beargiles/kdc-sandbox repository overview

This is a simple sandbox for the MIT KDC. It is intended for educational purposes.

Required software:

• krb5-user (Debian and Ubuntu)
• krb5-workstation (RedHat and CentOS)

To run the docker image use

  $ docker run -d -p 88:88 -p 749:749 beargiles/kdc-sandbox

OS-specific notes:

  Linux:
     - works as-is
  Macs:
     - you will need to either add "-p 88:88/udp -p 749:749/udp" or add "tcp/" to the hostname in the [realms] section in the
       hosts's /etc/krb5.conf. You do not need to modify the file in the docker container.
     - you might need to remap ports 88 and 749 to a different address. If so you'll need to add ":port" to the hostname in the
       [realms] section in the host's /etc/krb5.conf. You do not need to modify the file in the docker container.
  Windows:
     - unknown

You will need to edit your /etc/krb5.conf file to include

  [logging]
     default = FILE:/var/log/krb5libs.log
     kdc = FILE:/var/log/krb5kdc.log
     admin_server = FILE:/var/log/kadmind.log

  [libdefaults]
     forwardable = true
     default_realm = EXAMPLE.COM  (optional)

  [realms]
     EXAMPLE.COM = {
         kdc = localhost
         admin_server = localhost
      }

  [domain_realm]
     .example.com = EXAMPLE.COM
     example.com = EXAMPLE.COM

KERBEROS BASICS

Kerberos principals fall into three general categories:

• user@REALM
• user/svcname@REALM
• svcname/host@REALM

where 'svcname' is a service name such as 'ftp', 'hdfs', 'solr', etc. The svcname 'admin' is special - it is reserved for the right to run the 'kadmin' application. A user without a svcname can connect to any service except kadmin. A user with a svcname can only connect to that specific service. There can be multiple entries if a user needs access to multiple services.

The host must either be an IP address or DNS entry. (Note: Hadoop uses advanced Kerberos techniques to allow the client, not server, to use _HOST as a wildcard.) The realm is the domain name in uppercase but it is not required.

Users typically use passwords or SSL keys to prove their identity. (SSL keys are supported with 'PKINIT'.) Client applications typically use keytab files to prove their identity. Keytab files contain sensitive information and must be protected.

BASIC COMMANDS

To log in:

  $ kinit [email protected]

(password is 'password')

To log out:

  $ kdestroy

To list your current Kerberos principals:

  $ klist

To log in as administrator:

  $ kinit root/[email protected]

(password is 'password')

To create a new user:

  $ kadmin
  kadmin: addprinc -pw password bob
  kadmin: quit

To create a new admin:

  $ kadmin
  kadmin: addprinc -pw password bob/admin
  kadmin: quit

To create a new service account and keytab file:

  $ kadmin
  kadmin: addprinc -randkey ftp/localhost
  kadmin: ktadd -k /tmp/ftp.keytab -norandkey ftp/localhost
  kadmin: quit

OS-specific notes:

  Linux:
     - works as-is
  Macs:
     - fails due to insufficient permissions despite kadm5.acl file. Must use 'kadmin.local' instead.
  Windows:
     - unknown

To log in using keytab file instead of password:

  $ kinit -kt /tmp/ftp.keytab ftp/localhost

To list all accounts:

  $ kadmin
  kadmin: listprincs
  kadmin: quit