test

Sun Enterprise Authentication Mechanism Guide

How to Configure a Slave KDC

In this procedure, a new slave KDC named kdc3 is configured. To provide a complete example, it is assumed that you did not use the preconfiguration procedure when installing the software or had not defined kdc3 as a slave when running the preconfiguration procedure. If you used the procedure and identified kdc3 as a slave, then many of the files included in this procedure do not need to be edited, but you should review the contents of the files.

This procedure uses the following configuration parameters:

  1. Prerequisites for configuring a slave KDC.

    This procedure requires that the master KDC has been configured and that the SEAM slave KDC software has been installed on kdc3. See "Swapping Master and Slave KDCs" for specific instructions if this slave is to be swappable.

  2. On the master KDC: Become superuser.

  3. On the master KDC: Start kadmin.

    You must log on with one of the admin principal names that you created when configuring the master KDC.


    kdc1 # /usr/krb5/sbin/kadmin -p kws/admin
Enter password: <Enter kws/admin password>
kadmin:

    1. On the master KDC: Add slave host principals to the database, if not already done, using kadmin.

      In order for the slave to function, it must have a host principal.


      kadmin: addprinc -randkey host/kdc3.acme.com
Principal "host/kdc3@ACME.COM" created.
kadmin:

    2. Optional: On the master KDC, create the slave KDC root principal using kadmin.

      This principal is only needed if the slave will be NFS-mounting an authenticated file system.


      kadmin: addprinc root/kdc3.acme.com
Enter password for principal root/kdc3.acme.com@ACME.COM: <type the password>
Re-enter password for principal root/kdc3.acme.com@ACME.COM: <type it again>
Principal "root/kdc3.acme.com@ACME.COM" created.
kadmin:

    3. Quit kadmin 


      kadmin: quit

  4. On the master KDC: Edit the Kerberos configuration file (krb5.conf).

    You need to add an entry for each slave. See the krb5.conf(4) man page for a full description of this file. If you defined kdc3 as a slave server when running the preconfiguration procedure, verify the contents of the file instead of editing it.


    kdc1 # cat /etc/krb5/krb5.conf
[libdefaults]
        default_realm = ACME.COM

[realms]
                ACME.COM = {
                kdc = kdc1.acme.com
                kdc = kdc2.acme.com
                kdc = kdc3.acme.com
                admin_server = kdc1.acme.com
        }

[domain_realm]
        .acme.com = ACME.COM
#
# if the domain name and realm name are equivalent, 
# this entry is not needed
#        
[logging]
        default = FILE:/var/krb5/kdc.log
        kdc = FILE:/var/krb5/kdc.log

[appdefaults]
    gkadmin = {
        help_url = http://denver:8888/ab2/coll.384.1/SEAM/@AB2PageView/6956

  5. On the master KDC: Add an entry for each slave KDC into the database propagation configuration file (kpropd.acl).

    See the kprop(1M) man page for a full description of this file. If you defined kdc3 as a slave server when running the preconfiguration procedure, verify the contents of the file instead of editing it.


    kdc1 # cat /etc/krb5/kpropd.acl
host/kdc1.acme.com@ACME.COM
host/kdc2.acme.com@ACME.COM
host/kdc3.acme.com@ACME.COM

  6. On all Slaves: Copy the KDC administration files from the master KDC server.

    This step needs to be followed on all slave KDCs, since the master KDC server has updated information that each KDC server needs. If you defined kdc3 as a slave server when running the preconfiguration procedure, verify the contents of the files instead of copying them. You can use ftp or a similar transfer mechanism to grab copies of the following files from the master:

    • /etc/krb5/krb5.conf

    • /etc/krb5/kdc.conf

    • /etc/krb5/kpropd.acl

  7. On the new slave: Add the slave's host principal to the slave's keytab file using kadmin.

    You must log on with one of the admin principal names that you created when configuring the master KDC. This entry will allow kprop and other Kerberized applications to function.


    kdc3 # /usr/krb5/sbin/kadmin -p kws/admin
Enter password: <Enter kws/admin password>
kadmin: ktadd host/kdc3.acme.com
kadmin: Entry for principal host/kdc3.acme.com with
  kvno 3, encryption type DES-CBC-CRC added to keytab
  WRFILE:/etc/krb5/krb5.keytab
kadmin: quit

  8. On the master KDC: Add slave KDC names to the cron job, which automatically runs the backups, by running crontab -e.

    Add the name of each slave KDC server at the end of the kprop_script line. If you defined kdc3 as a slave server when running the preconfiguration procedure, verify the contents of the file instead of editing it.


    10 3 * * * /usr/krb5/lib/kprop_script kdc2.acme.com kdc3.acme.com

    You might also want to change the time of the backups. This configuration starts the backup process every day at 3:10 AM.

  9. On the master KDC: Back up and propagate the database using kprop_script.

    If a backup copy of the database is already available, it is not necessary to complete another backup. See "How to Manually Propagate the Kerberos Database to the Slave KDCs" for further instructions.


    kdc1 # /usr/krb5/lib/kprop_script kdc3.acme.com
Database propagation to kdc3.acme.com: SUCCEEDED

  10. On the new slave: Create a stash file using kdb5_util.


    kdc3 # /usr/krb5/sbin/kdb5_util stash
kdb5_util: Cannot find/read stored master key while reading master key
kdb5_util: Warning: proceeding without master key

Enter KDC database master key: <type the key>

  11. On the new slave: Start the KDC daemon (krb5kdc).


    kdc3 # /etc/init.d/kdc start

  12. Optional: On the new slave, synchronize the master KDCs clock using NTP or another clock synchronization mechanism.

    It is not necessary to install and use NTP, but every clock must be within the default time defined in the libdefaults section of the krb5.conf file in order for authentication to succeed. See "Synchronizing Clocks between KDCs and SEAM Clients" for information about NTP.