From 597a913615f4f7bd31359e8481a8998cbe41fb26 Mon Sep 17 00:00:00 2001 From: Bruno Raoult Date: Fri, 19 Aug 2022 21:15:18 +0200 Subject: [PATCH] small changes --- nfsv4-kerberos-debian.md | 83 +++++++++++++++++++++++----------------- 1 file changed, 48 insertions(+), 35 deletions(-) diff --git a/nfsv4-kerberos-debian.md b/nfsv4-kerberos-debian.md index f8d2ed9..2916948 100644 --- a/nfsv4-kerberos-debian.md +++ b/nfsv4-kerberos-debian.md @@ -19,12 +19,13 @@ This document will (hopefully) allow you to setup a kerberized NFSv4 server on D - [Kerberos (V5)](#kerberos-v5) - [Naming](#naming) - [Packages installation](#packages-installation) - - [Client and server side](#client-and-server-side) - - [/etc/krb5.conf - main kerberos configuration](#etckrb5conf---main-kerberos-configuration) - - [Server only](#server--only) - - [/etc/heimdal-kdc/kdc.conf - heimdal kdc configuration file](#etcheimdal-kdckdcconf---heimdal-kdc-configuration-file) + - [Configuration](#configuration) + - [Client and server (krb5.conf)](#client-and-server-krb5conf) + - [Server only](#server-only) + - [Heimdal kdc configuration file (kdc.conf)](#heimdal-kdc-configuration-file-kdcconf) + - [Access-control lists (kadmind.acl)](#access-control-lists-kadmindacl) - [Master key](#master-key) - - [database initialization](#database-initialization) + - [Database initialization](#database-initialization) - [Client side](#client-side) - [Testing](#testing) - [NFSv4](#nfsv4) @@ -35,6 +36,11 @@ This document will (hopefully) allow you to setup a kerberized NFSv4 server on D +**TODO** +> glossary + + + ## Introduction If you share some files between your machines, your choice was probably [SMB/CIFS](https://en.wikipedia.org/wiki/Server_Message_Block), as it is supported on nearly any platform (GNU/Linux, MacOS, Windows, iOS, Android, @@ -54,7 +60,7 @@ security, on a [Debian](https://www.debian.org/)-based system (Debian, [Ubuntu]( ## Pre-requisites - [**`NTP`**](https://en.wikipedia.org/wiki/Network_Time_Protocol) : All machines (clients and servers) must be time-synchronized, as Kerberos authentication is partly based on tickets timestamps. - [**`DNS server`**](https://en.wikipedia.org/wiki/Domain_Name_System) (optional) : Kerberos may, in some configurations make use of some DNS records such as [SRV](https://en.wikipedia.org/wiki/SRV_record) or [TXT](https://en.wikipedia.org/wiki/TXT_record). - A lightweight DNS server like [dnsmasq](https://dnsmasq.org/) is sufficient, and will avoid the administration of a full-fledged server such as [bind](https://www.isc.org/bind/). + A lightweight DNS server like [dnsmasq](https://dnsmasq.org/) is sufficient, and will avoid the administration of a full-fledged server such as [bind](https://www.isc.org/bind/). ## Kerberos (V5) There are basically two major implementations of [Kerberos V5](https://datatracker.ietf.org/doc/html/rfc4120) on GNU/Linux: The original [MIT](https://web.mit.edu/kerberos/www/) one, and the [Heimdal](https://github.com/heimdal/heimdal) one. There was also a GNU implementation [Shishi](http://www.gnu.org/software/shishi/), but developement looks stalled for 10+ years. @@ -84,27 +90,12 @@ And on client(s), install the following : ``` $ sudo apt-get install krb5-config heimdal-clients heimdal-docs ``` - -**Note about documentation**: The `heimdal-docs` package will install [`GNU info`](https://en.wikipedia.org/wiki/Info_(Unix)). -If you want HTML documentation, you will have to manually build it from source with the following commands : -``` -$ git clone https://github.com/heimdal/heimdal.git -$ cd heimdal -$ autoreconf -f -i -$ sh autogen.sh -$ ./configure -$ make html -$ cd doc/heimdal.html -$ sudo cp -ar heimdal.html /usr/share/doc/heimdal-docs/ -``` - -### Client and server side -The `krb5-config` package installation will ask you some questions, just fill with the information from Table 1 : +The `krb5-config` package installation will ask you some questions, just fill with the information from table above : - Default Kerberos version 5 realm: `LAN` - Kerberos servers for your realm: `kdc1.lan` and `kdc2.lan` - Administrative server for your Kerberos realm: `kadmin.lan` -After this initial configuration, `/etc/krb5.conf` will have been created with some default value, which can look-like : +After this initial configuration, `/etc/krb5.conf` will have been