Kerberos - Revision history

C256zhao: /* Configuring Kerberos */ fix link

2026-04-05T01:34:49Z

Configuring Kerberos: fix link

← Older revision		Revision as of 20:34, 4 April 2026
Line 62:		Line 62:
	<pre>/admin </pre>		<pre>/admin </pre>
	<p>Our primary admin principal will be <code>sysadmin/admin@WICS.UWATERLOO.CA</code>, so there is no need to add a separate <code>admin</code> principal to the ACL.</p></li>		<p>Our primary admin principal will be <code>sysadmin/admin@WICS.UWATERLOO.CA</code>, so there is no need to add a separate <code>admin</code> principal to the ACL.</p></li>
	<li><p>Let's configure Kerberos client-side in [https://git.uwaterloo.ca/wics/documentation/blob/master/krb5.conf <code>/etc/krb5.conf</code>]. Consulting with the CSC's config, [[www.rjsystems.nl/en/2100-d6-kerberos-master.php#rcfg\|our favoured setup guide]], and [http://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html the Kerberos krb5.conf manual], we'll mostly select default settings. Notable additions include</p>		<li><p>Let's configure Kerberos client-side in [https://git.uwaterloo.ca/wics/documentation/blob/master/krb5.conf <code>/etc/krb5.conf</code>]. Consulting with the CSC's config, [https://www.rjsystems.nl/en/2100-d6-kerberos-master.php#rcfg our favoured setup guide], and [http://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/krb5_conf.html the Kerberos krb5.conf manual], we'll mostly select default settings. Notable additions include</p>
	<pre>[libdefaults]		<pre>[libdefaults]
	allow_weak_crypto = false # default is currently false but hey		allow_weak_crypto = false # default is currently false but hey

S23adhik at 05:59, 14 June 2025

2025-06-14T05:59:57Z

@@ Line 316: / Line 316: @@
 * modify_principal -allow_tix [username]
 If you are seriously locking out an account, you may want to do some other things as well, including but not limited to changing the user's password (prevents password login) and changing the ownership and permissions on .ssh/authorized_keys* (prevents SSH key login). Don't do these things without a strong reason (but know how to do them when the time comes).
 = bofh's Kerberos5 cheat sheet, or "what does *that* error message mean, exactly?" =

N4chung: ceo pw reset

2024-07-06T08:41:49Z

ceo pw reset

← Older revision		Revision as of 03:41, 6 July 2024
Line 1:		Line 1:
			'''IF YOU ARE LOOKING FOR A PASSWORD RESET, PLEASE VISIT''' https://csclub.uwaterloo.ca/ceo/pwreset '''FOR A SELF-SERVICE PORTAL FOR PASSWORD RESETS! (If you experience any issues, please contact Syscom)'''

			---


	We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. <b>This realm is CASE-SENSITIVE.</b> KDCs run on [[Machine_List#auth1\|auth1]] (kdc1) and [[Machine_List#auth2\|auth2]] (kdc2).		We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. <b>This realm is CASE-SENSITIVE.</b> KDCs run on [[Machine_List#auth1\|auth1]] (kdc1) and [[Machine_List#auth2\|auth2]] (kdc2).

Merenber: /* raymo's guide to keytabs */

2023-10-21T20:15:46Z

raymo's guide to keytabs

← Older revision		Revision as of 15:15, 21 October 2023
Line 325:		Line 325:
	= raymo's guide to keytabs =		= raymo's guide to keytabs =

	Adapted from https://stackoverflow.com/a/55826172/9206488		Adapted from https://stackoverflow.com/a/55826172/9206488 and https://sfu.teamdynamix.com/TDClient/255/ITServices/KB/ArticleDet?ID=3932

	You can follow this guide to never need to <code>kinit</code> or enter your password for CEO again. Note that all caps is needed for the Kerberos realm, and replace <code><user></code> with your CSC username.		You can follow this guide to never need to <code>kinit</code> or enter your password for CEO again. Note that all caps is needed for the Kerberos realm, and replace <code><user></code> with your CSC username.
Line 344:		Line 344:

	kinit -kt ~/keytabs/$USER.keytab $USER@CSCLUB.UWATERLOO.CA		kinit -kt ~/keytabs/$USER.keytab $USER@CSCLUB.UWATERLOO.CA

			Alternatively, use k5start so that your tickets automatically get renewed in the background:

