Sun Microsystems, Inc.
spacer |
black dot
  Previous   Contents   Next 
Chapter 8

Configuring SEAM (Tasks)

This chapter provides configuration procedures for KDC servers, network application servers, NFS servers, and SEAM clients. Many of these procedures require superuser access, so they should be used by system administrators or advanced users. Cross-realm configuration procedures and other topics related to KDC servers are also covered.

Configuring SEAM (Task Map)

Parts of the configuration process depend on other parts and must be done in a specific order. These procedures often establish services that are required to use SEAM. Other procedures are not dependent on any order, and can be done when appropriate. The following task map shows a suggested order for a SEAM installation.

Table 8-1 First Steps: SEAM Configuration Order



For Instructions

1. Plan for your SEAM installation

Lets you resolve configuration issues before you start the software configuration process. Planning ahead saves you time and other resources in the long run. Chapter 7, Planning for SEAM

2. (Optional) Install NTP

Configures the Network Time Protocol (NTP) software, or another clock synchronization protocol. In order for SEAM to work properly, the clocks on all systems in the realm must be synchronized. "Synchronizing Clocks between KDCs and SEAM Clients"

3. Configure the master KDC server

Configures and builds the master KDC server and database for a realm. "How to Configure a Master KDC"

4. (Optional) Configure a slave KDC server

Configures and builds a slave KDC server for a realm. "How to Configure a Slave KDC"

5. (Optional) Increase security on the KDC servers

Prevents security breaches on the KDC servers. "How to Restrict Access to KDC Servers"

6. (Optional) Configure swappable KDC servers

Makes the task of swapping the master KDC and a slave KDC easier. "How to Configure a Swappable Slave KDC"

Once the required steps have been completed, the following procedures can be used when required.

Table 8-2 Next Steps: Additional SEAM Tasks



For Instructions

Configure cross-realm authentication

Enables communications from one realm to another realm. "Configuring Cross-Realm Authentication"

Configure SEAM clients

Enables a client to use SEAM services. "Configuring SEAM Clients"

Configure SEAM NFS server

Enables a server to share a file system that requires Kerberos authentication. "Configuring SEAM NFS Servers"

Configuring KDC Servers

After you install the SEAM software, you must configure the KDC servers. Configuring a master KDC and at least one slave KDC provides the service that issues credentials. These credentials are the basis for SEAM, so the KDCs must be installed before you attempt other tasks.

The most significant difference between a master KDC and a slave KDC is that only the master KDC can handle database administration requests. For instance, changing a password or adding a new principal must be done on the master KDC. These changes can then be propagated to the slave KDCs. Both the slave KDC and master KDC generate credentials. This feature provides redundancy in case the master KDC cannot respond.

How to Configure a Master KDC

In this procedure, the following configuration parameters are used:

  • Realm name = EXAMPLE.COM

  • DNS domain name =

  • Master KDC =

  • Slave KDC =

  • admin principal = kws/admin

  • Online help URL = http://denver:8888/ab2/coll.384.1/SEAM/@AB2PageView/6956

    Note - Adjust the URL to point to the "SEAM Administration Tool" section, as described in "Online Help URL".

  1. Complete the prerequisites for configuring a master KDC.

    This procedure requires that DNS must be running. For specific naming instructions if this master is to be swappable, see "Swapping a Master KDC and a Slave KDC".

  2. Become superuser on the master KDC.

  3. Edit the Kerberos configuration file (krb5.conf).

    You need to change the realm names and the names of the servers. See the krb5.conf(4) man page for a full description of this file.

    kdc1 # cat /etc/krb5/krb5.conf
            default_realm = EXAMPLE.COM
                    EXAMPLE.COM = {
                    kdc =
                    kdc =
                    admin_server =
    # if the domain name and realm name are equivalent, 
    # this entry is not needed
            default = FILE:/var/krb5/kdc.log
            kdc = FILE:/var/krb5/kdc.log
        gkadmin = {
            help_url = http://denver:8888/ab2/coll.384.1/SEAM/@AB2PageView/6956

    In this example, the lines for domain_realm, kdc, admin_server, and all domain_realm entries were changed. In addition, the line that defines the help_url was edited.

  4. Edit the KDC configuration file (kdc.conf).

    You need to change the realm name. See the kdc.conf(4) man page for a full description of this file.

    kdc1 # cat /etc/krb5/kdc.conf
            kdc_ports = 88,750
            EXAMPLE.COM= {
                    profile = /etc/krb5/krb5.conf
                    database_name = /var/krb5/principal
                    admin_keytab = /etc/krb5/kadm5.keytab
                    acl_file = /etc/krb5/kadm5.acl
                    kadmind_port = 749
                    max_life = 8h 0m 0s
                    max_renewable_life = 7d 0h 0m 0s

    In this example, the realm name definition in the realms section was changed.

