IBM RS/6000 SP, Problem Determination Manual

Page: 93 / 316

This soft copy for use by IBM employees only.
3.2.3 Realm
A realm is the set of principals sharing the same authentication database and
authentication server. The realm name identifies each independently
administered Kerberos site. Kerberos does not specify any constraints on the
form of the realm name. When
setup_authent
is run, the realm name is set to
the primary authentication server
′
s (usually the Control Workstation) domain
name converted to uppercase. If you want to set your own realm name, you
must edit the /etc/krb.conf and /etc/krb.realm files.
3.2.4 Ticket
To use a Kerberos service, a client must supply a ticket previously obtained from
Kerberos. A ticket for a service is a string of bits which have been encrypted
using the private key for that service. The ticket contains the following data:
•
The name of the client (user)
•
The current time
•
The length of time the ticket will be valid
•
The name of the workstation
•
A randomly created DES key (the session key)
3.2.5 Key
The key is the password associated with a Kerberos user or service. Keys are
stored in the Kerberos database. Keys are used to encrypt the data packets
used by Kerberos clients and services.
3.2.6 Ticket-Granting Ticket
When a user executes the kinit command, a request is sent to the
authentication server. This request contains the user
′
s (principal) name and the
name of a special Kerberos service, the ticket-granting service. The
authentication server checks if the user is known to Kerberos. If it is, Kerberos
creates a random session key and a ticket for the ticket-granting service. This
ticket contains:
•
The client name
•
The name of the ticket-granting server
•
The current time
•
The lifetime of the ticket
•
The client
′
s IP address
• The session key (which was just created)
This ticket is encrypted with a key (using the principal
′
s password) known only to
the ticket-granting server and the authentication server and sent back to the
client. This ticket is then stored in the user
′
s t i c k e t c a c h e f i l e ( / t m p / t k t < u i d > )
and is known as the ticket-granting ticket. Whenever the client goes back to
Kerberos for an additional service-specific ticket, the response is encrypted
using the session key from the ticket-granting ticket.
Chapter 3. K e r b e r o s
73