			KEYTAB_FILE=~/keytabs/$USER.keytab
			if command -v k5start >/dev/null && ! pgrep -u $USER k5start >/dev/null && [ -f $KEYTAB_FILE ]; then
			k5start -K 60 -H 70 -b -f $KEYTAB_FILE
			fi
			unset KEYTAB_FILE

	Tada! Now you'll automatically get a kerberos ticket on SSH/shell. You can test this by running		Tada! Now you'll automatically get a kerberos ticket on SSH/shell. You can test this by running

Merenber: /* raymo's guide to keytabs */

2023-10-19T13:35:45Z

raymo's guide to keytabs

← Older revision		Revision as of 08:35, 19 October 2023
Line 330:		Line 330:

	ktutil		ktutil
	addent -password -p <user>@CSCLUB.UWATERLOO.CA -k 1 -e ~~rc4~~-hmac		addent -password -p <user>@CSCLUB.UWATERLOO.CA -k 1 -e aes256-cts-hmac-sha1-96
	# enter password at the prompt		# enter password at the prompt
	wkt <user>.keytab		wkt <user>.keytab

R389li: Add new tutorial

2022-01-19T04:00:05Z

Add new tutorial

← Older revision		Revision as of 23:00, 18 January 2022
Line 322:		Line 322:

	Occasionally, the replication results in "ulog_replay failed (Cannot allocate memory), updates not registered". To correct this, run `kproplog -R` on auth1 and start the `kpropd` server again.		Occasionally, the replication results in "ulog_replay failed (Cannot allocate memory), updates not registered". To correct this, run `kproplog -R` on auth1 and start the `kpropd` server again.

			= raymo's guide to keytabs =

			Adapted from https://stackoverflow.com/a/55826172/9206488

			You can follow this guide to never need to <code>kinit</code> or enter your password for CEO again. Note that all caps is needed for the Kerberos realm, and replace <code><user></code> with your CSC username.

			ktutil
			addent -password -p <user>@CSCLUB.UWATERLOO.CA -k 1 -e rc4-hmac
			# enter password at the prompt
			wkt <user>.keytab
			quit

			Then move your keytab to a secure directory:

			mkdir -m700 ~/keytabs
			mv ~/$USER.keytab ~/keytabs/
			chmod 600 ~/keytabs/$USER.keytab

			Finally, add this line to the <b>TOP</b> of your <code>bashrc</code> (or before any command to disable it for non-interactive shells, unless you don't want <code>kinit</code> to be triggered when running remote commands:

			kinit -kt ~/keytabs/$USER.keytab $USER@CSCLUB.UWATERLOO.CA

			Tada! Now you'll automatically get a kerberos ticket on SSH/shell. You can test this by running

			ssh hfcs@csclub.uwaterloo.ca klist

			You should see a valid ticket from a second or two ago.

R389li: Bump headings and add case sensitivity note

2022-01-19T01:49:35Z

Bump headings and add case sensitivity note

← Older revision		Revision as of 20:49, 18 January 2022
Line 1:		Line 1:
	We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. KDCs run on [[Machine_List#auth1\|auth1]] (kdc1) and [[Machine_List#auth2\|auth2]] (kdc2).		We use [http://web.mit.edu/Kerberos/ MIT Kerberos 5] for authentication. Our kerberos realm is CSCLUB.UWATERLOO.CA. <b>This realm is CASE-SENSITIVE.</b> KDCs run on [[Machine_List#auth1\|auth1]] (kdc1) and [[Machine_List#auth2\|auth2]] (kdc2).

	[[File:kerberos.png\|frame\|Kerberos, the network authentication protocol]]		[[File:kerberos.png\|frame\|Kerberos, the network authentication protocol]]

	=== ehashman's guide to MIT Kerberos v5 on Debian ===		= ehashman's guide to MIT Kerberos v5 on Debian =

	==== Preparatory Reading ====		== Preparatory Reading ==

	# [http://web.mit.edu/kerberos/dialogue.html Kerberos: A Dialogue in Four Scenes] ('''''definitely''''' read this)		# [http://web.mit.edu/kerberos/dialogue.html Kerberos: A Dialogue in Four Scenes] ('''''definitely''''' read this)
Line 12:		Line 12:
	# [http://web.mit.edu/kerberos/krb5-latest/doc/admin/index.html The official Kerberos documentation]		# [http://web.mit.edu/kerberos/krb5-latest/doc/admin/index.html The official Kerberos documentation]

