以下为客户端配置：
[root@test-vm1 ~]# vi /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
default_realm = FAYSON.COM
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
[realms]
FAYSON.COM = {
kdc = 192.168.116.137
admin_server = 192.168.116.137
}
[domain_realm]
.192.168.116.137 = FAYSON.COM
192.168.116.137 = FAYSON.COM
以下为参考：
[ec2-user@ip-172-31-16-68 ~]$ sudo vim /etc/krb5.conf
# Configuration snippets may be placed in this directory as well
includedir /etc/krb5.conf.d/
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = FAYSON.COM
#default_ccache_name = KEYRING:persistent:%{uid}
[realms]
FAYSON.COM = {
kdc = ip-172-31-16-68.ap-southeast-1.compute.internal
admin_server = ip-172-31-16-68.ap-southeast-1.compute.internal
}
[domain_realm]
.ap-southeast-1.compute.internal = FAYSON.COM
ap-southeast-1.compute.internal = FAYSON.COM
服务端权限控制：
[root@test-vm3 ~]# vi /var/kerberos/krb5kdc/kadm5.acl
*/[email protected] *
~
服务端配置：
[root@test-vm3 ~]# vi /var/kerberos/krb5kdc/kdc.conf
[kdcdefaults]
kdc_ports = 88
kdc_tcp_ports = 88
[realms]
FAYSON.COM= {
#master_key_type = aes256-cts
max_renewable_life= 7d 0h 0m 0s
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported_enctypes = aes128-cts:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
}
.创建Kerberos数据库
[ec2-user@ip-172-31-16-68 ~]$ sudo kdb5_util create -r FAYSON.COM -s
Loading random data
Initializing database '/var/kerberos/krb5kdc/principal' for realm 'FAYSON.COM',
master key name 'K/[email protected]'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:
[ec2-user@ip-172-31-16-68 ~]$
创建Kerberos的管理账号
[ec2-user@ip-172-31-16-68 ~]$ sudo kadmin.local
Authenticating as principal root/[email protected] with password.
kadmin.local: addprinc admin/[email protected]
WARNING: no policy specified for admin/[email protected]; defaulting to no policy
Enter password for principal "admin/[email protected]":
Re-enter password for principal "admin/[email protected]":
Principal "admin/[email protected]" created.
kadmin.local: exit
[ec2-user@ip-172-31-16-68 ~]$
将Kerberos服务添加到自启动服务，并启动krb5kdc和kadmin服务
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl enable krb5kdc
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl enable kadmin
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl start krb5kdc
[ec2-user@ip-172-31-16-68 ~]$ sudo systemctl start kadmin