oysteikt/heimdal
0
0
Fork 0
Code Issues 5 Pull Requests Releases Activity

language; say something about kadmin del_enctype

Browse Source 
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@8639 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
2000-07-10 11:50:05 +00:00
parent 66889b64d7
commit beb57945e8
1 changed files with 17 additions and 23 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
doc/misc.texi
View File

@@ -4,11 +4,11 @@
@section Making things work on Ciscos @section Making things work on Ciscos
Modern versions of Cisco IOS has some support for authenticating via Modern versions of Cisco IOS has some support for authenticating via
Kerberos 5. This can be used both to verify passwords via a ticket Kerberos 5. This can be used both by having the router get a ticket when
exchange Kerberos 5 (boring), and to use Kerberos authenticated telnet you login (boring), and by using Kerberos authenticated telnet to access
to access your router (less boring). The following has been tested on your router (less boring). The following has been tested on IOS
IOS 11.2(12), things might be different with other versions. Old 11.2(12), things might be different with other versions. Old versions
versions are known to have bugs. are known to have bugs.
To make this work, you will first have to configure your router to use To make this work, you will first have to configure your router to use
Kerberos (this is explained in the documentation). A sample Kerberos (this is explained in the documentation). A sample
@@ -24,31 +24,25 @@ kerberos server FOO.SE 10.0.0.1
kerberos instance map admin 15 kerberos instance map admin 15
@end example @end example
This tells you (among other things) that the when logging in, the router This tells you (among other things) that when logging in, the router
should try to authenticate with kerberized telnet, and if that fails try should try to authenticate with kerberised telnet, and if that fails try
to verify a plain text password via a Kerberos ticket exchange (as to verify a plain text password via a Kerberos ticket exchange (as
opposed to a local database or RADIUS or something similar), and if that opposed to a local database, RADIUS or something similar), and if that
fails try the local enable password. If you're not careful when you fails try the local enable password. If you're not careful when you
specify the `login default' authentication mechanism, you might not be specify the `login default' authentication mechanism, you might not be
able to login. The `instance map' and `authorization exec' lines says able to login at all. The `instance map' and `authorization exec' lines
that people with `admin' instances should be given `enabled' shells when says that people with `admin' instances should be given `enabled' shells
logging in. when logging in.
The numbers after the principal on the `srvtab' line are principal type,
timestamp (in seconds since 1970), key version number (4), keytype (1 ==
des), key length (always 8 with des), and then the key.
To make the Heimdal KDC produce tickets that the Cisco can decode you To make the Heimdal KDC produce tickets that the Cisco can decode you
might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the
KDC. You will also have to specify that the router can't handle anything KDC. You will also have to specify that the router can't handle anything
but @samp{des-cbc-crc}. There currently isn't an easy way to do but @samp{des-cbc-crc}. This can be done with the @samp{del_enctype}
this. The best you can do is to dump your database (with @samp{kadmin -l command of @samp{kadmin}.
dump}), remove all entries for keys other than @samp{des-cbc-crc}, and
then reloading the database (@samp{kadmin -l load}). An example should
clarify this. You should have something like (again, truncated):
@example
host/router.foo.se@@FOO.SE 4:0:1:...:-:... - - - - - - - 126
@end example
Change this to:
@example
host/router.foo.se@@FOO.SE 4:0:1:...:- - - - - - - - 126
@end example
This all fine and so, but unless you have an IOS version with encryption This all fine and so, but unless you have an IOS version with encryption
(available only in the U.S) it doesn't really solve any problems. Sure (available only in the U.S) it doesn't really solve any problems. Sure