	==== Set up host records ====		== Set up host records ==

	<ul>		<ul>
Line 22:		Line 22:
	<p>You may have guessed that the third integer is the port the service runs on.</p></li></ul>		<p>You may have guessed that the third integer is the port the service runs on.</p></li></ul>

	==== Install packages ====		== Install packages ==

	<ul>		<ul>
Line 51:		Line 51:
	<li><p>You'll also note that the <code>krb5-kdc</code> service failed to start. This is okay. > This is because the realm, EXAMPLE.COM, or rather the database file for it (<code>/var/lib/krb5kdc/principal</code>), has not yet been created. – http://www.rjsystems.nl/en/2100-d6-kerberos-master.php</p></li></ul>		<li><p>You'll also note that the <code>krb5-kdc</code> service failed to start. This is okay. > This is because the realm, EXAMPLE.COM, or rather the database file for it (<code>/var/lib/krb5kdc/principal</code>), has not yet been created. – http://www.rjsystems.nl/en/2100-d6-kerberos-master.php</p></li></ul>

	==== Configuring Kerberos ====		== Configuring Kerberos ==

	<ul>		<ul>
Line 101:		Line 101:
	<pre># touch /var/log/{krb5,krb5kdc,kadmin}.log</pre></li></ul>		<pre># touch /var/log/{krb5,krb5kdc,kadmin}.log</pre></li></ul>

	==== Creating the Kerberos Realm ====		== Creating the Kerberos Realm ==

	<ul>		<ul>
Line 160:		Line 160:
	Principal "krbtgt/WICS.UWATERLOO.CA@WICS.UWATERLOO.CA" modified.</pre></li></ul>		Principal "krbtgt/WICS.UWATERLOO.CA@WICS.UWATERLOO.CA" modified.</pre></li></ul>

	==== Adding Principals ====		== Adding Principals ==

	<ul>		<ul>
Line 229:		Line 229:
	<li><p>Awesome! Now we're ready to configure Kerberos for clients.</p></li></ul>		<li><p>Awesome! Now we're ready to configure Kerberos for clients.</p></li></ul>

	==== Setting Up Client Machines with SSSD ====		== Setting Up Client Machines with SSSD ==

	<ul>		<ul>
Line 267:		Line 267:
	machine:~$ sudo -i</pre></li></ul>		machine:~$ sudo -i</pre></li></ul>

	==== Tools for Debugging SSSD ====		== Tools for Debugging SSSD ==

	<ul>		<ul>
Line 277:		Line 277:
	and then reboot (or restart sssd).		and then reboot (or restart sssd).

	=== Password Resets ===		= Password Resets =
	To change your own password you can run passwd on any of the club's machines.		To change your own password you can run passwd on any of the club's machines.

	==== Changing other user's passwords (new) ====		== Changing other user's passwords (new) ==
	The [[ceo]] utility now has the ability to reset members' passwords, and it also takes care of expiring it. Usage:		The [[ceo]] utility now has the ability to reset members' passwords, and it also takes care of expiring it. Usage:
	<pre>		<pre>
Line 286:		Line 286:
	</pre>		</pre>

	==== Changing other users' passwords (old) ====		== Changing other users' passwords (old) ==
	* <pre>ssh auth1</pre>		* <pre>ssh auth1</pre>
	* <pre>sudo kadmin.local</pre>		* <pre>sudo kadmin.local</pre>
Line 297:		Line 297:
	[http://web.archive.org/web/20120202205851/http://cryptnet.net/mirrors/docs/krb5api.html API Documentation.] While not even close to enough to let you do most things that you'd want to do with Kerberos (and also being somewhat woefully out-of-date, considering it's from 1996), it's at least a start.		[http://web.archive.org/web/20120202205851/http://cryptnet.net/mirrors/docs/krb5api.html API Documentation.] While not even close to enough to let you do most things that you'd want to do with Kerberos (and also being somewhat woefully out-of-date, considering it's from 1996), it's at least a start.

