Translations by Stéphane V

You will then be prompted to enter the name of the Kerberos Realm. Also, if you don't have DNS configured with Kerberos <emphasis>SRV</emphasis> records, the menu will prompt you for the hostname of the Key Distribution Center (KDC) and Realm Administration server.

The <application>dpkg-reconfigure</application> adds entries to the <filename>/etc/krb5.conf</filename> file for your Realm. You should have entries similar to the following:

[libdefaults] default_realm = EXAMPLE.COM ... [realms] EXAMPLE.COM = } kdc = 192.168.0.1 admin_server = 192.168.0.1 }

You can test the configuration by requesting a ticket using the <application>kinit</application> utility. For example:

kinit steve@EXAMPLE.COM

Password for steve@EXAMPLE.COM:

When a ticket has been granted, the details can be viewed using <application>klist</application>:

Next, use the <application>auth-client-config</application> to configure the <application>libpam-krb5</application> module to request a ticket during login:

sudo auth-client-config -a -p kerberos_example

You will should now receive a ticket upon successful login authentication.

For more information on Kerberos see the <ulink url="http://web.mit.edu/Kerberos/">MIT Kerberos</ulink> site.

O'Reilly's <ulink url="http://oreilly.com/catalog/9780596004033/">Kerberos: The Definitive Guide</ulink> is a great reference when setting up Kerberos.

Also, feel free to stop by the <emphasis>#ubuntu-server</emphasis> IRC channel on <ulink url="http://freenode.net/">Freenode</ulink> if you have Kerberos questions.

Kerberos and LDAP

Replicating a Kerberos principal database between two servers can be complicated, and adds an additional user database to your network. Fortunately, MIT Kerberos can be configured to use an <application>LDAP</application> directory as a principal database. This section covers configuring a primary and secondary kerberos server to use <application>OpenLDAP</application> for the principal database.

Next, extract the <filename>kerberos.schema.gz</filename> file:

sudo gzip -d /usr/share/doc/krb5-kdc-ldap/kerberos.schema.gz

sudo cp /usr/share/doc/krb5-kdc-ldap/kerberos.schema /etc/ldap/schema/

The <emphasis>kerberos</emphasis> schema needs to be added to the <emphasis>cn=config</emphasis> tree. The procedure to add a new schema to <application>slapd</application> is also detailed in <xref linkend="openldap-configuration"/>.

include /etc/ldap/schema/core.schema include /etc/ldap/schema/collective.schema include /etc/ldap/schema/corba.schema include /etc/ldap/schema/cosine.schema include /etc/ldap/schema/duaconf.schema include /etc/ldap/schema/dyngroup.schema include /etc/ldap/schema/inetorgperson.schema include /etc/ldap/schema/java.schema include /etc/ldap/schema/misc.schema include /etc/ldap/schema/nis.schema include /etc/ldap/schema/openldap.schema include /etc/ldap/schema/ppolicy.schema include /etc/ldap/schema/kerberos.schema

Create a temporary directory to hold the LDIF files:

Edit the generated <filename>/tmp/ldif_output/cn=config/cn=schema/cn={12}kerberos.ldif</filename> file, changing the following attributes:

dn: cn=kerberos,cn=schema,cn=config ... cn: kerberos

And remove the following lines from the end of the file:

structuralObjectClass: olcSchemaConfig entryUUID: 18ccd010-746b-102d-9fbe-3760cca765dc creatorsName: cn=config createTimestamp: 20090111203515Z entryCSN: 20090111203515.326445Z#000000#000#000000 modifiersName: cn=config modifyTimestamp: 20090111203515Z

ldapadd -x -D cn=admin,cn=config -W -f /tmp/ldif_output/cn\=config/cn\=schema/cn\=\{12\}kerberos.ldif

dn: olcDatabase={1}hdb,cn=config add: olcDbIndex olcDbIndex: krbPrincipalName eq,pres,sub

That's it, your LDAP directory is now ready to serve as a Kerberos principal database.

Primary KDC Configuration

With <application>OpenLDAP</application> configured it is time to configure the KDC.

First, install the necessary packages, from a terminal enter:

sudo apt-get install krb5-kdc krb5-admin-server krb5-kdc-ldap

Now edit <filename>/etc/krb5.conf</filename> adding the following options to under the appropriate sections:

[libdefaults] default_realm = EXAMPLE.COM ... [realms] EXAMPLE.COM = { kdc = kdc01.example.com kdc = kdc02.example.com admin_server = kdc01.example.com admin_server = kdc02.example.com default_domain = example.com database_module = openldap_ldapconf } ... [domain_realm] .example.com = EXAMPLE.COM ... [dbdefaults] ldap_kerberos_container_dn = dc=example,dc=com [dbmodules] openldap_ldapconf = { db_library = kldap ldap_kdc_dn = "cn=admin,dc=example,dc=com" # this object needs to have read rights on # the realm container, principal container and realm sub-trees ldap_kadmind_dn = "cn=admin,dc=example,dc=com" # this object needs to have read and write rights on # the realm container, principal container and realm sub-trees ldap_service_password_file = /etc/krb5kdc/service.keyfile ldap_servers = ldaps://ldap01.example.com ldaps://ldap02.example.com ldap_conns_per_server = 5 }

Change <emphasis>example.com</emphasis>, <emphasis>dc=example,dc=com</emphasis>, <emphasis>cn=admin,dc=example,dc=com</emphasis>, and <emphasis>ldap01.example.com</emphasis> to the appropriate domain, LDAP object, and LDAP server for your network.

Next, use the <application>kdb5_ldap_util</application> utility to create the realm:

sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com create -subtrees dc=example,dc=com -r EXAMPLE.COM -s -H ldap://ldap01.example.com

sudo kdb5_ldap_util -D cn=admin,dc=example,dc=com stashsrvpw -f /etc/krb5kdc/service.keyfile cn=admin,dc=example,dc=com

addprinc -x dn="uid=steve,ou=people,dc=example,dc=com" steve

Authenticating as principal root/admin@EXAMPLE.COM with password. kadmin.local: <placeholder-1/> WARNING: no policy specified for steve@EXAMPLE.COM; defaulting to no policy Enter password for principal "steve@EXAMPLE.COM": Re-enter password for principal "steve@EXAMPLE.COM": Principal "steve@EXAMPLE.COM" created.

There should now be krbPrincipalName, krbPrincipalKey, krbLastPwdChange, and krbExtraData attributes added to the <emphasis>uid=steve,ou=people,dc=example,dc=com</emphasis> user object. Use the <application>kinit</application> and <application>klist</application> utilities to test that the user is indeed issued a ticket.

BOOT_DEGRADED=true

Now extend the Volume Group (VG):

Finally, resize the filesystem:

The <ulink url="http://www.tldp.org/HOWTO/DNS-HOWTO.html">DNS HOWTO</ulink> explains more advanced options for configuring BIND9.

For in depth coverage of <emphasis>DNS</emphasis> and <application>BIND9</application> see <ulink url="http://www.bind9.net/">Bind9.net</ulink>.

<ulink url="http://www.oreilly.com/catalog/dns5/index.html">DNS and BIND</ulink> is a popular book now in it's fifth edition.

A great place to ask for <application>BIND9</application> assistance, and get involved with the Ubuntu Server community, is the <emphasis>#ubuntu-server</emphasis> IRC channel on <ulink url="http://freenode.net">freenode</ulink>.

Ubuntu provides two popular database servers. They are:

They are available in the main repository. This section explains how to install and configure these database servers.