Configuring an AIX client with multiple Kerberos realms

A typical customer environment is heterogeneous and includes AIX®, Windows®, and Linux®, which can be servers or clients. In many situations, an AIX Kerberos client needs to interact with multiple Kerberos realms hosted on a Windows or AIX Kerberos server to handle the requested services. This article explains the configuration details required to set the AIX Kerberos client to interact with multiple realms hosted on Windows Kerberos servers.

Share:

Shruthi Sharma (shrutsha@in.ibm.com), Software Engineer, IBM  

author photoShruthi Sharma works as a Development support specialist for AIX security. She has three years experience and has gained knowledge in components of AIX security and AIX system administration. She also has experience of working with customers and handling critical situations. You can reach her at shrutsha@in.ibm.com.



Uma Chandolu (uchandol@in.ibm.com), Software Engineer, IBM

Photo of Uma ChandoluUma M. Chandolu works as a Development Support Specialist on AIX. He is currently the team lead of the AIX Security Development Support team at IBM Bangalore.He has three years of extensive hands-on experience in AIX environments, and demonstrated expertise in AIX system administration and other subsystems. He has experience interfacing with customers and handling customer-critical situations. He has been recognized as an IBM developerWorks Contributing Author. You can reach him at uchandol@in.ibm.com.


developerWorks Contributing author
        level

20 October 2009

Also available in Chinese

Overview

Kerberos is a network authentication protocol based on symmetric key cryptography. It is a client-server based model that provides mutual authentication. It requires a trusted third party called the Key Distribution Center (KDC), which in turn consists of an Authentication Server (AS) and Ticket Granting Server (TGS). A Kerberos "realm" consists of Kerberos principals and services that are registered within a Kerberos server.

Windows Active Directory (AD), along with LDAP, also provides Kerberos services. Windows AD forest supports multiple domains and each of them can constitute of a Kerberos realm. The multiple domains may be divided based on business unit, geography, and other variables.

Overview of multiple realms

Advantages of multiple realms

There are several advantages to having multiple realms. They are:

  • Data is distributed across different realms instead of a single database, so there will not be a single point of failure.
  • It is easier to manage several small independent Kerberos realms than a single huge one.
  • Having interoperability between different KDCs, like MIT and Windows, leads to easier integration of new Kerberos realms into an existing environment.
  • It provides flexibility in terms of future add-ons or developments.
  • It provides flexibility in that a user from a different realm can access services from another realm based on the trust relationship that resides between the realms.
  • Users from different Kerberos realms in a particular AD forest can log in to a single AIX Kerberos client.

Scope, assumptions, and the environment

The scope of this article is to configure AIX as a Kerberos client to multiple Kerberos realms hosted on a Windows AD server. It is assumed that the reader of this article has a medium to high level of knowledge of the Kerberos protocol and Windows Active Directory.

The steps described in this article have been tested with Microsoft Windows 2003 AD server as Kerberos servers and IBM NAS 1.4.0.7 the as Kerberos client. The same steps should work with other versions of IBM NAS.

Configuration steps

Setting up Microsoft Windows Active Directory

For information on setting up Microsoft Active Directory on Microsoft Windows Server 2003, refer to the relevant Microsoft Windows documentation. Here we configured an Active Directory forest containing a parent and child domain (refer above diagram). The Active Directory Domain is also referred as the Microsoft Kerberos Realm running on Microsoft Active Directory.

  • Parent Domain - IBM.COM, windows AD server: ibmad1.ibm.com
  • Child Domain - SEC.IBM.COM, Windows AD server: ibmad2.sec.ibm.com
  • AIX Kerberos client - indus28.in.ibm.com

Configuring the AIX Kerberos client

  1. Make sure that the AIX client is configured with a FQDN (fully qualified domain name).

    For example, the hostname should be "indus28.in.ibm.com".

  2. Initially configure the AIX Kerberos client with child domain on the Windows AD server.

    Use the config.krb5 command to set up the Kerberos client on AIX.

