9. Kerberos

There are two different versions of the Kerberos client, version 4 from KTH and 5 from MIT. As Microsoft uses version 5, you should use the MIT version. Fedora includes the MIT one so you will be ok to use the stock standard one.

Packages krb5-lib and krb5-workstation are required. They are installed by default. If they are not, please get the latest version from yum.

The configuration file of Kerberos is /etc/krb5.conf. To connect to AD, the settings must match the domain configuration.

[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
default_realm = EXAMPLENET.ORG
dns_lookup_realm = false
dns_lookup_kdc = false
ticket_lifetime = 24h
forwardable = yes

[realms]
EXAMPLENET.ORG = {
kdc = dc1.examplenet.org:88
# admin_server = kerberos.example.com:749
default_domain = examplenet.org
}

[domain_realm]
.examplenet.org = EXAMPLENET.ORG
examplenet.org = EXAMPLENET.ORG

[kdc]
profile = /var/kerberos/krb5kdc/kdc.conf

[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}

Lines shown in bold are the ones you should pay attention to. Use uppercase as shown.

Before trying to connect to AD, the AD DNS should have a A record for the pptp server. To add the A record, on your Windows DNS server, click Start -> Administrative Tools -> DNS. The dnsmgmt window pops up. Click on the "+" of "Forward Lookup Zones". Right click on AD Domain name, in our test environment is EXAMPLENET.ORG, and choose "New Host (A)...". Put in the server Netbios name which is defined in smb.conf and the ip address. Then press the "Add Host" button.

When the DNS is ready, it is time to test Kerberos. Please note that the domain name must be in capital.

[root@pptp etc]# kinit -V skwok@EXAMPLENET.ORG
Password for skwok@EXAMPLENET.ORG: 
Authenticated to Kerberos v5 

To check the Kerberos tickets:

[root@pptp etc]# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: skwok@EXAMPLENET.ORG

Valid starting Expires Service principal
     09/03/05 14:43:47 09/04/05 00:43:04 krbtgt/EXAMPLENET.ORG@EXAMPLENET.ORG
   renew until 09/04/05 14:43:47

Kerberos 4 ticket cache: /tmp/tkt0
     klist: You have no tickets cached