Kerberos¶

설치 전 반드시 시간 동기화

Yum install

yum install krb5-*

/etc/krb5.conf

[logging]
[libdefaults]
    default_realm = BDP.TEST
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = true
    udp_preference_limit = 1000000
    default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
    default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1
    permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1

[realms]
    BDP.TEST = {
        kdc = KERBEROS.BDP.TEST:88
        admin_server = KERBEROS.BDP.TEST:749
        default_domain = BDP.TEST
    }

[domain_realm]
    .bdp.test = BDP.TEST
     bdp.test = BDP.TEST

[logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log

/var/kerberos/krb5kdc/kdc.conf on KDC

default_realm = BDP.TEST

[kdcdefaults]
    v4_mode = nopreauth
    kdc_ports = 0

[realms]
    BDP.TEST = {
        kdc_ports = 88
        admin_keytab = /etc/kadm5.keytab
        database_name = /var/kerberos/krb5kdc/principal
        acl_file = /var/kerberos/krb5kdc/kadm5.acl
        key_stash_file = /var/kerberos/krb5kdc/stash
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
        default_principal_flags = +preauth
    }

/var/kerberos/krb5kdc/kadm5.acl on KDC

*/admin@BDP.TEST        *

create kerberos DB

kdb5_util create -r BDP.TEST -s
-가상 머신에서 'roading random data' 메시지 출력 후 작업 처리에 오래 걸릴 수 있음
 해당 연산은 온전히 CPU 능력에 의존함

admin principal 및 user pincipal 생성

kadmin.local
kadmin.local:  addprinc root/admin
kadmin.local:  addprinc test
kadmin.local:  ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/admin
kadmin.local:  ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/changepw
kadmin.local:  exit

KDC 서버를 위한 principal 생성 및 keytab 에 적용

kadmin.local
kadmin.local:  addprinc -randkey host/kerberos.bdp.test
kadmin.local:  ktadd host/kerberos.bdp.test

=======client

kerberos client 설치

yum -y install krb5-workstation

서버의 /etc/krb5.conf 파일 복사 (동일 경로 동일 파일명)

client principal 생성

kadmin -p root/admin
kadmin:  addpinc --randkey host/test.bdp.test
kadmin:  ktadd host/kdc.bdp.test