by @command{kpasswdd}. To configure in these
@command{kpasswdd}. To configure in these controls, add controls, add lines similar to the following to your
lines similar to the following to your @file{/etc/krb5.conf}: @file{/etc/krb5.conf}:
@example @example
[password_quality] [password_quality]
@@ -410,7 +413,7 @@ The builtin polices are
Executes the program specified by @samp{[password_quality]external_program}. Executes the program specified by @samp{[password_quality]external_program}.
A number of key/value pairs is passed as input to the program, one per A number of key/value pairs are passed as input to the program, one per
line, ending with the string @samp{end}. The key/value lines are of line, ending with the string @samp{end}. The key/value lines are of
the form the form
@example @example
@@ -422,7 +425,7 @@ where @var{password} is the password to check for the previous
If the external application approves the password, it should return If the external application approves the password, it should return
@samp{APPROVED} on standard out and exit with exit code 0. If it @samp{APPROVED} on standard out and exit with exit code 0. If it
doesn't approve the password, a one line error message explaining the doesn't approve the password, an one line error message explaining the
problem should be returned on standard error and the application problem should be returned on standard error and the application
should exit with exit code 0. In case of a fatal error, the should exit with exit code 0. In case of a fatal error, the
application should, if possible, print an error message on standard application should, if possible, print an error message on standard
@@ -438,35 +441,35 @@ to be at least this length.
The character-class password quality check reads the configuration The character-class password quality check reads the configuration
file stanza @samp{[password_quality]min_classes}. The policy requires file stanza @samp{[password_quality]min_classes}. The policy requires
the password to have characters from at least that many characters the password to have characters from at least that many character
classes. Default value if not given is 3. classes. Default value if not given is 3.
The four diffrent characters classes are, uppercase, lowercase, The four different characters classes are, uppercase, lowercase,
number, special characters. number, special characters.
@end itemize @end itemize
If you want to write you own shared object that checks password If you want to write your own shared object to check password
policies, see the manual page @manpage{kadm5_pwcheck,3}. policies, see the manual page @manpage{kadm5_pwcheck,3}.
Code for a password quality checking function that uses the cracklib Code for a password quality checking function that uses the cracklib
library can be found in @file{lib/kadm5/sample_password_check.c} in the library can be found in @file{lib/kadm5/sample_password_check.c} in
source code distribution. It requires the cracklib library built with the source code distribution. It requires that the cracklib library
the patch available at be built with the patch available at
@url{ftp://ftp.pdc.kth.se/pub/krb/src/cracklib.patch}. @url{ftp://ftp.pdc.kth.se/pub/krb/src/cracklib.patch}.
A sample policy external program is included in A sample policy external program is included in
@file{lib/kadm5/check-cracklib.pl}. @file{lib/kadm5/check-cracklib.pl}.
If no password quality checking function is configured, it is only If no password quality checking function is configured, the only check
verified that it is at least six characters long. performed is that the password is at least six characters long.
To check the password policy settings, the command To check the password policy settings, use the command
@command{password-quality} in @command{kadmin} program. The password @command{password-quality} in @command{kadmin} program. The password
verification is only performed locally, even on the client. verification is only performed locally, on the client. It may be
It may be convenient to set the environment variable convenient to set the environment variable @samp{KRB5_CONFIG} to point
@samp{KRB5_CONFIG} to point to a test version of @file{krb5.conf} to a test version of @file{krb5.conf} while you're testing the
while you're testing the @samp{[password_quality]} stanza that way. @samp{[password_quality]} stanza that way.
@node Testing clients and servers, Slave Servers, Password changing, Setting up a realm @node Testing clients and servers, Slave Servers, Password changing, Setting up a realm
@section Testing clients and servers @section Testing clients and servers
@@ -482,7 +485,7 @@ master server fails. It is possible to have any number of such slave
servers but more than three usually doesn't buy much more redundancy. servers but more than three usually doesn't buy much more redundancy.
All Kerberos servers for a realm must have the same database so that All Kerberos servers for a realm must have the same database so that
they present the same service to all the users. The they present the same service to the users. The
@pindex hprop @pindex hprop
@command{hprop} program, running on the master, will propagate the database @command{hprop} program, running on the master, will propagate the database
to the slaves, running to the slaves, running
@@ -606,7 +609,7 @@ there is no salt. This is to be compatible with NTLM keys in Windows
NT 4. NT 4.
@code{[kadmin]default_keys} in @file{krb5.conf} controls @code{[kadmin]default_keys} in @file{krb5.conf} controls
what salting to use, what salting to use.
The syntax of @code{[kadmin]default_keys} is The syntax of @code{[kadmin]default_keys} is
@samp{[etype:]salt-type[:salt-string]}. @samp{etype} is the encryption @samp{[etype:]salt-type[:salt-string]}. @samp{etype} is the encryption
@@ -728,10 +731,10 @@ The syntax for @code{[capaths]} section:
@end example @end example
The realm @code{STACKEN.KTH.SE} allows clients from @code{SU.SE} and The realm @code{STACKEN.KTH.SE} allows clients from @code{SU.SE} and
@code{DSV.SU.SE} to cross it. Since @code{STACKEN.KTH.SE} only have @code{DSV.SU.SE} to cross it. Since @code{STACKEN.KTH.SE} only has
direct cross realm with @code{KTH.SE}, and @code{DSV.SU.SE} only have direct cross direct cross realm setup with @code{KTH.SE}, and @code{DSV.SU.SE} only
realm with @code{SU.SE} they need to use both @code{SU.SE} and has direct cross realm setup with @code{SU.SE} they need to use both
@code{KTH.SE} as transit realms. @code{SU.SE} and @code{KTH.SE} as transit realms.
