Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 107 / 450

6
Start the Kerberos Daemon
Once the KDC software is installed and properly
configured, start the Kerberos daemon to provide Kerberos service for your realm.
Refer to
Section “Starting the KDC” (page 94) for details.
7 Create a Principal for Yourself You need a principal for yourself. Refer to
Section “Creating a Principal” (page 94) for details.
Setting Up the Database
Your next step is to initialize the database where Kerberos keeps all information about
principals. Set up the database master key, which is used to protect the database from
accidental disclosure, in particular when it is backed up to a tape. The master key is
derived from a pass phrase and is stored in a file called the stash file. This is so you do
not need to enter the password every time the KDC is restarted. Make sure that you
choose a good pass phrase, such as a sentence from a book opened to a random page.
When you make tape backups of the Kerberos database (
/var/lib/kerberos/
krb5kdc/principal
), do not back up the stash file (which is in
/var/lib/
kerberos/krb5kdc/.k5.EXAMPLE.COM
). Otherwise, everyone able to read the
tape could also decrypt the database. Therefore, it is also a good idea to keep a copy of
the pass phrase in a safe or some other secure location, because you need it to restore
your database from backup tape after a crash.
To create the stash file and the database, run:
$> kdb5_util create -r EXAMPLE.COM -s
Initializing database '/var/lib/kerberos/krb5kdc/principal' for realm
'EXAMPLE.COM',
master key name 'K/M@EXAMPLE.COM'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
<= Type the master password.
Re-enter KDC database master key to verify: <= Type it again.
$>
To verify that it did anything, use the list command:
$>kadmin.local
kadmin> listprincs
K/M@EXAMPLE.COM
kadmin/admin@EXAMPLE.COM
kadmin/changepw@EXAMPLE.COM
krbtgt/EXAMPLE.COM@EXAMPLE.COM
Network Authentication with Kerberos 93