用户添加完成以后进行本地测试。 hawk# kinit cnhawk/
[email protected] cnhawk/
[email protected]'s PassWord: hawk# klist -f Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued EXPires Flags Principal Jun 7 17:12:21 Jun 8 03:12:21 I krBTgt/
[email protected] 我们可以看到本地已经拿到票据了。 下面添加测试机B的域名地址信息，就是允许测试机B能登陆测试机A。 特别注意Kerberos必须使用域名来访问机器。如果使用IP添加主机会出现一些意外的问题。 test1# kadmin -l kadmin> add --random-key host/test1.the9.com //说明添加的是主机不是用户 Max ticket life [1 day]: Max renewable life [1 week]: Principal expiration time [never]: Password expiration time [never]: Attributes []: kadmin> ext host/test1.the9.com kadmin> ext --keytab=/tmp/the9.keytab host/test1.the9.com 这样完成以后就好了，基本配置已经结束了，可以使用。 调试 我们开始使用Kerberos的认证部署网络服务,注意Kerberos通过修改用户主目录下的.klogin和.k5login文件，将你允许登陆的用户Principal添加在文件里就好了。 test1# cat .k5login # $FreeBSD: src/etc/root/dot.k5login,v 1.1 2003/04/30 20:58:49 markm Exp $ # # user1/
[email protected] # user2/
[email protected] cnhawk/
[email protected] 这样就可以了 使用Kerberos认证的telnet 修改/etc/inetd.conf 添加 telnet stream tcp nowait root /usr/libexec/telnetd telnetd -a user 然后开启 test2# inetd 然后从test1登陆test2 test1# kinit cnhawk/test1.the9.com //先取得票据 cnhawk/
[email protected]'s Password: test1# klist –f //看看是不是取得 Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued Expires Flags Principal Jun 11 16:21:36 Jun 12 02:21:36 I krbtgt/
[email protected] //可以了 test1# telnet -a -l the9 192.168.0.3 //开始登陆 Trying 192.168.0.3... Connected to test2.the9.com. Escape character is '^]'. [ Trying mutual KERBEROS5 (host/
[email protected])... ] [ Kerberos V5 accepts you as `` cnhawk/
[email protected]'' ] FreeBSD/i386 (test2.the9.com) (ttyp1) //登陆欢迎词 %id uid=1001(the9) gid=0(wheel) groups=0(wheel) % //好了成功了 使用Kerberos认证的ssh 修改测试A，B，C的sshd 配置文件。 # Kerberos options KerberosAuthentication yes KerberosOrLocalPasswd yes 然后重启sshd Test2#kill –HUP 80 开始从test1登陆到test2，因为只有ssh1支持Kerberos，所以使用ssh1连接同时开启debug信息。 test1# ssh -1v
[email protected] OpenSSH_3.6.1p1 FreeBSD-20030924, SSH protocols 1.5/2.0, OpenSSL 0x0090703f debug1: Reading configuration data /etc/ssh/ssh_config debug1: Rhosts Authentication disabled, originating port will not be trusted. debug1: Connecting to test2.the9.com [192.168.0.3] port 22. debug1: Connection established. debug1: identity file /root/.ssh/identity type -1 debug1: Remote protocol version 1.99, remote software version OpenSSH_3.5p1 FreeBSD-20030924 debug1: match: OpenSSH_3.5p1 FreeBSD-20030924 pat OpenSSH* debug1: Local version string SSH-1.5-OpenSSH_3.6.1p1 FreeBSD-20030924 debug1: Waiting for server public key. debug1: Received server public key (768 bits) and host key (1024 bits). debug1: Host 'test2.the9.com' is known and matches the RSA1 host key. debug1: Found key in /root/.ssh/known_hosts:3 debug1: Encryption type: 3des debug1: Sent encrypted session key. debug1: Installing crc compensation attack detector. debug1: Received encrypted confirmation. debug1: Trying Kerberos v5 authentication. debug1: Kerberos v5 authentication accepted. debug1: Requesting pty. debug1: Requesting shell. debug1: Entering interactive session. Last login: Fri Jun 11 16:31:14 2004 from test1.the9.com Copyright (c) 1980, 1983, 1986, 1988, 1990, 1991, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD 4.9-RELEASE (GENERIC) #0: Mon Oct 27 17:51:09 GMT 2003 FreeBSD/i386 (test2.the9.com) (ttyp1) //登陆欢迎词 %id uid=1001(the9) gid=0(wheel) groups=0(wheel) % //好了成功了 测试已经完成了。可以使用Kerberos了。 FTP 服务 %kinit cnhawk/test1.the9.com Cnhawk/test1.the9.com @THE9.COM's Password: %klist -f Credentials cache: FILE:/tmp/krb5cc_1001 Principal: cnhawk/
[email protected] Issued Expires Flags Principal Jun 11 18:49:56 Jun 12 04:49:56 I krbtgt/
[email protected] %/usr/local/bin/ftp -v hawk.the9.com Connected to hawk.the9.com. 220 hawk.the9.com FTP server (Version 5.60) ready. 334 Using authentication type GSSAPI; ADAT must follow GSSAPI accepted as authentication type GSSAPI authentication sUCceeded Name (hawk.the9.com:cnhawk): 232 GSSAPI user
[email protected] is authorized as cnhawk Remote system type is UNIX. Using binary mode to transfer files. ftp> 好了FTP也可以接受登陆
总结 Kerberos使用中需要注意一些地方，例如，时间一定要保证同步，因为Kerberos靠时间戳来保持同步，时间允许的飘溢量非常小。所以必须保证时间的准确。 cnhawk# kinit cnhawk/
[email protected] cnhawk/
[email protected]'s Password: kinit: krb5_get_init_creds: time skew (314) larger than max (300) cnhawk# ntpdate time.the9.com 7 Jun 16:59:49 ntpdate[623]: step time server 61.129.93.5 offset 211.348035 sec cnhawk# kinit cnhawk/test1.the9.com @THE9.COM cnhawk/
[email protected]'s Password: 而且很多时候在登陆前要查看票据是不是过期了。 hawk# klist Credentials cache: FILE:/tmp/krb5cc_0 Principal: cnhawk/
[email protected] Issued Expires Principal Jun 7 17:19:25 >>>Expired<<< krbtgt/
[email protected] Jun 7 17:20:23 >>>Expired<<< host/
[email protected] 同时要注意认证时候不只是认证用户信息，还有主机信息，要保证这两个信息都在KDC中心数据库上存储。这样才能保证用户取得票据以后能顺利登陆服务器。 Kerberos系统认证过程示意图
[1] [2] 下一页
（出处：http://www.sheup.com）
上一页 [1] [2]