文章目录
1. Kerberos主kdc安装
KDC (Key Distribution Center)密匙分配中心, 其在kerberos中通常提供两种服务:
- Authentication Service (AS):认证服务
- Ticket-Granting Service (TGS):授予票据服务
1.1 安装kerberos服务
yum -y install krb5-libs krb5-server krb5-workstation krb5-auth-dialog
#其它都安装成功了,但是No package krb5-auth-dialog available.先不管它
1.2 配置kerberos服务
安装完成会在kdc主机上生成配置文件/etc/krb5.conf
和/var/kerberos/krb5kdc/kdc.conf
1.2.1 配置krb5.con
# Other applications require this directory to perform krb5 configuration.
includedir /etc/krb5.conf.d/
[libdefaults] # 每种连接的默认配置,需要注意以下几个关键的小配置
renew_lifetime = 7d #表明凭证最长可以被延期的时限,一般为7天。当凭证过期之后, 对安全认证的服务的后续访问则会失败。
forwardable = true
default_realm = HONEY.COM # 默认的realm,必须跟要配置的realm的名称一致
ticket_lifetime = 24h #表明凭证生效的时限,一般为24小时。
dns_lookup_realm = false
dns_lookup_kdc = false
default_ccache_name = /tmp/krb5cc_%{uid}
#default_tgs_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
#default_tkt_enctypes = aes des3-cbc-sha1 rc4 des-cbc-md5
[domain_realm]
#10.211.55.60 = HONEY.COM #可不配置
[logging] #表示server端的日志的打印位置
default = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log