/etc/krb5/krb5.conf 配置檔中含有可讓 Kerberos 用戶端與 KDC 通訊的必要資訊。
在 KDC 機器、目錄伺服器機器,以及任何將使用 Kerberos 對目錄伺服器進行認證的用戶端機器上,編輯 /etc/krb5/krb5.conf 配置檔。
將您所看到的每個 "___default_realm___" 取代為 "EXAMPLE.COM"。
將您所看到的每個 "___master_kdc___" 取代為 "kdc.example.com"。
由於只會有一部 Kerberos 伺服器,因此請移除含有 "___slave_kdcs___" 的文字行。
將 "___domain_mapping___" 取代為 ".example.com = EXAMPLE.COM" (請注意 .example.com 開頭處的句點)。
更新的 /etc/krb5/krb5.conf 配置檔應如下列範例的內容所示。
#pragma ident "@(#)krb5.conf 1.2 99/07/20 SMI" # Copyright (c) 1999, by Sun Microsystems, Inc. # All rights reserved. # # krb5.conf template # In order to complete this configuration file # you will need to replace the __<name\>__ placeholders # with appropriate values for your network. # [libdefaults] default_realm = EXAMPLE.COM [realms] EXAMPLE.COM = { kdc = kdc.example.com admin_server = kdc.example.com } [domain_realm] .example.com = EXAMPLE.COM [logging] default = FILE:/var/krb5/kdc.log kdc = FILE:/var/krb5/kdc.log kdc_rotate = { # How often to rotate kdc.log. Logs will get rotated no more # often than the period, and less often if the KDC is not used # frequently. period = 1d # how many versions of kdc.log to keep around (kdc.log.0, kdc.log.1, ...) versions = 10 } [appdefaults] kinit = { renewable = true forwardable= true } gkadmin = { help_url = http://docs.sun.com:80/ab2/coll.384.1/SEAM/@AB2PageView/1195 } |