30-34
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2948G-GE-TX, and Catalyst 2980G Switches Software Configuration Guide—Release 8.2GLX
78-15908-01
Chapter 30 Configuring Switch Access Using AAA
Configuring Authentication
Copying SRVTAB Files
To allow remote users to authenticate to the switch using Kerberos credentials, the switch must share a
key with the KDC. You must give the switch a copy of the file that is stored in the KDC that contains the
key. These files are called SRVTAB files on the switch and KEYTAB files on the servers.
The most secure method of copying SRVTAB files to the hosts in your Kerberos realm is to copy them
onto physical media and then manually copy the files onto the system. To copy SRVTAB files to a switch
that does not have a physical media drive, you must transfer them through the network by using the
Trivial File Transfer Protocol (TFTP).
When you copy the SRVTAB file from the switch to the KDC, the switch parses the information in this
file and stores it in the running configuration in the Kerberos SRVTAB entry format. If you enter the
SRVTAB directly into the switch, create an entry for each Kerberos principal (service) on the switch.
The entries are maintained in the SRVTAB table. The maximum size of the table is 20 entries.
To retrieve SRVTAB files to the switch from the KDC, perform this task in privileged mode:
This example shows how to retrieve an SRVTAB file from the KDC, enter an SRVTAB directly into the
switch, and verify the configuration:
Console> (enable) set kerberos srvtab remote 187.20.32.10 /users/jdoe/krb5/ninerskeytab
Console> (enable)
Console> (enable) set kerberos srvtab entry host/[email protected] 0 932423923 1
1 8 03;;5>00>50;0=0=0
Kerberos SRVTAB entry set to
Principal:host/[email protected]
Principal Type:0
Timestamp:932423923
Key version number:1
Key type:1
Key length:8
Encrypted key tab:03;;5>00>50;0=0=0
Console> (enable) show kerberos
Kerberos Local Realm:CISCO.COM
Kerberos server entries:
Realm:CISCO.COM, Server:187.0.2.1, Port:750
Realm:CISCO.COM, Server:187.20.2.1, Port:750
Kerberos Domain<->Realm entries:
Domain:cisco.com, Realm:CISCO.COM
Task
Command
Step 1
Retrieve a specified SRVTAB file from the KDC. set kerberos srvtab remote {hostname |
ip-address} filename
Step 2
(Optional) You can enter the SRVTAB directly
into the switch.
set kerberos srvtab entry kerberos-principal
principal-type timestamp key-version number
key-type key-length encrypted-keytab