[HOWTO] Kerberos for small networks, without LDAP or AD

[Bones]

Please post comments and constructive criticism in this thread.

Simple Kerberos HOWTO
The purpose of this guide is to walk an admin through the steps needed to Kerberise a small network. I wrote it because I couldn't find anything on the Internet that suited my needs. All of the HOWTOs I found were for setting up industrial-strength, redundant solutions appropriate for a corporate network. Those sorts of setups are fabulously capable, but they are massively over-engineered for a small network. I was looking primarily for single sign-on (SSO) to my network services... and that's all. I didn't need LDAP, didn't need NIS, and didn't want to integrate Windows AD into my network.

I'll try not to bore you with details of how Kerberos works, and instead stick with the practical matter of getting Kerberos up and running. I assume basic knowledge of Kerberos terms and concepts. If you don't know at least a little about Kerberos, go read up on it now.

The end product of this guide is a fully functional Kerberos realm, with:

• A master KDC running on a Linux host without failover capability (no fault tolerance)
  
• Single Sign-on (SSO) capability for network services, without having to remember or type in different passwords for each service
  
• Windows clients directly integrated into the Kerberos realm without the use of Active Directory
  

Also covered is how to Kerberise the following services:

• OpenSSH
  
• Samba file sharing
  
• IMAP mail service with virtual users, courtesy of Dovecot
  

Why Kerberos?
I chose Kerberos because it has seen many years of development and deployment; it is mature. It can be easily integrated into a network in stages, and can be set up to work transparently to the network users. Many services have built-in support for Kerberos. Basically, if it has GSSAPI capability, it can directly use Kerberos. By extension, anything that supports SASL (which can interface with GSSAPI) can also authenticate with Kerberos.

Which Kerberos?
Several Kerberos implementations are available. Possibly the best known is used by Microsoft Windows AD services. On the open source side of things are the Heimdal and MIT packages. This guide was developed while using the MIT-Kerberos package, version 1.5.2, on Gentoo Linux systems. The necessary Gentoo packages are:

• app-crypt/mit-krb5-1.5.2-r1
  
• sys-auth/pam_krb5-20030601-r1
  

These packages should be installed on each Gentoo host on the network.
_________________
I have a computer.

[Bones]

Required Infrastructure
Kerberos requires NTP and DNS.

NTP
Kerberos authentication is time sensitive. The system times between the client and the server hosts must be synchronized, or at least nearly so. Clock time discrepancies of more than 5 minutes (in the default configuration) will result in authenticaion failure. No two machines keep time at the same rate, and so the clocks WILL drift apart without active intervention. The easiest way to keep the clocks in sync is to use NTP on every host, either running as a daemon (preferred), or periodically as a cron job to make step adjustments to the system clock.

DNS
Kerberos makes heavy use of name services. Almost every operation involves a lookup of some sort, so it is vital to have a healthy DNS in place. Any misconfiguration or problem will result in a broken or partially functional Kerberos system. Your DNS must be capable of forward and reverse lookups. On each host, a name lookup must return the fully qualified domain name (FQDN). THIS IS VITALLY IMPORTANT. To check this, run this command on each host:

[Bones]

Creating the Kerberos Database
Create the Kerberos database using the kdb5_util program. As root:

[Bones]

Adding a Network Host to the Kerberos Realm
This section of the guide configures a computer to take part in the Kerberos realm. This involves making PAM kerberos aware, and installing host service principals into the system keytab for the SSH server. I consider SSH to be a critical service for every host on my network, so I'll cover the Kerberos configuration in this section.

PAM Configuration
First, a word about user accounts. Kerberos does not act as a database for user accounts as far as user logins are concerned. The network admin must still configure user accounts on each individual machine. Kerberos does not replace the /etc/passwd or /etc/shadow files! It only handles authentication. So there is a duality, of sorts, with this type of Kerberos setup. Each host keeps a list of users, and Kerberos keeps its own list of users (principals).

When logging in, PAM will try to get a TGT for the principal named "loginname@REALM" using the password typed in by the user. Therefore, when adding new user accounts to machines on your network, make sure to add Kerberos principals with the same name.

The pam_krb5 module makes Kerberising PAM quite easy. Basically, the pam_krb5 module is inserted into the system-auth PAM configuration file, in front of the pam_unix module. PAM will then try to authenticate with Kerberos first, and we will set things up to allow normal pam_unix authentication in case the KDC is not available. We will also configure PAM to handle Kerberos password changes transparently with system user password changes.

*** Warning! Open up another terminal somewhere before testing changes to PAM configuration files. If you screw it up badly, you may have problems logging back in to make fixes! You can use the previously opened terminal to make emergency repairs. ***

Make these changes to the auth and password sections of /etc/pam.d/system-auth:

[Bones]

Samba Configuration
To enable Kerberos functionality, Samba should be compiled with the "kerberos" and "ldap" USE flags. Even though we are not using LDAP, the Samba build requires it to be present for Kerberos.

Samba uses a cifs/fqdn service principal to do its business. Add it to the Kerberos database and the system keytab using the kadmin utility. Here we will assume the FQDN of the file sharing machine is sambabox.tiny.net. As root on the Samba server:

[Bones]

Adding a Windows Client to the Kerberos Realm
This section of the guide implements Kerberos support in Windows 2000/XP as a client to the realm. We will first add the Windows machine to the realm, and then discuss how to get Windows to talk to a Kerberised Samba server. These instructions are for XP, but the Windows 2000 setup is exactly the same except that some of the GUI button labels are different.

Adding the Windows Machine to the Kerberos Database
Use kadmin to add a host/fqdn principal to the Kerberos database. In this example, we will assume that the Windows machine has a FQDN of windbox.tiny.net. Do not use the -randkey option here like we did for the Linux hosts; we must give the password to Windows later on. The Arcfour encryption type MUST be specified here as the only type allowed for this principal:

[Bones]

Mail Server Configuration
This section covers the configuration of the Dovecot server, and the Thunderbird 2.0 mail client.

Dovecot Configuration
Dovecot can use Kerberos as its user database, allowing us to set up a virtual mail system that provides a mailbox for every Kerberos principal. First, create an imap/fqdn service principal and add it to the keytab on the IMAP server. We will assume that our mail server has a FQDN of mailserver.tiny.net:

[Xn0r]

Nice writeup for KRB n00bs like myself.

You may want to reiterate that when you run kadmin and add the principal for the SSH server host (testbox in your example), that this should be run ON testbox, otherwise it wont put the key into the system keytab on that host.

Rather obvious now, but when I was n00bing around with it I didn't think about it.