Novell LINUX ENTERPRISE DESKTOP 11, Manual

Page: 116 / 450

6.4.8 Creating Kerberos Service Principals
So far, only user credentials have been discussed. However, Kerberos-compatible ser-
vices usually need to authenticate themselves to the client user, too. Therefore, special
service principals must be present in the Kerberos database for each service offered in
the realm. For example, if ldap.example.com offers an LDAP service, you need a service
principal,
ldap/ldap.example.com@EXAMPLE.COM
, to authenticate this service
to all clients.
The naming convention for service principals is
service / hostname @ REALM
, where
hostname
is the host's fully qualified hostname.
Valid service descriptors are:
Service Service Descriptor
Telnet, RSH, SSH host
NFSv4 (with Kerberos support) nfs
HTTP (with Kerberos authentication) HTTP
IMAP imap
POP3 pop
LDAP ldap
Service principals are similar to user principals, but have significant differences. The
main difference between a user principal and a service principal is that the key of the
former is protected by a password—when a user obtains a ticket-granting ticket from
the KDC, he needs to type his password so Kerberos can decrypt the ticket. It would
be quite inconvenient for the system administrator if he had to obtain new tickets for
the SSH daemon every eight hours or so.
Instead, the key required to decrypt the initial ticket for the service principal is extracted
by the administrator from the KDC once and stored in a local file called the keytab.
102 Security Guide