User Tools
аутентификация_с_использованием_kerberos_сервера
Differences
This shows you the differences between two versions of the page.
| Both sides previous revision Previous revision Next revision | Previous revision | ||
|
аутентификация_с_использованием_kerberos_сервера [2010/09/24 12:45] val |
— (current) | ||
|---|---|---|---|
| Line 1: | Line 1: | ||
| - | ====== Аутентификация с использованием KERBEROS сервера ====== | ||
| - | |||
| - | [[http://www.freebsd.org/doc/ru_RU.KOI8-R/books/handbook/kerberos5.html]] | ||
| - | |||
| - | Сервер Kerberos свободно распространяет TGT (Ticket Granting Ticket) на каждый неавторизованный запрос; однако, каждый TGT зашифрован ключом, полученным из пароля пользователя. Следовательно, когда пользователь вводит свой пароль, он не отправляется на KDC, а используется для расшифровки TGT, который уже получен kinit. Если в процессе расшифровки получается правильный билет с правильным значением времени, у пользователя есть действующее ''удостоверение''. Это удостоверение содержит ключ сессии для установления безопасного соединения с сервером Kerberos, как и действующий TGT, зашифрованный ключом сервера Kerberos. Второй уровень шифрования недоступен пользователю, но позволяет серверу Kerberos проверять правильность каждого TGT. | ||
| - | |||
| - | ===== Предварительная настройка стенда ===== | ||
| - | <code> | ||
| - | # cat /etc/hosts | ||
| - | ... | ||
| - | #192.168.X.1 gate.corpX.un gate | ||
| - | #192.168.X.10 server.corpX.un server | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | ===== Настройка DNS сервера ===== | ||
| - | |||
| - | ==== Инсталяция и настройка сервиса ==== | ||
| - | |||
| - | === FreeBSD === | ||
| - | <code> | ||
| - | [server:~] # cat /etc/rc.conf | ||
| - | ... | ||
| - | named_enable="YES" | ||
| - | ... | ||
| - | |||
| - | [server:~] # cat /etc/namedb/named.conf | ||
| - | options { | ||
| - | directory "/etc/namedb"; | ||
| - | pid-file "/var/run/named/pid"; | ||
| - | }; | ||
| - | |||
| - | zone "." { | ||
| - | type hint; | ||
| - | file "named.root"; | ||
| - | }; | ||
| - | |||
| - | zone "corpX.un" { | ||
| - | type master; | ||
| - | file "master/corpX.un"; | ||
| - | }; | ||
| - | |||
| - | zone "X.168.192.IN-ADDR.ARPA" { | ||
| - | type master; | ||
| - | file "master/corpX.rev"; | ||
| - | }; | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu === | ||
| - | <code> | ||
| - | root@server:~# apt-get install bind9 | ||
| - | |||
| - | root@server:~# cat /etc/bind/named.conf.local | ||
| - | zone "corpX.un" { | ||
| - | type master; | ||
| - | file "/var/cache/bind/corpX.un"; | ||
| - | }; | ||
| - | |||
| - | zone "X.168.192.in-addr.arpa" { | ||
| - | type master; | ||
| - | file "/var/cache/bind/corpX.rev"; | ||
| - | }; | ||
| - | </code> | ||
| - | |||
| - | ==== Описание файлов зон ==== | ||
| - | |||
| - | === FreeBSD === | ||
| - | <code> | ||
| - | server# cd /etc/namedb/master/ | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu === | ||
| - | <code> | ||
| - | server# cd /var/cache/bind/ | ||
| - | </code> | ||
| - | |||
| - | === FreeBSD/Ubuntu === | ||
| - | <code> | ||
| - | server# cat corpX.un | ||
| - | </code><code> | ||
| - | $TTL 3h | ||
| - | @ SOA server root.server 1 1d 12h 1w 3h | ||
| - | NS server | ||
| - | server A 192.168.X.10 | ||
| - | gate A 192.168.X.1 | ||
