...
The file contains a section for logging configuration, default settings, realms and DNS to domain mappings to easily locate the Kerberos Distribution Center (KDC). Below is an example krb5.conf configuration file from a Linux workstation setup for the EXAMPLE.COM realm:
No Format |
---|
[DIRxSBOX:logging] default = FILE:/var/log/krb5libs.log kdc = FILE:/var/log/krb5kdc.log admin_server = FILE:/var/log/kadmind.log [DIRxSBOX:libdefaults] default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = false ticket_lifetime = 24h forwardable = yes default_tgs_enctypes = des-cbc-md5 default_tkt_enctypes = des-cbc-md5 preferred_enctypes = des-cbc-md5 permitted_enctypes = des-cbc-md5 [DIRxSBOX:realms] EXAMPLE.COM = { kdc = localhost:88 kpasswd_server = localhost:464 default_domain = example.com } [DIRxSBOX:domain_realm] .example.com = EXAMPLE.COM example.com = EXAMPLE.COM [DIRxSBOX:kdc] profile = /var/kerberos/krb5kdc/kdc.conf [DIRxSBOX:appdefaults] pam = { debug = false forwardable = true krb4_convert = false } |
...
Note | ||
---|---|---|
| ||
Presently found some issues with pam authentication when setting ticket and renew lifetimes. If you get the following error then you might try removing these properties from your pam section in the krb5.conf file: Authentication failure (KDC reply did not match expectations). |
Wiki Markup |
---|
In the \[DIRxSBOX:realms\] section you want to again substitute your realm name for EXAMPLE.COM. Remember case makes a difference and realm names need to be in all uppercase. In this section you configure the server and port for the KDC. Apache Directory is the KDC and its Kerberos port by default runs on port 88. The next parameter is, *kpasswd_server*, this is for the changepw protocol service which also runs on Apache Directory. The default port is 464 for this protocol and Apache Directory runs the service by default on this port. The last parameter in this section is the *default_domain*. This is the DNS domain name to use to locate the *kdc* and the *kpasswd_server* if they cannot be resolved by the non-qualified host name specified. |
Wiki Markup |
---|
The last section that we're concerned with is the \[DIRxSBOX:domain_realm\] section. Here we map the DNS domain name to the Kerberos realm name. Note that the first line has a '.' in front of the domain name. You must also add a dot and substitute the search domain for the kdc and the kpasswd_server. |
...