created with some default value, which can look-like : ``` [libdefaults] default_realm = LAN @@ -123,7 +114,20 @@ After this initial configuration, `/etc/krb5.conf` will have been created with s lan = LAN .lan = LAN ``` -#### /etc/krb5.conf - main kerberos configuration +**Note about documentation**: The `heimdal-docs` package will install [`GNU info`](https://en.wikipedia.org/wiki/Info_(Unix)). +If you want HTML documentation, you will have to manually build it from source with the following commands : +``` +$ git clone https://github.com/heimdal/heimdal.git +$ cd heimdal +$ autoreconf -f -i +$ sh autogen.sh +$ ./configure +$ make html +$ cd doc/heimdal.html +$ sudo cp -ar heimdal.html /usr/share/doc/heimdal-docs/ +``` +### Configuration +#### Client and server (krb5.conf) The `/etc/krb5.conf` can be changed at any time, and we will immediately make some changes with some sane defaults (see `krb5.conf(5)` for more details) : ``` [appdefaults] @@ -175,11 +179,11 @@ The `/etc/krb5.conf` can be changed at any time, and we will immediately make so admin_server = SYSLOG:DEBUG:AUTH default = SYSLOG:DEBUG:AUTH ``` -### Server only -#### /etc/heimdal-kdc/kdc.conf - heimdal kdc configuration file -See `kdc(8)` for configuration details. In this file, we just setup the `[kdc]` section : +### Server only +#### Heimdal kdc configuration file (kdc.conf) +`/etc/heimdal-kdc/kdc.conf` (see `kdc(8)` for details) is the Heimdal KDC configuration file. In this file, we just setup the `[kdc]` section as below. Note that I prefer to use an `sqlite` database, simply because many tools allow to browse/edit the content. ``` -$ grep -vE '(\#|^$)' kdc.conf +$ grep -vE '(\#|^$)' kdc.conf [kdc] database = { dbname = sqlite:/var/lib/heimdal-kdc/heimdal-lan.sqlite3 @@ -188,6 +192,12 @@ $ grep -vE '(\#|^$)' kdc.conf } addresses = 0.0.0.0 ``` +#### Access-control lists (kadmind.acl) +`/etc/heimdal-kdc/kadmind.acl` is the file giving access to non-local administration (i.e. when using `kadmin` without `-l` option). See `kadmind(8)` for syntax details. To get a simple administration, we give full admin rights to `bruno/admin@LAN` principal, and allow any principal in admin +``` +bruno/admin@LAN all +*/admin@LAN add,get-keys host/*@LAN +``` #### Master key **Note**: A master key is mainly necessary if you store the database in a shared location (think about backups), to make brute-force attacks more difficult. For testing purpose, you may skip this section. @@ -195,14 +205,16 @@ First, we will Use`kstash(1)` to give a master key to the database (we don't nee ``` $ sudo kstash --random-key -k /var/lib/heimdal-kdc/m-key ``` -#### database initialization -The three `kadmin` commands below will initialize `LAN` realm, create a `bruno/admin` XXX, and list the known YYY : +#### Database initialization +The four `kadmin` commands below will initialize `LAN` realm, create a `bruno/admin` principal, and list the known principals : ``` $ sudo kadmin -l kadmin> init LAN Realm max ticket life [unlimited]: Realm max renewable ticket life [unlimited]: - +``` +Add a user +``` kadmin> add bruno/admin Max ticket life [1 day]: Max renewable life [1 week]: @@ -212,7 +224,9 @@ Attributes []: Policy [default]: bruno/admin@LAN's Password: Verify password - bruno/admin@LAN's Password: +``` +``` kadmin> get -s * Principal Expiration PW-exp PW-change Max life Max renew krbtgt/LAN never never 2022-08-17 unlimited unlimited @@ -225,8 +239,7 @@ WELLKNOWN/org.h5l.fast-cookie@WELLKNOWN:ORG.H5L never never 2022-08-17 default never never 2022-08-17 1 day 1 week bruno/admin never never 2022-08-17 1 day 1 week ``` - -Then, +Then, TODO... ### Client side ### Testing ## NFSv4 @@ -236,8 +249,8 @@ Then, ## Sources Kerberos : - `heimdal-docs` package documentation : - - info help: `$ info heimdal` - - HTML documentation (if installed), it should be in `/usr/share/doc/heimdal-docs/heimdal.html/index.html` + - info help: `$ info heimdal` + - HTML documentation (if installed as above): You will find it in `/usr/share/doc/heimdal-docs/heimdal.html/index.html` - [Heimdal setup on Debian](http://chschneider.eu/linux/server/heimdal.shtml). - [Debian/Ubuntu Linux with Active Directory Kerberos Server](http://www.cs.rug.nl/~jurjen/ApprenticesNotes/ad_kinit.html) - [Principal names and DNS](https://web.mit.edu/kerberos/krb5-1.13/doc/admin/princ_dns.html)