| - | _kerberos._udp SRV 01 00 88 server | ||
| - | _kerberos._tcp SRV 01 00 88 server | ||
| - | _kpasswd._udp SRV 01 00 464 server | ||
| - | _kerberos-adm._tcp SRV 01 00 749 server | ||
| - | _kerberos TXT CORPX.UN | ||
| - | </code><code> | ||
| - | server# cat corpX.rev | ||
| - | </code><code> | ||
| - | $TTL 3h | ||
| - | @ SOA server.corpX.un. root.server.corpX.un. 1 1d 12h 1w 3h | ||
| - | NS server.corpX.un. | ||
| - | 10 PTR server.corpX.un. | ||
| - | 1 PTR gate.corpX.un. | ||
| - | </code><code> | ||
| - | |||
| - | server# named-checkconf -z | ||
| - | |||
| - | server# named-checkzone corpX.un corpX.un | ||
| - | |||
| - | server# named-checkzone X.168.192.in-addr.arpa. corpX.rev | ||
| - | </code> | ||
| - | |||
| - | ==== Запуск сервиса ==== | ||
| - | |||
| - | === FreeBSD === | ||
| - | <code> | ||
| - | [server:~] # /etc/rc.d/named start | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu === | ||
| - | <code> | ||
| - | root@server:~# /etc/init.d/bind9 restart | ||
| - | </code> | ||
| - | |||
| - | |||
| - | ==== Настройки клиентов ==== | ||
| - | <code> | ||
| - | server# cat /etc/resolv.conf | ||
| - | domain corpX.un | ||
| - | nameserver 127.0.0.1 | ||
| - | |||
| - | gate# cat /etc/resolv.conf | ||
| - | domain corpX.un | ||
| - | nameserver 192.168.X.10 | ||
| - | </code> | ||
| - | |||
| - | ==== Проверки (на gate и server) ==== | ||
| - | <code> | ||
| - | # host ya.ru | ||
| - | # host gate.corpX.un | ||
| - | # host server.corpX.un | ||
| - | # host 192.168.X.10 | ||
| - | # host 192.168.X.1 | ||
| - | # dig TXT _kerberos.corpX.un | ||
| - | # dig SRV _kerberos._tcp.corpX.un | ||
| - | </code> | ||
| - | |||
| - | ===== Cинхронизация времени ===== | ||
| - | |||
| - | ==== FreeBSD ==== | ||
| - | <code> | ||
| - | # cp /usr/share/zoneinfo/Europe/Moscow /etc/localtime | ||
| - | |||
| - | # date 201504070842 | ||
| - | Tue Apr 7 08:42:00 MSD 2015 | ||
| - | </code> | ||
| - | |||
| - | ==== Ubuntu ==== | ||
| - | <code> | ||
| - | # cp /usr/share/zoneinfo/Europe/Moscow /etc/localtime | ||
| - | |||
| - | # date 040708422015 | ||
| - | Tue Apr 7 08:42:00 MSD 2015 | ||
| - | </code> | ||
| - | |||
| - | ===== Перезапуск служб NIS, NFS и RPCBIND ===== | ||
| - | |||
| - | ==== FreeBSD ==== | ||
| - | <code> | ||
| - | [server:~] # /etc/rc.d/nfsd stop | ||
| - | [server:~] # /etc/rc.d/mountd stop | ||
| - | [server:~] # /etc/rc.d/ypserv stop | ||
| - | |||
| - | [server:~] # /etc/rc.d/rpcbind restart | ||
| - | |||
| - | [server:~] # /etc/rc.d/ypserv start | ||
| - | [server:~] # /etc/rc.d/mountd start | ||
| - | [server:~] # /etc/rc.d/nfsd start | ||
| - | </code> | ||
| - | |||
| - | ==== Ubuntu ==== | ||
| - | <code> | ||
| - | |||
| - | </code> | ||
| - | |||
| - | ===== Настройка KDC сервера ===== | ||
| - | |||
| - | ==== FreeBSD ==== | ||
| - | <code> | ||
| - | [server:~] # cat /etc/rc.conf | ||
| - | ... | ||
| - | kerberos5_server_enable="YES" | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | ==== Ubuntu (8.04) ==== | ||
| - | <code> | ||
| - | root@server:~# apt-get install heimdal-kdc | ||
| - | |||
| - | root@server:~# ls /var/lib/heimdal-kdc/* | ||
| - | </code> | ||
| - | |||
| - | ==== Ubuntu (10.04) ==== | ||
| - | |||
| - | !!! В виртуальной машине krb5_newrealm может зависать | ||
| - | |||
| - | <code> | ||
| - | root@server:~# apt-get install krb5-kdc krb5-admin-server | ||
