📄 kerberos5.html
字号:
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"><html xmlns="http://www.w3.org/1999/xhtml"><head><meta name="generator" content="HTML Tidy, see www.w3.org" /><title>Kerberos5</title><meta name="GENERATOR" content="Modular DocBook HTML Stylesheet Version 1.7" /><link rel="HOME" title="FreeBSD 使用手册" href="index.html" /><link rel="UP" title="安全" href="security.html" /><link rel="PREVIOUS" title="KerberosIV" href="kerberosiv.html" /><link rel="NEXT" title="Firewalls" href="firewalls.html" /><link rel="STYLESHEET" type="text/css" href="docbook.css" /><meta http-equiv="Content-Type" content="text/html; charset=GB2312" /></head><body class="SECT1" bgcolor="#FFFFFF" text="#000000" link="#0000FF" vlink="#840084"alink="#0000FF"><div class="NAVHEADER"><table summary="Header navigation table" width="100%" border="0" cellpadding="0"cellspacing="0"><tr><th colspan="3" align="center">FreeBSD 使用手册</th></tr><tr><td width="10%" align="left" valign="bottom"><a href="kerberosiv.html"accesskey="P">Prev</a></td><td width="80%" align="center" valign="bottom">Chapter 10. 安全</td><td width="10%" align="right" valign="bottom"><a href="firewalls.html"accesskey="N">Next</a></td></tr></table><hr align="LEFT" width="100%" /></div><div class="SECT1"><h1 class="SECT1"><a id="KERBEROS5" name="KERBEROS5">10.7. <bclass="APPLICATION">Kerberos5</b></a></h1><i class="AUTHORGROUP"><span class="CONTRIB">Contributed by</span> Tillman Hodgson.</i><i class="AUTHORGROUP"><span class="CONTRIB">Based on a contribution by</span> MarkMurray.</i> <p>Every FreeBSD release beyond FreeBSD-5.1 includes support only for <bclass="APPLICATION">Kerberos5</b>. Hence <b class="APPLICATION">Kerberos5</b> is the onlyversion included, and its configuration is similar in many aspects to that of <bclass="APPLICATION">KerberosIV</b>. The following information only applies to <bclass="APPLICATION">Kerberos5</b> in post FreeBSD-5.0 releases. Users who wish to use the<b class="APPLICATION">KerberosIV</b> package may install the <ahref="http://www.FreeBSD.org/cgi/url.cgi?ports/security/krb4/pkg-descr"><ttclass="FILENAME">security/krb4</tt></a> port.</p><p><b class="APPLICATION">Kerberos</b> is a network add-on system/protocol that allowsusers to authenticate themselves through the services of a secure server. Services suchas remote login, remote copy, secure inter-system file copying and other high-risk tasksare made considerably safer and more controllable.</p><p><b class="APPLICATION">Kerberos</b> can be described as an identity-verifying proxysystem. It can also be described as a trusted third-party authentication system. <bclass="APPLICATION">Kerberos</b> provides only one function -- the secure authenticationof users on the network. It does not provide authorization functions (what users areallowed to do) or auditing functions (what those users did). After a client and serverhave used <b class="APPLICATION">Kerberos</b> to prove their identity, they can alsoencrypt all of their communications to assure privacy and data integrity as they go abouttheir business.</p><p>Therefore it is highly recommended that <b class="APPLICATION">Kerberos</b> be usedwith other security methods which provide authorization and audit services.</p><p>The following instructions can be used as a guide on how to set up <bclass="APPLICATION">Kerberos</b> as distributed for FreeBSD. However, you should refer tothe relevant manual pages for a complete description.</p><p>For purposes of demonstrating a <b class="APPLICATION">Kerberos</b> installation, thevarious namespaces will be handled as follows:</p><ul><li><p>The <acronym class="ACRONYM">DNS</acronym> domain (``zone'') will be example.org.</p></li><li><p>The <b class="APPLICATION">Kerberos</b> realm will be EXAMPLE.ORG.</p></li></ul><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> Please use real domain names when setting up <bclass="APPLICATION">Kerberos</b> even if you intend to run it internally. This avoids<acronym class="ACRONYM">DNS</acronym> problems and assures inter-operation with other <bclass="APPLICATION">Kerberos</b> realms.</p></blockquote></div><div class="SECT2"><h2 class="SECT2"><a id="AEN11561" name="AEN11561">10.7.1. History</a></h2><p><b class="APPLICATION">Kerberos</b> was created by <acronymclass="ACRONYM">MIT</acronym> as a solution to network security problems. The <bclass="APPLICATION">Kerberos</b> protocol uses strong cryptography so that a client canprove its identity to a server (and vice versa) across an insecure networkconnection.</p><p><b class="APPLICATION">Kerberos</b> is both the name of a network authenticationprotocol and an adjective to describe programs that implement the program (<bclass="APPLICATION">Kerberos</b> telnet, for example). The current version of theprotocol is version 5, described in <acronym class="ACRONYM">RFC</acronym> 1510.