|
||||||
|
||||||
ncsa |
||||||
|
User Information Home
 NCSA's Help Desk is available 24 hours a day, seven days a week, 365 days a year: Kerberos Installation Notes for NCSA Unix SystemsThese instructions are for installing the Kerberos client on machines that are on NCSA's network. If you have a remote machine which is not on NCSA's network then you can refer to the Installing Kerberos on remote systems page.If you run into trouble see the troubleshooting notes.
Installation Choices:Binaries on local disk or as a link to AFS?
Installation step 1: Installing the binariesOption 1: Binaries are linked to AFS The standard place to install the binaries is in /usr/local/krb5.
Option 2: Binaries are on local disk and you want to tar up the distribution from AFS
You can make your own distribution from the appropriate directory in /afs/ncsa/packages/kerberos. Option 3: Binaries are on local disk and you want to download the distribution from the Web
You can download unix binary distributions from the NCSA Kerberos 5 Binary download page. Note that you will need a valid NCSA account in order to do so. Option 4: I need to use the Kerberos clients on a machine but don't have root access to it
If you don't have root access to a machine, and you can't (or don't want to) get those that do to install the Kerberos clients, you can install and use them as a normal user. Note that if your machines has access to NCSA's AFS cell you can run them directly out of the AFS cell by setting the KRB5_CONFIG variable to /afs/ncsa/packages/kerberos/Common/etc/krb5.conf Installation step 2: Configuring the application serversYou only need to do this step if you need to run the Kerberos application servers (e.g. rlogind, telnetd, ftpd, rshd, ksu) to allow people to use Kerberos to connect to your Unix system. Otherwise you can skip to Step 3. Step 2.1: Get a Kerberos host key For each machine that needs to run Kerberos application servers you need to get a host key for it. Please see the web page for adding a host to the Kerberos database for directions. Step 2.2: Add Kerberos services to /etc/services
The file /usr/local/krb5/etc/services contains a list of services you need to add the your /etc/services file. You can append these entries your file with the following command: If that file does not exist then you can take a look at this copy of the services entries. Step 2.3: Add Kerberos servers to /etc/inetd.conf The file /usr/local/krb5/etc/inetd.conf contains example entries for installing Kerberos servers in a /etc/inetd.conf file. You need to look through this file and decide which servers you want to run and add these to your /etc/inetd.conf file. After making changes to your inetd.conf file, don't forget to restart your inetd daemon (usually kill -HUP <inetd's pid>). Note that the klogind and kshell daemons run on different ports than their standard BSD counterparts so there is no problem running them in parallel. However the Kerberos telnet and ftp daemons will by default use the same port as their BSD counterparts. You can run them in parallel on alternate ports, (for example we commonly run Kerberized telnet on port 888 here at NCSA when we don't want to replace the vendor or AFS telnetd) or you can replace the vendor daemons with the kerberos ones. If you want to use the kerberos daemons then you can comment the current vendor supplied ones in the inetd.conf file, uncomment the kerberos ftp line, and copy the ktelnet line and remove the "k" from ktelnet so it's just telnet. Here is a copy of the inetd.conf entries. Option 2: Installing applications servers in alternate directory
The krb5.conf file will need to be copied to the /etc directory:
% cp <local krb5 dir>/etc/krb5.conf /etc
If you are running AFS and want to get a token when logging in you will
need to change the krb5_aklog_path to point to your alternate installed
location.
krb5_aklog_path = <local krb5 dir>/bin/aklog
You will also need to modify the krb5 entries in the inetd.conf file. These are different from the normal entries and contain -L flags at then end of some lines. Here is a copy of the new entries. You will need to replace <local krb5 dir> with the location of where kerberos was installed. Installation step 3: Configuring AFS support
krb5_run_aklog = 0
If you have AFS on your system and you have access to NCSA's cell,
change the 0 to a 1 so the line looks like:
krb5_run_aklog = 1
This will tell kinit to get
an AFS token for you whenever you get a Kerberos ticket.
Step 3.1: Additional Configuration for AFS/NFS translator clients
On AFS clients using a AFS/NFS translator you need to make sure that the file /.AFSSERVER and /.AFSCONF are in place and are world-readable (permissions should be 0644). The file /.AFSSERVER contains the full hostname of the machine acting as a translator. The file /.AFSCONF contains the path to the AFS configuration files, typically /afs/ncsa/service/etc. If you don't know if you are using an AFS translator, run the command: df | grep afsand the output should look like one of the following lines: AFS 9000000 0 9000000 0% /afsor translator:/afs 72000000 0 72000000 0% /afsIf you see the first line (with the capital AFS) that means you have a native AFS client and you don't need to worry about the /.AFSSERVER and /.AFSCONF files. If you see the second line, that means you are using a translator (in this case the translator is the host translator) and you need to make sure the /.AFSSERVER and /.AFSCONF files exist.
Question or comments about this page may be sent to Kerberos@ncsa.uiuc.edu
|
||||||
|
|
||||||
