
40
Cyclades ACS 5000 Advanced Console Server Command Reference Guide
The login program or kinit decrypts the TGT using the user's key, which is computed from the
user's password. The TGT, which is set to expire after a certain period of time, is stored in the
credentials cache. An expiration time is set so that a compromised TGT may only be used for a
certain period of time, usually eight hours, unlike a compromised password, which could be used
until changed. The user does not have to re-enter the password until the TGT expires or a new
session is started.
When the user needs access to a network service, the client uses the TGT to request a ticket for the
service from the Ticket Granting Service (TGS), which runs on the KDC. The TGS issues a ticket
for the desired service, which is used to authenticate the user.
Configuring the console server to use Kerberos tickets authentication
The following procedure describes the console server’s configuration, assuming that the kerberos
server with ticket support is properly configured with the following parameters.
•
Principal: john
•
Host: acs48.cyclades.com
To configure the console server for SSH:
1.
Configure and start an NTP server. Configuration must be synchronized with an NTP server.
To configure an NTP server, see
To configure an NTP server:
on page 85.
2.
Configure authentication type and protocol in the /etc/portslave/pslave.conf file with the
following parameters.
all.authtype local
all.protocol socket_ssh.
3.
Activate and save the configuration.
#
runconf
#
saveconf
4.
Add a user with the same name as the principal in the Kerberos server.
#
adduser john
5.
Configure the krb5.conf file. The /etc/krb5.conf file must be exactly the same as the one that is
in the Kerberos server. It is highly recommended to copy it directly from the server, instead of
editing it. To copy using scp, execute the following command.
#
scp [email protected]:/etc/krb5.conf /etc/krb5.conf
6.
Extract the host that is in the Kerberos server database to the console server.
#
kadmin -p admin/admin
Where the first admin is the service and the second admin is the user.
This prompts a Kerberos server menu. To extract the configured hosts run the following
commands in the kadmin menu.
Summary of Contents for Cyclades ACS 5000 SERIES
Page 1: ...CYCLADES ACS 5000 Command Reference Guide ...
Page 8: ...vi Cyclades ACS 5000 Advanced Console Server Command Reference Guide ...
Page 16: ...8 Cyclades ACS 5000 Advanced Console Server Command Reference Guide ...
Page 40: ...32 Cyclades ACS 5000 Advanced Console Server Command Reference Guide ...
Page 62: ...54 Cyclades ACS 5000 Advanced Console Server Command Reference Guide ...
Page 76: ...68 Cyclades ACS 5000 Advanced Console Server Command Reference Guide ...
Page 151: ......
Page 152: ...590 814 501B For Technical Support www avocent com support ...