    Syntax
    config.krb5 -C -d (domain name ) -r (realm name) -c (windows server) 
               -s (windows server)
    Ex:config.krb5 -C -d in.ibm.com -r SEC.IBM.COM -c ibmad2.sec.ibm.com -s 
    ibmad2.sec.ibm.com
  3. Change the /etc/krb5/krb5.conf file to include the details of parent domain "IBM.COM" and the Windows-supported encryption types.
    [libdefaults]
           default_realm = SEC.IBM.COM
           default_keytab_name = FILE:/etc/krb5/krb5.keytab
           default_tkt_enctypes = des-cbc-md5 des-cbc-crc
           default_tgs_enctypes = des-cbc-md5 des-cbc-crc
    
    [realms]
           SEC.IBM.COM = {
                   kdc = ibmad2.sec.ibm.com:88
                   admin_server = ibmad2.sec.ibm.com:749
                   default_domain = in.ibm.com
           }
           IBM.COM = {
                   kdc = ibmad1.ibm.com:88
                   admin_server = ibmad1.ibm.com:749
                   default_domain = in.ibm.com
           }  
    
    [domain_realm]
           .in.ibm.com = SEC.IBM.COM
           ibmad2.sec.ibm.com = SEC.IBM.COM
           ibmad1.ibm.com = SEC.IBM.COM
    
    [logging]
           kdc = FILE:/var/krb5/log/krb5kdc.log
           admin_server = FILE:/var/krb5/log/kadmin.log
           default = FILE:/var/krb5/log/krb5lib.log
  4. Add the following KRB5A stanza in the /usr/lib/security/methods.cfg file:
    KRB5A:
            program = /usr/lib/security/KRB5A 
            options = authonly 
    
    KRB5Afiles:  
             options = db=BUILTIN,auth=KRB5A 
    
    Note: For AIX 6.1 TL02 onwards add the Kerberos stanza as below:
    
    KRB5: 
            program = /usr/lib/security/KRB5 
            options = authonly,is_kadmind_compat=no  
    
    KRB5files: 
            options = db=BUILTIN,auth=KRB5
  5. On the child domain "SEC.IBM.COM", create a user using the Active Directory users and computer snap in for the AIX machine.

    For example, in this case a username, indus28, is created on the AD as the Kerberos client is being configured on indus28.in.ibm.com. While creating a user, you will be asked for information such as password. Provide a valid password for the username.

    On the Active Directory server, do the following:

    Use the Active Directory Management tool to create a new user corresponding to the AIX Kerberos client machine indus28.in.ibm.com.

    • Select the Users folder.
    • Right-click and select New.
    • Select user.
    • Give the name indus28.
    User selectiondefining passwordAfter password
  6. Use the ktpass tool to generate the keytab file on the Windows machine.
    ktpass -princ host/indus28.in.ibm.com@SEC.IBM.COM -mapuser indus28 -pass 123 
    -out indus28.keytab -ptype KRB5_NT_PRINCIPAL
    
    Ktpass:
    
    -princ user@realm , The user will be the aix client box, so in our case it will be 
    indus28. in.ibm.com, this has to be full domain name
    -mapuser : The user name will be indus28
    -pass provide the password or * if you want it to prompt for password
    -out , the name of output keytab file.
    ktpass command

    Securely transfer the indus28.keytab file to the AIX Kerberos client indus28.in.ibm.com.

  7. Similarly, create user "indus28_ibm" on the parent domain, IBM.COM (machine: ibmad1.ibm.com).
  8. Run the ktpass command in the domain IBM.COM:
    ktpass.exe -princ host/indus28.in.ibm.com@IBM.COM -mapuser indus28_ibm -pass 123 
    -out indus28_ibm.keytab -ptype KRB5_NT_PRINCIPAL
    
    Note: The map user is indus28_ibm and the keytab is indus28_ibm.keytab and the princ 
    name is again host/indus28.in.ibm,com
    ktpass command

    Securely transfer the indus28_ibm.keytab file to the AIX Kerberos client.

