Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 101 / 450

Here is a short list of some applications that use Kerberos authentication. These appli-
cations can be found under
/usr/lib/mit/bin
or
/usr/lib/mit/sbin
after
installing the package
krb5-apps-clients
. They all have the full functionality of
their common UNIX and Linux brothers plus the additional bonus of transparent authen-
tication managed by Kerberos:
• telnet, telnetd
• rlogin
• rsh, rcp, rshd
• ftp, ftpd
• ksu
You no longer have to enter your password for using these applications because Kerberos
has already proven your identity. ssh, if compiled with Kerberos support, can even
forward all the tickets acquired for one workstation to another one. If you use ssh to
log in to another workstation, ssh makes sure that the encrypted contents of the tickets
are adjusted to the new situation. Simply copying tickets between workstations is not
sufficient because the ticket contains workstation-specific information (the IP address).
XDM, GDM, and KDM offer Kerberos support, too. Read more about the Kerberos
network applications in Kerberos V5 UNIX User's Guide at
http://web.mit.edu/
kerberos
.
6.4 Installing and Administering
Kerberos
A Kerberos environment consists of several different components. A key distribution
center (KDC) holds the central database with all Kerberos-relevant data. All clients
rely on the KDC for proper authentication across the network. Both the KDC and the
clients need to be configured to match your setup:
General Preparations
Check your network setup and make sure it meets the minimum requirements out-
lined in
Section 6.4.1, “Kerberos Network Topology” (page 88). Choose an appro-
priate realm for your Kerberos setup, see Section 6.4.2, “Choosing the Kerberos
Network Authentication with Kerberos 87