Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 111 / 450

Figure 6.3 YaST: Advanced Configuration of a Kerberos Client
For more information about the configuration of Expert PAM Settings and PAM Services
tabs, see the official documentation referenced in
Section 6.5, “For More Information”
(page 108) and the manual page
man 5 krb5.conf
.
Manually Configuring Kerberos Clients
When configuring Kerberos, there are basically two approaches you can take—static
configuration in the
/etc/krb5.conf
file or dynamic configuration with DNS.
With DNS configuration, Kerberos applications try to locate the KDC services using
DNS records. With static configuration, add the hostnames of your KDC server to
krb5
.conf
(and update the file whenever you move the KDC or reconfigure your realm
in other ways).
DNS-based configuration is generally a lot more flexible and the amount of configuration
work per machine is a lot less. However, it requires that your realm name is either the
same as your DNS domain or a subdomain of it. Configuring Kerberos via DNS also
creates a minor security issue—an attacker can seriously disrupt your infrastructure
through your DNS (by shooting down the name server, spoofing DNS records, etc.).
However, this amounts to a denial of service at most. A similar scenario applies to the
Network Authentication with Kerberos 97