安装kerberos服务

来源：互联网发布：预算软件多少钱编辑：程序博客网时间：2024/06/05 16:11

a. 下载kerberos：http://web.mit.edu/kerberos/dist/
b. 解压编译：
  cd /home/cxz/krb5-1.11.3/src
  ./configure --prefix=/home/cxz/kerberos5
  make && make install
c. 设置环境变量
  export KRB5_CONFIG=/home/cxz/kerberos5/etc/krb5.conf
  export KRB5_KDC_PROFILE=/home/cxz/kerberos5/var/krb5kdc/kdc.conf
d. 配置krb5.conf

[libdefaults]default_realm = KERBEROS.ROCKdns_lookup_realm = falsedns_lookup_kdc = falseticket_lifetime = 24hforwardable = yesdefault_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5permitted_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5renew_lifetime = 7d[realms]KERBEROS.ROCK = {kdc = rock-kdc.dscc:50088admin_server = rock-kdc.dscc:50749kpasswd_server = rock-kdc.dscc:50464default_domain = .kerberos.rocksupported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal}[domain_realm].rock-nn.dscc = KERBEROS.ROCKrock-nn.dscc = KERBEROS.ROCK[kdc]    profile=/home/cxz/kerberos5/var/krb5kdc/kdc.conf

e. 配置kdc.conf

[kdcdefaults]v4_mode = nopreauthkdc_ports = 50750,50088kdc_tcp_ports = 50088supported_enctypes = des3-hmac-sha1:normal des-cbc-crc:normal[realms]KERBEROS.ROCK = {database_name = /home/cxz/kerberos5/var/krb5kdc/principaladmin_keytab = /home/cxz/kerberos5/var/krb5kdc/kadm5.keytabacl_file = /home/cxz/kerberos5/var/krb5kdc/kadm5.aclkey_stash_file = /home/cxz/kerberos5/var/krb5kdc/.k5.KERBEROS.ROCKkdc_ports = 50750,50088max_life = 10h 0m 0smax_renewable_life = 7d 0h 0m 0skpasswd_port = 50464supported_enctypes = supported_enctypes = des3-hmac-sha1 des-cbc-crc}[logging]    kdc = FILE:/home/cxz/log/kerberos5/krb5kdc.log    admin_server = FILE:/home/cxz/log/kerberos5/kadmin.log    default = FILE:/home/cxz/log/kerberos5/krb5lib.log

f. 创建KDC数据库
  kdb5_util create -r KERBEROS.ROCK -s
  注：可能会在loading random data中等待很长时间，因为/dev/random的随机数据产生的很少，可以适当的让网卡传输数据，这样有助于产生随机数据，具体原因可以看看/dev/random的原理
  要求输入database master的密码，然后会在../var/krb5kdc/下产生几个与principal相关的文件
g. 配置ACL文件
  echo '*/admin@KERBEROS.ROCK *' > ../var/krb5kdc/kadm5.acl
h. 为kerberos数据库添加管理员
  ../sbin/kadmin.local
  kadmin.local: addprinc admin/admin@KERBEROS.ROCK
i. 启动服务
  ../sbin/krb5kdc
  ../sbin/kadmind