yum install krb5-server-ldap
cp /usr/share/doc/krb5-server-ldap-1.13.2/kerberos.* /etc/openldap/schema/
mkdir /tmp/ldap-kerberos/ echo "include /etc/openldap/schema/kerberos.schema" > /tmp/ldap-kerberos/schema_convert.conf mkdir /tmp/ldap-kerberos/krb5_ldif slaptest -f /tmp/ldap-kerberos/schema_convert.conf -F /tmp/ldap-kerberos/krb5_ldif # Edit /tmp/ldap-kerberos/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif and replace dn: cn={0}kerberos cn: {0}kerberos with dn: cn=kerberos,cn=schema,cn=config cn: kerberos # Remove (at the end of the file) structuralObjectClass: olcSchemaConfig entryUUID: ... creatorsName: cn=config createTimestamp: ... entryCSN: ... modifiersName: cn=config modifyTimestamp: ...
ldapadd -H ldaps://<FQDN> -x -D "cn=Manager,dc=domain,dc=tld" -W -f /tmp/ldap-kerberos/krb5_ldif/cn=config/cn=schema/cn={0}kerberos.ldif
krbadmin
.olcAccess: {0}to attrs=userPassword,shadowLastChange,krbPrincipalKey by dn.exact="cn=Manager,dc=domain,dc=tld" write by dn.exact="cn=krbadmin,dc=domain,dc=tld" write by dn.exact="cn=replicator,dc=domain,dc=tld" read by self =xw by anonymous auth by * none olcAccess: {1}to * by dn.exact="cn=Manager,dc=domain,dc=tld" write by dn.exact="cn=krbadmin,dc=domain,dc=tld" write by dn.exact="cn=replicator,dc=domain,dc=tld" read by self read by users read by * none
# ldapmodify -H ldapi:/// -x -D "cn=config" -W <<EOF dn: olcDatabase={2}hdb,cn=config add: olcDbIndex olcDbIndex: krbPrincipalName eq,pres,sub - EOF
yum install -y krb5-server krb5-server-ldap krb5-workstation
/var/kerberos/krb5kdc/kdc.conf
and replace EXAMPLE.COM with your domain. Convention is to make it the same as your domain name, in upper-case letters./var/kerberos/krb5kdc/kdc.conf
add below [realms]
:default_principal_flags = +preauth
/etc/krb5.conf
uncomment all lines and replace EXAMPLE.COM (and the lower-case ones) with your domain. /etc/krb5.conf
and add below [realms]
.default_domain = example.com database_module = openldap_ldapconf
/etc/krb5.conf
add LDAP config:[dbdefaults] ldap_kerberos_container_dn = cn=krbContainer,dc=example,dc=com [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=krbadmin,dc=example,dc=com" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=krbadmin,dc=example,dc=com" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/kerberos/service.keyfile ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com ldap_conns_per_server = 5 }
/var/kerberos/krb5kdc/kadm5.acl
, replace EXAMPLE.COM with your own realm.kdb5_ldap_util -D cn=krbadmin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com
/etc/kerberos
kdb5_ldap_util -D cn=krbadmin,dc=example,dc=com stashsrvpw -f /etc/kerberos/service.keyfile cn=krbadmin,dc=example,dc=com
systemctl start krb5kdc kadmin systemctl enable krb5kdc kadmin
kadmin.local: addprinc -randkey host/kdc.dc.polaire.nl kadmin.local: ktadd host/kdc.dc.polaire.nl kadmin.local: addprinc root/admin kadmin.local: addprinc -x dn="uid=example,ou=people,dc=example,dc=com" example kadmin.local: quit
firewall-cmd --zone public --add-service kerberos --permanent firewall-cmd --reload
yum -y install krb5-workstation pam_krb5
/etc/krb5.conf
filekadmin -p root/admin kadmin: addprinc -randkey host/test1.example.com kadmin: addprinc -randkey host/test2.example.com kadmin: addprinc -randkey host/test3.example.com kadmin: ktadd host/test1.example.com kadmin: ktadd host/test2.example.com kadmin: ktadd host/test3.example.com
/etc/ssh/sshd_config
file to include the following lines:KerberosAuthentication yes GSSAPIAuthentication yes GSSAPICleanupCredentials yes #UsePAM no # set to no if you don't want to allow logins with local accounts.
/etc/ssh/ssh_config
to include following lines:Host *.domain.com GSSAPIAuthentication yes GSSAPIDelegateCredentials yes
kinit benst
ssh user@host