Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 118 / 450

The above command adds the
pam_krb5
module to the existing PAM configuration
files and makes sure it is called in the right order. To make fine adjustments to the way
in which
pam_krb5
is used, edit the file
/etc/krb5.conf
and add default appli-
cations to
pam
. For details, refer to the manual page with
man 5 pam_krb5
.
The
pam_krb5
module was specifically not designed for network services that accept
Kerberos tickets as part of user authentication. This is an entirely different matter, which
is discussed below.
6.4.10 Configuring SSH for Kerberos
Authentication
OpenSSH supports Kerberos authentication in both protocol version 1 and 2. In ver-
sion 1, there are special protocol messages to transmit Kerberos tickets. Version 2 does
not use Kerberos directly anymore, but relies on GSSAPI, the General Security Services
API. This is a programming interface that is not specific to Kerberos—it was designed
to hide the peculiarities of the underlying authentication system, be it Kerberos, a public-
key authentication system like SPKM, or others. The GSSAPI library included supports
only Kerberos, however.
To use sshd with Kerberos authentication, edit
/etc/ssh/sshd_config
and set
the following options:
# These are for protocol version 1
#
# KerberosAuthentication yes
# KerberosTicketCleanup yes
# These are for version 2 - better to use this
GSSAPIAuthentication yes
GSSAPICleanupCredentials yes
Then restart your SSH daemon using
rcsshd restart
.
To use Kerberos authentication with protocol version 2, enable it on the client side as
well. Do this either in the systemwide configuration file
/etc/ssh/ssh_config
or on a per-user level by editing
~/.ssh/config
. In both cases, add the option
GSSAPIAuthentication yes
.
104 Security Guide