View source for Notes on Kerberos / LDAP authentication

This will be a scratch space for the beginning of new Kerberos & LDAP page.  Initially, this will be a bunch of random notes, hopefully coalesced into a document.

===Reference Documents===

The main reference by Danang : [http://www.bekatul.info/node/24 Building Powerful Central Authentication]


===Things that can use Kerberos / LDAP to authenticate===
These are the things that we would like to use our K&L auth:

* NFS4 authentication/security
* automount / autofs
* sudo
* ssh / kerberos key forwarding / ldap shared keys?
* Apache web page security
* Netgroups -- limiting logins to specific machines
* AFS -- andrew file system
* Email
* radius / 802.1x for wired and wireless networks
* Samba -- be able authenticate windows clients -- perhaps using pgina.
* Mac OS/X clients?

===First setup DNS===

Kerberos and to a lesser extent LDAP need to have proper DNS names.  If you are using an internal network (192.168.x.y), you will need to setup a DNS for your network.

The topic of DNS is very large.  I'm not going to cover it here.  I should point you to some external document.  

I've found that on RHEL5/CentOS5 you can use '''system-config-bind'''.  The help is good.  I just imported the /etc/hosts file as suggested.  This worked very well!

Also, one can use DNS service records to automatically find both the kerberos KDC and the ldap server.

===Setting up Kerberos===

yum -y install krb5-server

edit /etc/krb5.conf
edit /var/kerberos/krb5kdc/kdc.conf

/usr/kerberos/sbin/kdb5_util create -s  (can redirect input)

edit /var/kerberso/krb5kdc/kadm5.acl make it look like

 */admin@ECE.VT.EDU    *