	=== Expiring Passwords ===		= Expiring Passwords =

	If you are on syscom, you can force a user to change their password by doing this:		If you are on syscom, you can force a user to change their password by doing this:
Line 304:		Line 304:
	* <pre>modify_principal +needchange [username]</pre>		* <pre>modify_principal +needchange [username]</pre>

	=== Suspending an Account ===		= Suspending an Account =

	If you are on syscom, you can prevent a user from logging with a Kerberos ticket by doing this:		If you are on syscom, you can prevent a user from logging with a Kerberos ticket by doing this:
Line 312:		Line 312:
	If you are seriously locking out an account, you may want to do some other things as well, including but not limited to changing the user's password (prevents password login) and changing the ownership and permissions on .ssh/authorized_keys* (prevents SSH key login). Don't do these things without a strong reason (but know how to do them when the time comes).		If you are seriously locking out an account, you may want to do some other things as well, including but not limited to changing the user's password (prevents password login) and changing the ownership and permissions on .ssh/authorized_keys* (prevents SSH key login). Don't do these things without a strong reason (but know how to do them when the time comes).

	=== bofh's Kerberos5 cheat sheet, or "what does that error message mean, exactly?" ===		= bofh's Kerberos5 cheat sheet, or "what does that error message mean, exactly?" =

	* If GSSAPI complains about "Wrong Principal in Request", make sure there's no clockskew on the machine trying to get the service ticket and the machine running the service that you are trying to get a GSS token to. This will cause this error for some insane reason, despite there being ANOTHER message for clockskew that specifically says "your clocks are off" - it just never seems to be used in the source code anywhere (as of MIT-KRB5 1.9, at least).		* If GSSAPI complains about "Wrong Principal in Request", make sure there's no clockskew on the machine trying to get the service ticket and the machine running the service that you are trying to get a GSS token to. This will cause this error for some insane reason, despite there being ANOTHER message for clockskew that specifically says "your clocks are off" - it just never seems to be used in the source code anywhere (as of MIT-KRB5 1.9, at least).
	* There are some "generic" errors that are hard to debug. A few possible causes: unreadable krb5.keytab, reverse resolution of a host does not match its principal.		* There are some "generic" errors that are hard to debug. A few possible causes: unreadable krb5.keytab, reverse resolution of a host does not match its principal.

	=== Replication ===		= Replication =

	auth1 replicates to auth2 using kpropd. This requires additional setup that needs to be documented here.		auth1 replicates to auth2 using kpropd. This requires additional setup that needs to be documented here.

Merenber: /* Password Resets */

2021-11-15T00:56:45Z

Password Resets

← Older revision		Revision as of 19:56, 14 November 2021
Line 280:		Line 280:
	To change your own password you can run passwd on any of the club's machines.		To change your own password you can run passwd on any of the club's machines.

	Changing other ~~users~~' passwords		==== Changing other user's passwords (new) ====
			The [[ceo]] utility now has the ability to reset members' passwords, and it also takes care of expiring it. Usage:
			<pre>
			ceo members pwreset <username>
			</pre>

			==== Changing other users' passwords (old) ====
	* <pre>ssh auth1</pre>		* <pre>ssh auth1</pre>
	* <pre>sudo kadmin.local</pre>		* <pre>sudo kadmin.local</pre>
	* <pre>cpw username</pre>		* <pre>cpw username</pre>
	* Enter new password and confirm		* Enter new password and confirm
			* <pre>modify_principal +needchange username</pre>

	[[Category:Software]]		[[Category:Software]]

R389li: /* Password Resets */ Same thing with resets

2021-05-20T02:18:51Z

Password Resets: Same thing with resets

← Older revision		Revision as of 21:18, 19 May 2021
Line 281:		Line 281:

	Changing other users' passwords		Changing other users' passwords
	* ssh auth1		* <pre>ssh auth1</pre>
	* sudo kadmin.local		* <pre>sudo kadmin.local</pre>
	* cpw username		* <pre>cpw username</pre>
	* Enter new password and confirm		* Enter new password and confirm

R389li: Put the less dangerous info in pre tags

2021-05-20T02:18:06Z

Put the less dangerous info in pre tags

← Older revision		Revision as of 21:18, 19 May 2021
Line 293:		Line 293:

	If you are on syscom, you can force a user to change their password by doing this:		If you are on syscom, you can force a user to change their password by doing this:
	* ssh auth1		* <pre>ssh auth1</pre>
	* sudo kadmin.local		* <pre>sudo kadmin.local</pre>
	* modify_principal +needchange [username]		* <pre>modify_principal +needchange [username]</pre>

	=== Suspending an Account ===		=== Suspending an Account ===