| - | |||
| - | root@server:~# krb5_newrealm | ||
| - | ... | ||
| - | Enter KDC database master key: | ||
| - | Re-enter KDC database master key to verify: | ||
| - | |||
| - | root@server:~# ls -l /var/lib/krb5kdc/ | ||
| - | </code> | ||
| - | |||
| - | ==== Ubuntu/FreeBSD ==== | ||
| - | <code> | ||
| - | server# cat /etc/krb5.conf | ||
| - | [libdefaults] | ||
| - | default_realm = CORPX.UN | ||
| - | </code> | ||
| - | |||
| - | ==== Инициализация базы данных (FreeBSD) ==== | ||
| - | <code> | ||
| - | server# kstash | ||
| - | Master key: 123 | ||
| - | |||
| - | server# kadmin -l | ||
| - | kadmin> init CORPX.UN | ||
| - | Realm max ticket life [unlimited]: | ||
| - | Realm max renewable ticket life [unlimited]: | ||
| - | kadmin> quit | ||
| - | </code> | ||
| - | |||
| - | ==== Регистрация принципала пользователя в базе данных kerberos ==== | ||
| - | |||
| - | === FreeBSD, Ubuntu (8.04) === | ||
| - | <code> | ||
| - | # kadmin -l | ||
| - | kadmin> add user1 | ||
| - | ... | ||
| - | user1@CORPX.UN's Password: kpassword1 | ||
| - | Verifying - user@CORPX.UN's Password: kpassword1 | ||
| - | |||
| - | kadmin> list * | ||
| - | |||
| - | kadmin> quit | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@server:~# kadmin.local | ||
| - | |||
| - | kadmin.local: addprinc user1 | ||
| - | ... | ||
| - | Enter password for principal "user@CORPX.UN": kpassword1 | ||
| - | Re-enter password for principal "user@CORPX.UN": kpassword1 | ||
| - | |||
| - | kadmin.local: listprincs | ||
| - | ... | ||
| - | user1@CORPX.UN | ||
| - | </code> | ||
| - | |||
| - | ==== Запуск сервиса ==== | ||
| - | |||
| - | === FreeBSD === | ||
| - | <code> | ||
| - | [server:~] # /etc/rc.d/kerberos start | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (8.04) === | ||
| - | <code> | ||
| - | root@server:~# /etc/init.d/heimdal-kdc restart | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@server:~# /etc/init.d/krb5-kdc restart | ||
| - | </code> | ||
| - | |||
| - | ===== Настройка Kerberos клиента ===== | ||
| - | |||
| - | ==== Инсталляция клиента ==== | ||
| - | |||
| - | === Ubuntu (8.04) === | ||
| - | <code> | ||
| - | root@gate:~# apt-get install heimdal-clients | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@gate:~# apt-get install krb5-user | ||
| - | </code> | ||
| - | |||
| - | ==== Настройка Kerbros Realm ==== | ||
| - | <code> | ||
| - | gate# cat /etc/krb5.conf | ||
| - | [libdefaults] | ||
| - | default_realm = CORPX.UN | ||
| - | </code> | ||
| - | |||
| - | ==== Проверки ==== | ||
| - | <code> | ||
| - | server# kinit user1 | ||
| - | server# klist | ||
| - | server# kdestroy | ||
| - | |||
| - | gate# kinit user1 | ||
| - | gate# klist | ||
| - | gate# kdestroy | ||
| - | </code> | ||
| - | |||
| - | ===== Использование протокола GSSAPI для сервиса sshd ===== | ||
| - | Generic Security Services Application Program Interface | ||
| - | |||
| - | ==== Регистрация принципала сервиса в базе данных kerberos ==== | ||
| - | |||
| - | === FreeBSD, Ubuntu (8.04) === | ||
| - | <code> | ||
| - | server# kadmin -l | ||
| - | kadmin> add -r host/gate.corpX.un | ||
| - | ... | ||
| - | kadmin> list * | ||
| - | |||
| - | kadmin> | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@server:~# kadmin.local | ||
| - | kadmin.local: addprinc -randkey host/gate.corpX.un | ||
