From 9dd925cd205f4680c9015b9776f78ba2e4742dac Mon Sep 17 00:00:00 2001 From: Tom Rhodes Date: Wed, 10 Sep 2003 19:31:36 +0000 Subject: [PATCH] Clean up the so that they are in a logical order. This will index the KerberosIV entries under KerberosIV and Kerberos5 entries under Kerberos5. --- .../books/handbook/security/chapter.sgml | 64 +++++++++++++++---- 1 file changed, 52 insertions(+), 12 deletions(-) diff --git a/en_US.ISO8859-1/books/handbook/security/chapter.sgml b/en_US.ISO8859-1/books/handbook/security/chapter.sgml index 375fa2b3d4..6d82620fe3 100644 --- a/en_US.ISO8859-1/books/handbook/security/chapter.sgml +++ b/en_US.ISO8859-1/books/handbook/security/chapter.sgml @@ -419,7 +419,7 @@ vast majority of break-ins occur remotely, over a network, from people who do not have physical access to your workstation or servers. - Kerberos + KerberosIV Using something like Kerberos also gives you the ability to disable or change the password for a staff account in one place, @@ -916,7 +916,7 @@ Access Issues with Kerberos and SSH ssh - Kerberos + KerberosIV There are a few issues with both Kerberos and ssh that need to be addressed if @@ -1457,8 +1457,7 @@ permit port ttyd0 KerberosIV - KerberosIV - + Kerberos is a network add-on system/protocol that allows users to authenticate themselves through the services of a secure server. Services such as remote login, remote copy, secure inter-system file @@ -1470,12 +1469,12 @@ permit port ttyd0 relevant manual pages for a complete description. - Installing Kerberos + Installing KerberosIV MIT - Kerberos - installing + KerberosIV + Installing Kerberos is an optional component of &os;. The easiest way to install this software is by selecting the krb4 or @@ -1577,7 +1576,7 @@ It is important that you NOT FORGET this password. Now we have to save the key so that servers on the local machine can pick it up. Use the kstash command to do this: - + &prompt.root; kstash Enter Kerberos master key: @@ -1585,14 +1584,19 @@ It is important that you NOT FORGET this password. Current Kerberos master key version is 1. Master key entered. BEWARE! - + This saves the encrypted master password in /etc/kerberosIV/master_key. Making It All Run - + + + KerberosIV + Inital Startup + + Two principals need to be added to the database for each system that will be secured with Kerberos. Their names are kpasswd and rcmd. @@ -1945,8 +1949,6 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995 <application>Kerberos5</application> - Kerberos5 - Every &os; release beyond &os;-5.1 includes support only for Kerberos5. Hence Kerberos5 is the only version @@ -2011,6 +2013,10 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995 History + + Kerberos5 + History + Kerberos was created by MIT as a solution to network security problems. @@ -2053,6 +2059,10 @@ FreeBSD BUILT-19950429 (GR386) #0: Sat Apr 29 17:50:09 SAT 1995 Setting up a Heimdal <acronym>KDC</acronym> + + Kerberos5 + Key Distribution Center Configuration + The Key Distribution Center (KDC) is the centralized authentication service that @@ -2187,6 +2197,11 @@ _kerberos IN TXT EXAMPLE.ORG. <application>Kerberos</application> enabling a server with Heimdal services + + Kerberos5 + Enabling Services + + First, we need a copy of the Kerberos configuration file, /etc/krb5.conf. To do so, simply copy it over to the client computer from the @@ -2286,6 +2301,11 @@ _kerberos IN TXT EXAMPLE.ORG. <application>Kerberos</application> enabling a client with Heimdal + + Kerberos5 + Client Configuration + + Setting up a client computer is almost trivially easy. As far as Kerberos configuration goes, you only need the Kerberos @@ -2339,6 +2359,11 @@ _kerberos IN TXT EXAMPLE.ORG. User configuration files: <filename>.k5login</filename> and <filename>.k5users</filename> + + Kerberos5 + User Configuration Files + + Users within a realm typically have their Kerberos principal (such as tillman@EXAMPLE.ORG) mapped to a local @@ -2379,6 +2404,11 @@ _kerberos IN TXT EXAMPLE.ORG. <application>Kerberos</application> Tips, Tricks, and Troubleshooting + + Kerberos5 + Troubleshooting + + When using either the Heimdal or MIT @@ -2549,6 +2579,11 @@ _kerberos IN TXT EXAMPLE.ORG. Mitigating limitations found in <application>Kerberos</application> + + Kerberos5 + Limitations and Shortcomings + + <application>Kerberos</application> is an all-or-nothing approach @@ -2633,6 +2668,11 @@ _kerberos IN TXT EXAMPLE.ORG. Resources and further information + + Kerberos5 + External Resources + +