Current File : //usr/share/doc/libkrb5-3/README.Debian
MIT Kerberos for Debian
Kerberos Package Roadmap
Most systems using Kerberos should install at least krb5-user, which
contains the basic kinit, klist, and kdestroy binaries to manage user
Kerberos credentials, as well as other basic utilities. In order to
use Kerberos passwords for local authentication and obtain Kerberos
credentials automatically when logging in, install and configure
libpam-krb5.
To log on to other systems using Kerberos authentication, most sites
will find a Kerberos-enabled sshd the most convenient. See the ssh documentation for information on enabling GSSAPI
authentication (which is how Kerberos authentication is done over the
ssh protocol).
Some sites will instead prefer to use Kerberos-enabled versions of the
standard Unix login utilities (rsh, rlogin, telnet, ftp). The clients
are available in the krb5-clients package and the servers are available
in the krb5-rsh-server, krb5-telnetd, and krb5-ftpd packages. Please
note that the telnetd and ftpd included in those packages do not use PAM
(this is not supported upstream and may or may not ever be supported);
they only support Kerberos and will not run other PAM modules. For more
flexible login support, use Kerberos-enabled ssh instead.
The krb5-kdc and krb5-admin-server packages are only needed and used on
Kerberos KDCs, only one set of which is needed for each independently
managed Kerberos realm. For more information on how to set up a
Kerberos realm using the Debian packages, install krb5-kdc and then read
/usr/share/doc/krb5-kdc/README.KDC.
Documentation
All Kerberos binaries and most configuration files have manual pages.
For the info pages and reference manual, install krb5-doc. If you need
additional information, see <http://web.mit.edu/kerberos/>.
Debian-Specific Information
MIT distributes the Kerberos sources as a tarball and a PGP signature,
tarred up into a single .tar file. In order to create the Debian
original upstream source (.orig.tar.gz), I untarred the parent tarball,
checked the PGP signature, and used the contained tarball as the
upstream source. Since krb5-1.7, a separate "krb5-appl" tarball contains
the kerberized client utilities (rlogin, rsh, etc.) with a similar
nested-tarball scheme.
MIT Kerberos is built against the libcom_err and libss provided by the
e2fsprogs source package. It is built against the version of db
included in src/util/db2 in the Kerberos sources. In the future,
krb5-kdc may change to use db4, although doing so will make upgrades
somewhat difficult.
None of the sample clients and servers are installed. As a general
rule, these are not useful unless you are doing development, and in such
a situation you probably want to build them from source.
Note that by default, no unencrypted services are enabled. That means,
if you are using krb5-clients and the supporting server packages, you
need to use rlogin -x to connect to a Debian system and if you use rsh
or rcp without the -x option you will get an error that encryption is
required. In this day and age, not encrypting network traffic is a good
way to get attacked.
If installed, krb5-rsh-server by default allows any user in the local
realm whose principal matches a local account name to log on to that
account. See the klogind and kshd man pages. If this isn't the
behavior you want, one option is to create an empty .k5login file in the
home directory of every user and then add principals to those files
where it's appropriate. One way to do this for all newly created users
is:
touch /etc/skel/.k5login
This will cause an empty .k5login file to be put in the home directory
of newly created users.
-- Sam Hartman <hartmans@debian.org>, Wed, 2 Nov 2016 23:18:47 -0400
Mini Shell