| - | ... | ||
| - | kadmin.local: listprincs | ||
| - | |||
| - | kadmin.local: | ||
| - | </code> | ||
| - | |||
| - | ==== Перемещение ключа сервиса на сервер ==== | ||
| - | |||
| - | === FreeBSD, Ubuntu (8.04) === | ||
| - | <code> | ||
| - | kadmin> ext -k gate.keytab host/gate.corpX.un | ||
| - | kadmin> quit | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | kadmin.local: ktadd -k gate.keytab host/gate.corpX.un | ||
| - | ... | ||
| - | ... | ||
| - | ... | ||
| - | kadmin.local: quit | ||
| - | </code> | ||
| - | |||
| - | === FreeBSD, Ubuntu === | ||
| - | <code> | ||
| - | server# scp gate.keytab student@gate: | ||
| - | </code> | ||
| - | |||
| - | === FreeBSD, Ubuntu (8.04) === | ||
| - | <code> | ||
| - | gate# ktutil copy /usr/student/gate.keytab /etc/krb5.keytab | ||
| - | gate# touch /etc/srvtab | ||
| - | |||
| - | gate# ktutil list | ||
| - | ... | ||
| - | |||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@gate:~# ktutil | ||
| - | ktutil: rkt /usr/student/gate.keytab | ||
| - | ktutil: list | ||
| - | ktutil: wkt /etc/krb5.keytab | ||
| - | ktutil: quit | ||
| - | |||
| - | root@gate:~# klist -ek /etc/krb5.keytab | ||
| - | </code> | ||
| - | |||
| - | ==== Настройка сервиса sshd на использование GSSAPI ==== | ||
| - | <code> | ||
| - | gate# cat /etc/ssh/sshd_config | ||
| - | ... | ||
| - | GSSAPIAuthentication yes | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | ==== Настройка клиента ssh на использование GSSAPI ==== | ||
| - | <code> | ||
| - | server# cat /etc/ssh/ssh_config | ||
| - | ... | ||
| - | GSSAPIAuthentication yes | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | ===== Использование pam kerberos для сервиса login ===== | ||
| - | |||
| - | ==== Настройка pam ==== | ||
| - | |||
| - | === FreeBSD === | ||
| - | <code> | ||
| - | [server:~] # cat /etc/pam.d/system | ||
| - | ... | ||
| - | # auth | ||
| - | ... | ||
| - | auth sufficient pam_krb5.so no_warn try_first_pass | ||
| - | #auth sufficient pam_ssh.so no_warn try_first_pass | ||
| - | auth required pam_unix.so no_warn try_first_pass nullok | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (8.04) === | ||
| - | <code> | ||
| - | root@server:~# apt-get install libpam-heimdal | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu (10.04) === | ||
| - | <code> | ||
| - | root@server:~# apt-get install libpam-krb5 | ||
| - | </code> | ||
| - | |||
| - | === Ubuntu === | ||
| - | <code> | ||
| - | root@server:~# cat /etc/pam.d/login | ||
| - | ... | ||
| - | auth sufficient pam_krb5.so | ||
| - | # Standard Un*x authentication. | ||
| - | ... | ||
| - | </code> | ||
| - | |||
| - | ===== Отладка ===== | ||
| - | <code> | ||
| - | user@server$ ssh -vv gate.corpX.un | ||
| - | |||
| - | gate# /usr/sbin/sshd -d | ||
| - | </code> | ||
| - | |||
| - | ===== Нюансы ===== | ||
| - | <code> | ||
| - | kadmin.local: addprinc -e rc4-hmac:normal -randkey cifs/server.example.com | ||
| - | |||
| - | kadmin.local: ktadd -k cifs.server.example.com.keytab -e rc4-hmac:normal cifs/server.example.com | ||
| - | |||
| - | kadmin.local: ank -e rc4-hmac:normal -randkey imap/gate.CORP13.UN@CORP13.UN | ||
| - | </code> | ||
аутентификация_с_использованием_kerberos_сервера.1285317939.txt.gz · Last modified: 2013/05/22 13:50 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
