프로젝트

일반

사용자정보

편집 이력

Wiki »

Kerberos » 이력 » 버전 8

SANGKYU KANG, 2018-06-04 12:54 오후

1 1 SANGKYU KANG 
h1. Kerberos
2 2 SANGKYU KANG 





    3
    
    
    





    4
    5
    SANGKYU KANG
    





    5
    
    
    
설치 전 반드시 시간 동기화





    6
    
    
    





    7
    2
    SANGKYU KANG
    
Yum install





    8
    
    
    
<pre>





    9
    3
    SANGKYU KANG
    
yum install krb5-*





    10
    2
    SANGKYU KANG
    
</pre>





    11
    1
    SANGKYU KANG
    





    12
    5
    SANGKYU KANG
    
/etc/krb5.conf





    13
    1
    SANGKYU KANG
    
<pre>





    14
    
    
    
[libdefaults]





    15
    5
    SANGKYU KANG
    
    default_realm = BDP.TEST





    16
    
    
    
    dns_lookup_realm = false





    17
    
    
    
    dns_lookup_kdc = false





    18
    
    
    
    ticket_lifetime = 24h





    19
    
    
    
    forwardable = true





    20
    
    
    
    udp_preference_limit = 1000000





    21
    
    
    
    default_tkt_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1





    22
    
    
    
    default_tgs_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1





    23
    
    
    
    permitted_enctypes = des-cbc-md5 des-cbc-crc des3-cbc-sha1





    24
    2
    SANGKYU KANG
    





    25
    1
    SANGKYU KANG
    
[realms]





    26
    5
    SANGKYU KANG
    
    BDP.TEST = {





    27
    
    
    
        kdc = KERBEROS.BDP.TEST:88





    28
    
    
    
        admin_server = KERBEROS.BDP.TEST:749





    29
    
    
    
        default_domain = BDP.TEST





    30
    
    
    
    }





    31
    1
    SANGKYU KANG
    





    32
    
    
    
[domain_realm]





    33
    5
    SANGKYU KANG
    
    .bdp.test = BDP.TEST





    34
    
    
    
     bdp.test = BDP.TEST





    35
    
    
    





    36
    
    
    
[logging]





    37
    
    
    
    kdc = FILE:/var/log/krb5kdc.log





    38
    
    
    
    admin_server = FILE:/var/log/kadmin.log





    39
    
    
    
    default = FILE:/var/log/krb5lib.log





    40
    1
    SANGKYU KANG
    
</pre>





    41
    
    
    





    42
    5
    SANGKYU KANG
    





    43
    
    
    
/var/kerberos/krb5kdc/kdc.conf on KDC





    44
    
    
    
<pre>





    45
    
    
    
default_realm = BDP.TEST





    46
    
    
    





    47
    
    
    
[kdcdefaults]





    48
    
    
    
    v4_mode = nopreauth





    49
    
    
    
    kdc_ports = 0





    50
    
    
    





    51
    
    
    
[realms]





    52
    
    
    
    BDP.TEST = {





    53
    
    
    
        kdc_ports = 88





    54
    
    
    
        admin_keytab = /etc/kadm5.keytab





    55
    
    
    
        database_name = /var/kerberos/krb5kdc/principal





    56
    
    
    
        acl_file = /var/kerberos/krb5kdc/kadm5.acl





    57
    
    
    
        key_stash_file = /var/kerberos/krb5kdc/stash





    58
    
    
    
        max_life = 10h 0m 0s





    59
    
    
    
        max_renewable_life = 7d 0h 0m 0s





    60
    
    
    
        master_key_type = des3-hmac-sha1





    61
    
    
    
        supported_enctypes = arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3





    62
    
    
    
        default_principal_flags = +preauth





    63
    
    
    
    }





    64
    
    
    
</pre>





    65
    
    
    





    66
    
    
    
/var/kerberos/krb5kdc/kadm5.acl on KDC





    67
    
    
    
<pre>





    68
    
    
    
*/admin@BDP.TEST	    *





    69
    
    
    
</pre>





    70
    
    
    





    71
    1
    SANGKYU KANG
    
create kerberos DB





    72
    
    
    
<pre>





    73
    5
    SANGKYU KANG
    
kdb5_util create -r BDP.TEST -s





    74
    1
    SANGKYU KANG
    
-가상 머신에서 'roading random data' 메시지 출력 후 작업 처리에 오래 걸릴 수 있음





    75
    6
    SANGKYU KANG
    
 해당 연산은 온전히 CPU 능력에 의존함





    76
    5
    SANGKYU KANG
    
</pre>





    77
    
    
    





    78
    
    
    
admin principal 및 user pincipal 생성





    79
    
    
    
<pre>





    80
    
    
    
kadmin.local





    81
    
    
    
kadmin.local:  addprinc root/admin





    82
    
    
    
kadmin.local:  addprinc test





    83
    
    
    
kadmin.local:  ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/admin





    84
    
    
    
kadmin.local:  ktadd -k /var/kerberos/krb5kdc/kadm5.keytab kadmin/changepw





    85
    
    
    
kadmin.local:  exit





    86
    
    
    
</pre>





    87
    
    
    





    88
    
    
    
KDC 서버를 위한 principal 생성 및 keytab 에 적용





    89
    
    
    
<pre>





    90
    
    
    
kadmin.local





    91
    7
    SANGKYU KANG
    
kadmin.local:  add_principal -randkey host/kerberos.bdp.test





    92
    5
    SANGKYU KANG
    
kadmin.local:  ktadd host/kerberos.bdp.test





    93
    
    
    
</pre>





    94
    
    
    





    95
    
    
    





    96
    
    
    





    97
    
    
    





    98
    
    
    





    99
    
    
    





    100
    
    
    





    101
    
    
    





    102
    
    
    
=======client





    103
    
    
    





    104
    
    
    
kerberos client 설치





    105
    
    
    
<pre>





    106
    
    
    
yum -y install krb5-workstation





    107
    
    
    
</pre>





    108
    
    
    





    109
    
    
    
서버의 /etc/krb5.conf 파일 복사 (동일 경로 동일  파일명)





    110
    
    
    





    111
    
    
    
client principal 생성





    112
    
    
    
<pre>





    113
    
    
    
kadmin -p root/admin





    114
    7
    SANGKYU KANG
    
kadmin:  add_principal --randkey host/test.bdp.test





    115
    5
    SANGKYU KANG
    
kadmin:  ktadd host/kdc.bdp.test





    116
    1
    SANGKYU KANG
    
</pre>