  9. On the AIX Kerberos client, use the ktutil function to read the keytab file, which has been copied from the Windows server, and write it to default keytab file /etc/krb5/krb5.keytab.
    #/usr/krb/sbin/ktutil
    ktutil:  rkt /usr/krb/sbin/indus28.keytab
    ktutil:  wkt /etc/krb5/krb5.keytab
    ktutil:  q
    
    # /usr/krb5/bin/klist -ke
    Keytab name:  FILE:/etc/krb5/krb5.keytab
    KVNO Principal
    ---- ---------
     18 host/indus28.in.ibm.com@SEC.IBM.COM (ArcFour with HMAC/md5)
    
    #/usr/krb5/sbin/ktutil
    ktutil:  rkt /usr/krb/sbin/indus28_ibm.keytab
    ktutil:  wkt /etc/krb5/krb5.keytab
    ktutil:  q
    
     #/usr/krb5/bin/klist -ke
    Keytab name:  FILE:/etc/krb5/krb5.keytab
    KVNO Principal
    ---- ---------
     18 host/indus28.in.ibm.com@SEC.IBM.COM (ArcFour with HMAC/md5)
      4 host/indus28.in.ibm.com@IBM.COM (ArcFour with HMAC/md5)
  10. Create a user foo on domain IBM.COM and foo1 on domain SEC.IBM.COM. Also create them locally on the AIX Kerberos client.
    #mkuser -R KRB5Afiles registry= KRB5Afiles SYSTEM= KRB5Afiles foo
    #mkuser -R KRB5Afiles registry= KRB5Afiles SYSTEM= KRB5Afiles foo1

    Make sure the lsuser command lists all the relevant user attributes.
  11. Run kinit for both the users to make sure you are able to authenticate them using Kerberos and can get tickets from the Kerberos realm they belong to.
    # /usr/krb5/bin/kinit foo1
    Password for foo1@SEC.IBM.COM:
    # /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  foo1@SEC.IBM.COM
    
    Valid starting     Expires            Service principal
    02/27/08 15:29:37  02/28/08 01:29:40  krbtgt/SEC.IBM.COM@SEC.IBM.COM
           Renew until 02/28/08 15:29:37
    # /usr/krb5/bin/kinit foo@IBM.COM
    Password for foo@IBM.COM:
    # /usr/krb5/bin/klist
    Ticket cache:  FILE:/var/krb5/security/creds/krb5cc_0
    Default principal:  foo@IBM.COM
    
    Valid starting     Expires            Service principal
    02/27/08 15:29:49  02/28/08 01:29:49  krbtgt/IBM.COM@IBM.COM
           Renew until 02/28/08 15:29:49
  12. Log in as both the users from the AIX Kerberos client.

Resources

Learn

Get products and technologies

  • Download IBM product evaluation versions and get your hands on application development tools and middleware products from DB2®, Lotus®, Rational®, Tivoli®, and WebSphere®.

Discuss

Comments

developerWorks: Sign in

Required fields are indicated with an asterisk (*).


Need an IBM ID?
Forgot your IBM ID?


Forgot your password?
Change your password

By clicking Submit, you agree to the developerWorks terms of use.

 


The first time you sign into developerWorks, a profile is created for you. Information in your profile (your name, country/region, and company name) is displayed to the public and will accompany any content you post, unless you opt to hide your company name. You may update your IBM account at any time.

All information submitted is secure.

Choose your display name



The first time you sign in to developerWorks, a profile is created for you, so you need to choose a display name. Your display name accompanies the content you post on developerWorks.

Please choose a display name between 3-31 characters. Your display name must be unique in the developerWorks community and should not be your email address for privacy reasons.

Required fields are indicated with an asterisk (*).

(Must be between 3 – 31 characters.)

By clicking Submit, you agree to the developerWorks terms of use.

 


All information submitted is secure.

Dig deeper into AIX and Unix on developerWorks


static.content.url=http://www.ibm.com/developerworks/js/artrating/
SITE_ID=1
Zone=AIX and UNIX
ArticleID=438583
ArticleTitle=Configuring an AIX client with multiple Kerberos realms
publish-date=10202009