  5. Create the KDC database by using the kdb5_util command.

    The kdb5_util command creates the KDC database. Also, when used with the -s option, this command creates a stash file that is used to authenticate the KDC to itself before the kadmind and krb5kdc daemons are started.

    kdc1 # /usr/sbin/kdb5_util create -r EXAMPLE.COM -s
    Initializing database '/var/krb5/principal' for realm 'EXAMPLE.COM'
    master key name 'K/M@EXAMPLE.COM'
    You will be prompted for the database Master Password.
    It is important that you NOT FORGET this password.
    Enter KDC database master key: <type the key>
    Re-enter KDC database master key to verify: <type it again>

    The -r option followed by the realm name is not required if the realm name is equivalent to the domain name in the server's name space.

  6. Edit the Kerberos access control list file (kadm5.acl).

    Once populated, the /etc/krb5/kadm5.acl file should contain all principal names that are allowed to administer the KDC. The first entry that is added might look similar to the following:

    kws/admin@EXAMPLE.COM   *

    This entry gives the kws/admin principal in the EXAMPLE.COM realm the ability to modify principals or policies in the KDC. The default installation includes an asterisk (*) to match all admin principals. This default could be a security risk, so it is more secure to include a list of all of the admin principals. See the kadm5.acl(4) man page for more information.

  7. Start the kadmin.local command.

    The next sub-steps create principals that are used by SEAM.

    kdc1 # /usr/sbin/kadmin.local
    1. Add administration principals to the database.

      You can add as many admin principals as you need. You must add at least one admin principal to complete the KDC configuration process. For this example, a kws/admin principal is added. You can substitute an appropriate principal name instead of "kws."

      kadmin.local: addprinc kws/admin
      Enter password for principal kws/admin@EXAMPLE.COM: <type the password>
      Re-enter password for principal kws/admin@EXAMPLE.COM: <type it again>
      Principal "kws/admin@EXAMPLE.COM" created.
    2. Create a keytab file for the kadmind service.

      This command sequence creates a special keytab file with principal entries for kadmin and changepw. These principals are needed for the kadmind service. Note that when the principal instance is a host name, the FQDN must be entered in lowercase letters, regardless of the case of the domainname in the /etc/resolv.conf file.

      kadmin.local: ktadd -k /etc/krb5/kadm5.keytab kadmin/
      Entry for principal kadmin/ with kvno 3, encryption type DES-CBC-CRC
                added to keytab WRFILE:/etc/krb5/kadm5.keytab.
      kadmin.local: ktadd -k /etc/krb5/kadm5.keytab changepw/
      Entry for principal changepw/ with kvno 3, encryption type DES-CBC-CRC 
                added to keytab WRFILE:/etc/krb5/kadm5.keytab.
    3. Quit kadmin.local.

      You have added all of the required principals for the next steps.

      kadmin.local: quit
  8. Start the Kerberos daemons.

    kdc1 # /etc/init.d/kdc start
    kdc1 # /etc/init.d/kdc.master start
  9. Start kadmin.

    At this point, you can add principals by using the SEAM Administration Tool. To do so, you must log on with one of the admin principal names that you created earlier in this procedure. However, the following command-line example is shown for simplicity.

    kdc1 # /usr/sbin/kadmin -p kws/admin
    Enter password: <Type kws/admin password>
    1. Create the master KDC host principal.

      The host principal is used by Kerberized applications (such as klist and kprop) . Note that when the principal instance is a host name, the FQDN must be entered in lowercase letters, regardless of the case of the domainname in the /etc/resolv.conf file.

      kadmin: addprinc -randkey host/
      Principal "host/" created.
    2. (Optional)

      Create the master KDC root principal.

      This principal is used for authenticated NFS-mounting. So, the principal might not be necessary on a master KDC. Note that when the principal instance is a host name, the FQDN must be entered in lowercase letters, regardless of the case of the domainname in the /etc/resolv.conf file.

      kadmin: addprinc root/
      Enter password for principal root/ <type the password>
      Re-enter password for principal root/ <type it again>
      Principal "root/" created.
    3. Add the master KDC's host principal to the master KDC's keytab file.

      Adding the host principal to the keytab file allows this principal to be used automatically.

      kadmin: ktadd host/
      kadmin: Entry for principal host/ with
        kvno 3, encryption type DES-CBC-CRC added to keytab
    4. Quit kadmin.

      kadmin: quit
  10. Add an entry for each KDC into the propagation configuration file (kpropd.acl).

    See the kprop(1M) man page for a full description of this file.

    kdc1 # cat /etc/krb5/kpropd.acl
  11. (Optional)

    Synchronize the master KDCs clock by using NTP or another clock synchronization mechanism.

    It is not required to install and use the Network Time Protocol (NTP). However, every clock must be within the default time that is defined in the libdefaults section of the krb5.conf file in order for authentication to succeed. See "Synchronizing Clocks between KDCs and SEAM Clients" for information about NTP.

  Previous   Contents   Next