Kerberos Components

Similar to the MIT distribution of the Kerberos V5 product, the Solaris Kerberos service includes the following:

• Key Distribution Center (KDC):

  • Kerberos database administration daemon – kadmind.

  • Kerberos ticket processing daemon – krb5kdc.

  • Database administration programs – kadmin (master only), kadmin.local and kdb5_util.

  • Database propagation software – kprop (slave only) and kpropd.

• User programs for managing credentials – kinit, klist, and kdestroy.

• User program for changing your Kerberos password – kpasswd.

• Remote applications – ftp, rcp, rdist, rlogin, rsh, ssh, and telnet.

• Remote application daemons – ftpd, rlogind, rshd, sshd, and telnetd.

• Keytab administration utility – ktutil.

• The Generic Security Service Application Programming Interface (GSS-API) – Enables applications to use multiple security mechanisms without requiring you to recompile the application every time a new mechanism is added. The GSS-API uses standard interfaces that allow applications to be portable to many operating systems. GSS-API provides applications with the ability to include the integrity and privacy security services, as well as authentication. Both ftp and ssh use the GSS-API.

• The RPCSEC_GSS Application Programming Interface (API) – Enables NFS services to use Kerberos authentication. RPCSEC_GSS is a security flavor that provides security services that are independent of the mechanisms being used. RPCSEC_GSS sits on top of the GSS-API layer. Any pluggable GSS_API-based security mechanism can be used by applications that use RPCSEC_GSS.

In addition, the Solaris Kerberos service includes the following:

• Graphical Kerberos Administration Tool (gkadmin) – Enables you to administer the principals and principal policies. This Java^TM technology-based GUI is an alternative to the kadmin command.

• A Kerberos V5 service module for PAM – Provides authentication, account management, session management and password management for the Kerberos service. The module can be used to make Kerberos authentication transparent to the user.

• Kernel modules – Provides kernel-based implementations of the kerberos service for use by the NFS service, which greatly improves performance.