@example @example
@cartouche @cartouche
@@ -749,7 +752,7 @@ realm with @code{SU.SE} they need to use both @code{SU.SE} and
The order of the @code{PERMITTED-CROSS-REALMS} is not important when The order of the @code{PERMITTED-CROSS-REALMS} is not important when
doing transit cross realm verification. doing transit cross realm verification.
However the order is important when the @code{[capaths]} section is used However, the order is important when the @code{[capaths]} section is used
to figure out the intermediate realm to go to when doing multi-realm to figure out the intermediate realm to go to when doing multi-realm
transit. When figuring out the next realm, the first realm of the list transit. When figuring out the next realm, the first realm of the list
of @code{PERMITTED-CROSS-REALMS} is chosen. This is done in both the of @code{PERMITTED-CROSS-REALMS} is chosen. This is done in both the
@@ -773,17 +776,17 @@ will try to find a @code{SRV} resource record (RR) for the realm. If no
SRV RRs are found, it will fall back to looking for an @code{A} RR for SRV RRs are found, it will fall back to looking for an @code{A} RR for
a machine named kerberos.REALM, and then kerberos-1.REALM, etc a machine named kerberos.REALM, and then kerberos-1.REALM, etc
Adding this information to DNS makes the client have less Adding this information to DNS minimises the client configuration (in
configuration (in the common case, no configuration) and allows the the common case, resulting in no configuration needed) and allows the
system administrator to change the number of KDCs and on what machines system administrator to change the number of KDCs and on what machines
they are running without caring about clients. they are running without caring about clients.
The down side of using DNS that the client might be fooled to use the The downside of using DNS is that the client might be fooled to use the
wrong server if someone fakes DNS replies/data, but storing the IP wrong server if someone fakes DNS replies/data, but storing the IP
addresses of the KDC on all the clients makes it very hard to change addresses of the KDC on all the clients makes it very hard to change
the infrastructure. the infrastructure.
An example of the configuration for the realm @code{EXAMPLE.COM}, An example of the configuration for the realm @code{EXAMPLE.COM}:
@example @example
@@ -884,7 +887,7 @@ krb5Principal aux object with krb5PrincipalName set so that the
Another option is to create an admins group and add the dn to that Another option is to create an admins group and add the dn to that
group. group.
Since Heimdal talkes to the LDAP server over a UNIX domain socket, and Since Heimdal talks to the LDAP server over a UNIX domain socket, and
uses external sasl authentication, its not possible to require uses external sasl authentication, its not possible to require
security layer quality (ssf in cyrus-sasl lingo). So that requirement security layer quality (ssf in cyrus-sasl lingo). So that requirement
has to be turned off in OpenLDAP @command{slapd} configuration file has to be turned off in OpenLDAP @command{slapd} configuration file
@@ -978,30 +981,31 @@ index krb5PrincipalName eq
@c @node Using Samba LDAP password database, Providing Kerberos credentials to servers and programs, Using LDAP to store the database, Setting up a realm @c @node Using Samba LDAP password database, Providing Kerberos credentials to servers and programs, Using LDAP to store the database, Setting up a realm
@c @section Using Samba LDAP password database @c @section Using Samba LDAP password database
Samba domain and the Kerberos realm can have diffrent names since The Samba domain and the Kerberos realm can have diffrent names since
arcfour's string to key function principal/realm independent. So now arcfour's string to key functions principal/realm independent. So now
will be your first and only chance name your Kerberos without needing will be your first and only chance name your Kerberos realm without
to deal with old configuration files. needing to deal with old configuration files.
First you should set up Samba and get that working with LDAP backend. First, you should set up Samba and get that working with LDAP backend.
Now you can proceed as in @xref{Using LDAP to store the database}, Now you can proceed as in @xref{Using LDAP to store the database}.
Heimdal will pick up the Samba LDAP entries if they are in the same Heimdal will pick up the Samba LDAP entries if they are in the same
search space as the Kerberos entries. search space as the Kerberos entries.
@node Providing Kerberos credentials to servers and programs, , Using LDAP to store the database, Setting up a realm @node Providing Kerberos credentials to servers and programs, , Using LDAP to store the database, Setting up a realm
@section Providing Kerberos credentials to servers and programs @section Providing Kerberos credentials to servers and programs
Some service require Kerberos credentials when they start to make Some services require Kerberos credentials when they start to make
connections to other services or use them when they have started. connections to other services or need to use them when they have started.
The easiest way to get ticket for the a service is to store the key in The easiest way to get tickets for a service is to store the key in a
a keytab. Both ktutil get and kadmin ext can be used to get a keytab. Both ktutil get and kadmin ext can be used to get a
keytab. ktutil get is better in that way it changes the key/password keytab. ktutil get is better in that way it changes the key/password
for the user. This the problem with the ktutil. It ktutil is used for for the user. This is also the problem with ktutil. If ktutil is used
the same service principal on several hosts, they keytab will only for the same service principal on several hosts, they keytab will only
useful on the last host. In that case, run the command on host and be useful on the last host. In that case, run the extract command on
copy the keytab around to all other hosts that needs it. one host and then securely copy the keytab around to all other hosts
that need it.
@example @example
host# ktutil -k /etc/krb5-service.keytab \ host# ktutil -k /etc/krb5-service.keytab \
@@ -1010,7 +1014,7 @@ lha/admin@@EXAMPLE.ORG's Password:
@end example @end example
To get a Kerberos credential file for the service, use kinit in the To get a Kerberos credential file for the service, use kinit in the
--keytab mode, this will not ask for a password but rather that the --keytab mode. This will not ask for a password but instead fetch the
key from the keytab. key from the keytab.
@example @example