mirror of
https://github.com/fruworg/fruworg.github.io.git
synced 2024-11-16 09:27:17 +03:00
9c4706e826
On branch main Your branch is up to date with 'origin/main'. Changes to be committed: new file: .gitmodules new file: archetypes/default.md new file: config.toml new file: content/posts/ald-pro.md new file: content/posts/astra-fly.md new file: content/posts/astra-freeipa.md new file: content/posts/bareos-install.md new file: content/posts/cifs-automount.md new file: content/posts/create-user-keytab.md new file: content/posts/create-user-keytab.md.save new file: content/posts/dhcp-resolv.md new file: content/posts/github-ssh-auth.md new file: content/posts/ip-command.md new file: content/posts/linux-krb5.md new file: content/posts/linux-network.md new file: content/posts/linux-nfs.md.save new file: content/posts/linux-packages-rebuild.md new file: content/posts/lvm-base-commands.md new file: content/posts/pfx-to-pem.md new file: content/posts/pg-probackup-setup.md.save new file: content/posts/pg-probackup-setup.md.save.1 new file: content/posts/postgres-drop-db.md new file: content/posts/postgres-krb5.md new file: content/posts/postgres-ldaps.md new file: content/posts/postgres-pro-astra-se.md new file: content/posts/postgres-replication.md new file: content/posts/postgres-simple-backup.md new file: content/posts/postgres-tls.md new file: content/posts/reverse-shell-nc.md new file: content/posts/run-nologin.md new file: content/posts/security-solutions.md new file: content/posts/selfsigned-to-trusted.md new file: content/posts/ssh-2fa-totp.md new file: content/posts/ssh-auth-by-key.md new file: content/posts/ssh-fail2ban.md new file: content/posts/vmware-clipboard.md new file: content/posts/vmware-restart-date.md new file: content/posts/windows-disable-shutdown.md new file: static/0x952C15AB751A65F6 new file: static/favicon.ico new file: static/fruworg.png new file: themes/archie Changes not staged for commit: modified: themes/archie (modified content)
87 lines
2.0 KiB
Markdown
87 lines
2.0 KiB
Markdown
---
|
||
title: Установка и конфигурация Kerberos на Linux
|
||
description: На сервере и клиенте
|
||
date: 2022-11-29T13:07:00+05:00
|
||
tags: [linux, krb5]
|
||
---
|
||
## Конфигурация сервера
|
||
|
||
### Установка пакетов
|
||
```shell
|
||
apt -y install krb5-kdc krb5-admin-server
|
||
```
|
||
|
||
## Конфигурация клиента
|
||
|
||
### Установка пакетов
|
||
```shell
|
||
apt -y install krb5-user libpam-krb5
|
||
```
|
||
|
||
## Общая конфигурация
|
||
На сервере и клиенте надо проделать следующие шаги:
|
||
|
||
### Смена hostname
|
||
```shell
|
||
hostnamectl set-hostname <hostname>
|
||
```
|
||
|
||
### Правка файла hosts
|
||
Вместо правки файла hosts можно поднять DNS-сервер и сделать записи там.
|
||
```shell
|
||
<server-ip> <server-name.domain.name> <server-name>
|
||
<client-ip> <client-name.domain.name> <client-name>
|
||
|
||
# /etc/hosts
|
||
```
|
||
|
||
### Редактирование конфига Kerberos
|
||
```shell
|
||
[libdefaults]
|
||
default_realm = <DOMAIN.NAME>
|
||
|
||
[realms]
|
||
<DOMAIN.NAME> = {
|
||
kdc = <server-name.domain.name>
|
||
admin_server = <server-name.domain.name>
|
||
kpasswd_server = <server-name.domain.name>
|
||
default_domain = <DOMAIN.NAME>
|
||
}
|
||
|
||
[domain_realm]
|
||
<domain.name> = <DOMAIN.NAME>
|
||
.<domain.name> = <DOMAIN.NAME>
|
||
|
||
# /etc/krb5.conf
|
||
```
|
||
|
||
## Создание нового реалма (на сервере)
|
||
|
||
### Создание master key для БД krb5
|
||
```shell
|
||
krb5_newrealm
|
||
```
|
||
|
||
### Создание учётной записи администратора
|
||
```shell
|
||
kadmin.local
|
||
addprinc <admin-name>/admin
|
||
quit
|
||
```
|
||
|
||
### Разрешение административных прав
|
||
```shell
|
||
<admin-name>/admin
|
||
|
||
# /etc/krb5kdc/kadm5.acl
|
||
```
|
||
|
||
## Получение билета
|
||
```shell
|
||
kinit <admin-name>\admin
|
||
```
|
||
Проверяем наличие выданного билета:
|
||
```shell
|
||
klist
|
||
```
|