Committer: fruworg <im@fruw.org>

On branch main
Your branch is up to date with 'origin/main'.

Changes to be committed:
	new file:   .gitmodules
	new file:   archetypes/default.md
	new file:   config.toml
	new file:   content/posts/ald-pro.md
	new file:   content/posts/astra-fly.md
	new file:   content/posts/astra-freeipa.md
	new file:   content/posts/bareos-install.md
	new file:   content/posts/cifs-automount.md
	new file:   content/posts/create-user-keytab.md
	new file:   content/posts/create-user-keytab.md.save
	new file:   content/posts/dhcp-resolv.md
	new file:   content/posts/github-ssh-auth.md
	new file:   content/posts/ip-command.md
	new file:   content/posts/linux-krb5.md
	new file:   content/posts/linux-network.md
	new file:   content/posts/linux-nfs.md.save
	new file:   content/posts/linux-packages-rebuild.md
	new file:   content/posts/lvm-base-commands.md
	new file:   content/posts/pfx-to-pem.md
	new file:   content/posts/pg-probackup-setup.md.save
	new file:   content/posts/pg-probackup-setup.md.save.1
	new file:   content/posts/postgres-drop-db.md
	new file:   content/posts/postgres-krb5.md
	new file:   content/posts/postgres-ldaps.md
	new file:   content/posts/postgres-pro-astra-se.md
	new file:   content/posts/postgres-replication.md
	new file:   content/posts/postgres-simple-backup.md
	new file:   content/posts/postgres-tls.md
	new file:   content/posts/reverse-shell-nc.md
	new file:   content/posts/run-nologin.md
	new file:   content/posts/security-solutions.md
	new file:   content/posts/selfsigned-to-trusted.md
	new file:   content/posts/ssh-2fa-totp.md
	new file:   content/posts/ssh-auth-by-key.md
	new file:   content/posts/ssh-fail2ban.md
	new file:   content/posts/vmware-clipboard.md
	new file:   content/posts/vmware-restart-date.md
	new file:   content/posts/windows-disable-shutdown.md
	new file:   static/0x952C15AB751A65F6
	new file:   static/favicon.ico
	new file:   static/fruworg.png
	new file:   themes/archie

 Changes not staged for commit:
	modified:   themes/archie (modified content)

content/posts/linux-krb5.md

@@ -0,0 +1,86 @@
+---
+title: Установка и конфигурация Kerberos на Linux
+description: На сервере и клиенте
+date: 2022-11-29T13:07:00+05:00
+tags: [linux, krb5]
+---
+## Конфигурация сервера
+
+### Установка пакетов
+```shell
+apt -y install krb5-kdc krb5-admin-server
+```
+
+## Конфигурация клиента
+
+### Установка пакетов
+```shell
+apt -y install krb5-user libpam-krb5
+```
+
+## Общая конфигурация
+На сервере и клиенте надо проделать следующие шаги:
+
+### Смена hostname
+```shell
+hostnamectl set-hostname <hostname>
+```
+
+### Правка файла hosts
+Вместо правки файла hosts можно поднять DNS-сервер и сделать записи там.
+```shell
+<server-ip> <server-name.domain.name> <server-name>
+<client-ip> <client-name.domain.name> <client-name>
+
+# /etc/hosts
+```
+
+### Редактирование конфига Kerberos
+```shell
+[libdefaults]
+        default_realm = <DOMAIN.NAME>
+
+[realms]
+        <DOMAIN.NAME> = {
+                kdc = <server-name.domain.name>
+                admin_server = <server-name.domain.name>
+                kpasswd_server = <server-name.domain.name>
+                default_domain = <DOMAIN.NAME>
+        }
+
+[domain_realm]
+        <domain.name> = <DOMAIN.NAME>
+        .<domain.name> = <DOMAIN.NAME>
+
+# /etc/krb5.conf
+```
+
+## Создание нового реалма (на сервере)
+
+### Создание master key для БД krb5
+```shell
+krb5_newrealm
+```
+
+### Создание учётной записи администратора
+```shell
+kadmin.local
+addprinc <admin-name>/admin
+quit
+```
+
+### Разрешение административных прав 
+```shell
+<admin-name>/admin
+
+# /etc/krb5kdc/kadm5.acl
+```
+
+## Получение билета
+```shell
+kinit <admin-name>\admin
+```
+Проверяем наличие выданного билета:
+```shell
+klist
+```