Creating a Kerberos Realm (CLI)

Use the following procedure to create a Kerberos realm, set the KDC(s), and select strong or weak encryption types. Descriptions of each property are located in Kerberos Service Properties and Kerberos Properties and Logs.

Before You Begin

Ensure that you have configured the NTP service.

1. Go to configuration services kerberos and enter show.

   hostname:configuration services kerberos> show
   Properties:
                        <status> = disabled
               allow_weak_crypto = false

2. To enable the Kerberos service, enter enable and then enter commit.
3. To allow support for weak encryption types, such as DES and Exportable ArcFour with HMAC/md5, enter set allow_weak_crypto=true and then enter commit.

   The default does not support weak encryption types.

4. To create a realm, enter create and the realm name, and then enter commit.

   For familiarity, the realm name can be the same as your DNS domain name, except that the realm name is in uppercase.

   hostname:configuration services kerberos> create TEST.NET
   hostname:configuration services kerberos TEST.NET (uncommitted)> commit

5. Enter done.
6. To view all realms, enter list.

   hostname:configuration services kerberos> list
   REALM               KDC
   TEST.NET

7. Select the realm.

   hostname:configuration services kerberos> select TEST.NET
   hostname:configuration services kerberos TEST.NET>

8. To configure the KDC server(s), enter set kdcs= and the KDC administrative server host name. If you have additional KDCs, add them to the same line and separate them by commas. Then enter commit.

   If your Kerberos configuration includes DNS support for KDC lookup, do not perform this step.

   hostname:configuration services kerberos TEST.NET> set kdcs=kdc1.us.oracle.com,kdc2.us.oracle.com
                  kdcs = kdc1.us.oracle.com,kdc2.us.oracle.com (uncommitted)
   hostname:configuration services kerberos TEST.NET> commit

Next Steps

Choose one of the following options:

• Importing Kerberos Keys (CLI)

• Creating Kerberos Principals and Keys (CLI)