用戶添加完成以後進行本地測試。 hawk# kinit cnhawk/
[email protected] cnhawk/
[email protected]'s PassWord: hawk# klist -f Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued EXPires Flags Principal Jun 7 17:12:21 Jun 8 03:12:21 I krBTgt/
[email protected] 我們可以看到本地已經拿到票據了。 下面添加測試機B的域名地址信息，就是允許測試機B能登陸測試機A。 特別注意Kerberos必須使用域名來訪問機器。如果使用IP添加主機會出現一些意外的問題。 test1# kadmin -l kadmin> add --random-key host/test1.the9.com //說明添加的是主機不是用戶 Max ticket life [1 day]: Max renewable life [1 week]: Principal expiration time [never]: Password expiration time [never]: Attributes []: kadmin> ext host/test1.the9.com kadmin> ext --keytab=/tmp/the9.keytab host/test1.the9.com 這樣完成以後就好了，基本配置已經結束了，可以使用。 調試 我們開始使用Kerberos的認證部署網絡服務,注意Kerberos通過修改用戶主目錄下的.klogin和.k5login文件，將你允許登陸的用戶Principal添加在文件裡就好了。 test1# cat .k5login # $FreeBSD: src/etc/root/dot.k5login,v 1.1 2003/04/30 20:58:49 markm Exp $ # # user1/
[email protected] # user2/
[email protected] cnhawk/
[email protected] 這樣就可以了 使用Kerberos認證的telnet 修改/etc/inetd.conf 添加 telnet stream tcp nowait root /usr/libexec/telnetd telnetd -a user 然後開啟 test2# inetd 然後從test1登陸test2 test1# kinit cnhawk/test1.the9.com //先取得票據 cnhawk/
[email protected]'s Password: test1# klist –f //看看是不是取得 Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued Expires Flags Principal Jun 11 16:21:36 Jun 12 02:21:36 I krbtgt/
[email protected] //可以了 test1# telnet -a -l the9 192.168.0.3 //開始登陸 Trying 192.168.0.3... Connected to test2.the9.com. Escape character is '^]'. [ Trying mutual KERBEROS5 (host/
[email protected])... ] [ Kerberos V5 accepts you as `` cnhawk/
[email protected]'' ] FreeBSD/i386 (test2.the9.com) (ttyp1) //登陸歡迎詞 %id uid=1001(the9) gid=0(wheel) groups=0(wheel) % //好了成功了 使用Kerberos認證的ssh 修改測試A，B，C的sshd 配置文件。 # Kerberos options KerberosAuthentication yes KerberosOrLocalPasswd yes 然後重啟sshd Test2#kill –HUP 80 開始從test1登陸到test2，因為只有ssh1支持Kerberos，所以使用ssh1連接同時開啟debug信息。 test1# ssh -1v
[email protected] OpenSSH_3.6.1p1 FreeBSD-20030924, SSH protocols 1.5/2.0, OpenSSL 0x0090703f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: Connecting to test2.the9.com [192.168.0.3] port 22. debug1: Connection established. debug1: identity file /root/.ssh/identity type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_3.5p1 FreeBSD-20030924 debug1: match: OpenSSH_3.5p1 FreeBSD-20030924 pat OpenSSH* debug1: Local version string SSH-1.5-OpenSSH_3.6.1p1 FreeBSD-20030924 debug1: Waiting for server public key. debug1: Received server public key (768 bits) and host key (1024 bits). debug1: Host 'test2.the9.com' is known and matches the RSA1 host key. debug1: Found key in /root/.ssh/known_hosts:3 debug1: Encryption type: 3des debug1: Sent encrypted session key. debug1: Installing crc compensation attack detector. debug1: Received encrypted confirmation. debug1: Trying Kerberos v5 authentication. debug1: Kerberos v5 authentication accepted. debug1: Requesting pty. debug1: Requesting shell. debug1: Entering interactive session. Last login: Fri Jun 11 16:31:14 2004 from test1.the9.com Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.9-RELEASE (GENERIC) #0: Mon Oct 27 17:51:09 GMT 2003 FreeBSD/i386 (test2.the9.com) (ttyp1) //登陸歡迎詞 %id uid=1001(the9) gid=0(wheel) groups=0(wheel) % //好了成功了 測試已經完成了。可以使用Kerberos了。 FTP 服務 %kinit cnhawk/test1.the9.com Cnhawk/test1.the9.com @THE9.COM's Password: %klist -f Credentials cache: FILE:/tmp/krb5cc_1001 Principal: cnhawk/
[email protected] Issued Expires Flags Principal Jun 11 18:49:56 Jun 12 04:49:56 I krbtgt/
[email protected] %/usr/local/bin/ftp -v hawk.the9.com Connected to hawk.the9.com. 220 hawk.the9.com FTP server (Version 5.60) ready. 334 Using authentication type GSSAPI; ADAT must follow GSSAPI accepted as authentication type GSSAPI authentication sUCceeded Name (hawk.the9.com:cnhawk): 232 GSSAPI user
[email protected] is authorized as cnhawk Remote system type is UNIX. Using binary mode to transfer files. ftp> 好了FTP也可以接受登陸
總結 Kerberos使用中需要注意一些地方，例如，時間一定要保證同步，因為Kerberos靠時間戳來保持同步，時間允許的飄溢量非常小。所以必須保證時間的准確。 cnhawk# kinit cnhawk/
[email protected] cnhawk/
[email protected]'s Password: kinit: krb5_get_init_creds: time skew (314) larger than max (300) cnhawk# ntpdate time.the9.com 7 Jun 16:59:49 ntpdate[623]: step time server 61.129.93.5 offset 211.348035 sec cnhawk# kinit cnhawk/test1.the9.com @THE9.COM cnhawk/
[email protected]'s Password: 而且很多時候在登陸前要查看票據是不是過期了。 hawk# klist Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued Expires Principal Jun 7 17:19:25 >>>Expired<<< krbtgt/
[email protected] Jun 7 17:20:23 >>>Expired<<< host/
[email protected] 同時要注意認證時候不只是認證用戶信息，還有主機信息，要保證這兩個信息都在KDC中心數據庫上存儲。這樣才能保證用戶取得票據以後能順利登陸服務器。 Kerberos系統認證過程示意圖