</p><p>Several free implementations of this protocol are available, covering a wide range ofoperating systems. The Massachusetts Institute of Technology (<acronymclass="ACRONYM">MIT</acronym>), where <b class="APPLICATION">Kerberos</b> was originallydeveloped, continues to develop their <b class="APPLICATION">Kerberos</b> package. It iscommonly used in the <acronym class="ACRONYM">US</acronym> as a cryptography product, assuch it has historically been affected by <acronym class="ACRONYM">US</acronym> exportregulations. The <acronym class="ACRONYM">MIT</acronym> <bclass="APPLICATION">Kerberos</b> is available as a port (<ahref="http://www.FreeBSD.org/cgi/url.cgi?ports/security/krb5/pkg-descr"><ttclass="FILENAME">security/krb5</tt></a>). Heimdal <b class="APPLICATION">Kerberos</b> isanother version 5 implementation, and was explicitly developed outside of the <acronymclass="ACRONYM">US</acronym> to avoid export regulations (and is thus often included innon-commercial <span class="TRADEMARK">UNIX</span>® variants). The Heimdal <bclass="APPLICATION">Kerberos</b> distribution is available as a port (<ahref="http://www.FreeBSD.org/cgi/url.cgi?ports/security/heimdal/pkg-descr"><ttclass="FILENAME">security/heimdal</tt></a>), and a minimal installation of it is includedin the base FreeBSD install.</p><p>In order to reach the widest audience, these instructions assume the use of theHeimdal distribution included in FreeBSD.</p></div><div class="SECT2"><h2 class="SECT2"><a id="AEN11589" name="AEN11589">10.7.2. Setting up a Heimdal <acronymclass="ACRONYM">KDC</acronym></a></h2><p>The Key Distribution Center (<acronym class="ACRONYM">KDC</acronym>) is thecentralized authentication service that <b class="APPLICATION">Kerberos</b> provides --it is the computer that issues <b class="APPLICATION">Kerberos</b> tickets. The <acronymclass="ACRONYM">KDC</acronym> is considered ``trusted'' by all other computers in the <bclass="APPLICATION">Kerberos</b> realm, and thus has heightened security concerns.</p><p>Note that while running the <b class="APPLICATION">Kerberos</b> server requires veryfew computing resources, a dedicated machine acting only as a <acronymclass="ACRONYM">KDC</acronym> is recommended for security reasons.</p><p>To begin setting up a <acronym class="ACRONYM">KDC</acronym>, ensure that your <ttclass="FILENAME">/etc/rc.conf</tt> file contains the correct settings to act as a<acronym class="ACRONYM">KDC</acronym> (you may need to adjust paths to reflect your ownsystem):</p><pre class="PROGRAMLISTING">kerberos5_server_enable="YES"kadmind5_server_enable="YES"kerberos_stash="YES"</pre><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> The <var class="OPTION">kerberos_stash</var> is only available in FreeBSD4.X.</p></blockquote></div><p>Next we will set up your <b class="APPLICATION">Kerberos</b> config file, <ttclass="FILENAME">/etc/krb5.conf</tt>:</p><pre class="PROGRAMLISTING">[libdefaults] default_realm = EXAMPLE.ORG[realms] EXAMPLE.ORG = { kdc = kerberos.example.org }[domain_realm] .example.org = EXAMPLE.ORG</pre><p>Note that this <tt class="FILENAME">/etc/krb5.conf</tt> file implies that your<acronym class="ACRONYM">KDC</acronym> will have the fully-qualified hostname of <ttclass="HOSTID">kerberos.example.org</tt>. You will need to add a CNAME (alias) entry toyour zone file to accomplish this if your <acronym class="ACRONYM">KDC</acronym> has adifferent hostname.</p><div class="NOTE"><blockquote class="NOTE"><p><b>Note:</b> For large networks with a properly configured <acronymclass="ACRONYM">BIND</acronym> <acronym class="ACRONYM">DNS</acronym> server, the aboveexample could be trimmed to:</p><pre class="PROGRAMLISTING">[libdefaults] default_realm = EXAMPLE.ORG</pre><p>With the following lines being appended to the <tt class="HOSTID">example.org</tt>zonefile:</p><pre class="PROGRAMLISTING">_kerberos._udp IN SRV 01 00 88 kerberos.example.org._kerberos._tcp IN SRV 01 00 88 kerberos.example.org._kpasswd._udp IN SRV 01 00 464 kerberos.example.org._kerberos-adm._tcp IN SRV 01 00 749 kerberos.example.org._kerberos IN TXT EXAMPLE.ORG.</pre></blockquote></div><p>Next we will create the <b class="APPLICATION">Kerberos</b> database. This databasecontains the keys of all principals encrypted with a master password. You are notrequired to remember this password, it will be stored in a file (<ttclass="FILENAME">/var/heimdal/m-key</tt>). To create the master key, run <ttclass="COMMAND">kstash</tt> and enter a password.</p><p>Once the master key has been created, you can initialize the database using the <ttclass="COMMAND">kadmin</tt> program with the <var class="LITERAL">-l</var> option(standing for ``local''). This option instructs <tt class="COMMAND">kadmin</tt> to modifythe database files directly rather than going through the <ttclass="COMMAND">kadmind</tt> network service. This handles the chicken-and-egg problem oftrying to connect to the database before it is created. Once you have the <ttclass="COMMAND">kadmin</tt> prompt, use the <tt class="COMMAND">init</tt> command tocreate your realms initial database.</p><p>Lastly, while still in <tt class="COMMAND">kadmin</tt>, create your first principalusing the <tt class="COMMAND">add</tt> command. Stick to the defaults options for theprincipal for now, you can always change them later with the <ttclass="COMMAND">modify</tt> command. Note that you can use the <varclass="LITERAL">?</var> command at any prompt to see the available options.</p><p>A sample database creation session is shown below:</p><pre class="SCREEN"><samp class="PROMPT">#</samp> <kbd class="USERINPUT">kstash</kbd>Master key: <kbd class="USERINPUT">xxxxxxxx</kbd>Verifying password - Master key: <kbd class="USERINPUT">xxxxxxxx</kbd><samp class="PROMPT">#</samp> <kbd class="USERINPUT">kadmin -l</kbd>kadmin> <kbd class="USERINPUT">init EXAMPLE.ORG</kbd>Realm max ticket life [unlimited]:kadmin> <kbd class="USERINPUT">add tillman</kbd>Max ticket life [unlimited]:Max renewable life [unlimited]:Attributes []:⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -