Introduction

Since security is one of the key aspects and selling features of Network File System Version 4 (NFS Version 4), it is widely being accepted as the next-generation distributed file system. The current implementation of NFS Version 4 makes use of Kerberos (RFC 4120) as its underlying security mechanism to achieve authentication, privacy, integrity, and non-repudiation. IBM® has its own implementation of NFS Version 4 for its AIX® operating system, which makes use of IBM Network Authentication Service Version 1.4 (IBM NAS—the IBM flavor of Kerberos) for kerberizing the file system.

Most of the customers deploying AIX NFS Version 4 (or migrating from an older distributed file system like DCE/DFS or AFS) have a hybrid environment with a mix of Windows® and UNIX® systems. In such a heterogeneous environment, some administrators prefer using Microsoft® Active Directory as the Kerberos server for their Windows environment and using IBM NAS for AIX as the Kerberos server for the rest, thus resulting in two different Kerberos realms. There are also scenarios where there is a need for AIX NFS Version 4 to operate across organizational boundaries. In such cases, there is a high chance that the Kerberos servers used within individual organizations are deployed using different flavors of Kerberos by different vendors (for example, some using IBM NAS and others using Microsoft Active Directory). In other scenarios that are similar, some administrators might be planning to migrate from Microsoft Active Directory to IBM NAS for AIX to act as the Kerberos server for their realm.

In order for AIX NFS Version 4 to work in the scenarios involving multiple Kerberos realms, you need to establish an inter-realm configuration between the Kerberos realms configured using IBM NAS Version 1.4 for AIX and Microsoft Active Directory. This article describes the necessary configuration steps to aid you in configuring a successful inter-realm setup between IBM NAS Version 1.4 and Microsoft Active Directory. It further details the changes required for AIX NFS Version 4 to work over such an inter-realm setup and illustrates its working through examples.

Kerberos inter-realm configuration

The Kerberos Version 5 protocol is implemented by various vendors for a variety of systems. Its basic use is to achieve centralized authentication over a distributed network. Kerberos interoperability provides a common protocol for various implementations to coexist and work together in a heterogeneous environment.

In the Kerberos world, all the users and applications that use Kerberos as the authentication medium and which are configured to a particular Kerberos server (say either IBM NAS Version 1.4 for AIX or Microsoft Active Directory) together compose a cell called realm. The name of the realm in which a Kerberos client (user or application) gets registered is part of the client's name and can be used by the kerberized application server to decide whether to honor a request. As a part of Kerberos interoperability, most of the Kerberos implementation supports a theory called inter-realm configuration. The basic concept behind inter-realm configuration is the establishment of inter-realm keys, which aid administrators of two different realms to allow clients authenticated in one realm to use its Kerberos credentials in other realm.

The following sections describe the configuration details on how to set up an inter-realm between two Kerberos realms, one configured to IBM NAS servers and the other to Microsoft Active Directory. It further explains the use of AIX NFS Version 4 as the kerberized application to test the working of inter-realm configuration.

AIX NFS Version 4 with IBM NAS and Microsoft Active Directory—The scenario

In order to set up and test the execution of AIX NFS Version 4 over the Kerberos inter-realm consisting of IBM NAS and Microsoft Active Directory, consider the following scenario. As shown in Figure 1, the scenario consists of two different Kerberos realms. One of the realms, ADFSAIX1.IN.IBM.COM, has IBM NAS for AIX acting as the Kerberos Key Distribution Center (KDC), while the other realm, MSKERBEROS.IN.IBM.COM, makes use of Microsoft Active Directory as the Kerberos KDC. The AIX NFS Version 4 server exporting the directories is configured to the IBM NAS realm, ADFSAIX1.IN.IBM.COM, while the AIX NFS Version 4 client, which mounts the exported directories by AIX NFS V4 server, is configured to both the ADFSAIX1.IN.IBM.COM and MSKERBEROS.IN.IBM.COM Kerberos realms. The final goal that defines the success of this scenario is that an administrator@ MSKERBEROS.IN.IBM.COM Kerberos principal, belonging to MSKERBEROS.IN.IBM.COM realm, should be able to successfully acquire Kerberos credentials on the AIX NFS Version 4 client machine and use those credentials to successfully access and mount the directories exported by the AIX NFS Version 4 nfs/adfsaix1.in.ibm.com@ ADFSAIX1.IN.IBM.COMserver, belonging to the ADFSAIX1.IN.IBM.COM realm.

The following definitions are used in the example in this article:

                
        NFS domain name: in.ibm.com

        AIX NAS 1.4 (KDC) and AIX NFS V4 server:
        Realm name              : ADFSAIX1.IN.IBM.COM
        Hostname                : adfsaix1.in.ibm.com
        Operating system        : AIX V5.3
        IBM NAS admin principal : admin/admin
        NFS V4 Server principal : nfs/adfsaix1.in.ibm.com

        Microsoft Active Directory Server (KDC)
        Realm Name             : MSKERBEROS.IN.IBM.COM
        Hostname               : windce20.in.ibm.com
        Operating system       : Microsoft Windows Server 2003
        (Enterprise Edition, SP1)
        Active Directory admin
        Principal              : administrator

        AIX NAS 1.4 client and AIX NFS V4 client
        Realm name       : ADFSAIX1.IN.IBM.COM
        Hostname         : nfsaix02.in.ibm.com
        Operating system : AIX V5.3
        Configured to ADFSAIX1.IN.IBM.COM and MSKERBEROS.IN.IBM.COM realms.
      

Configuration steps

For a better understanding, the configuration steps are divided into four distinct modules:

• Setting up IBM NAS KDC server and AIX NFS Version 4 server
• Setting up Microsoft Active Directory
• Inter-realm settings on IBM NAS KDC Server and Microsoft Active Directory
• Setting up IBM NAS client and AIX NFS Version 4 client—Testing the scenario

Setting up IBM NAS KDC server and AIX NFS Version 4 server

1. Install krb5 and the modcrypt filesets on the AIX 5.3 machine.

   The IBM NAS Version 1.4 filesets are shipped with the AIX Version 5.3 Expansion CD. The commands to install IBM NAS Version 1.4 server and the modcrypt.base fileset required by AIX NFS Version 4 are:

   
   
   Listing 2. Fileset requirements
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# installp -aqXgd . krb5.server modcrypt.base

   
   

   With the release of AIX 53L (TL 5300-07) and AIX 610, you need to also install the clic.rte fileset shipped with the AIX Expansion Pack CD, which is the prerequisite for the execution of the gssd daemon. For more information, please refer to the AIX 53L or 610 documentation.

2. Configure the AIX NAS KDC server.

   After successfully installing IBM NAS Version 1.4, configure the IBM NAS KDC on the AIX machine. To configure the NAS KDC server to use the legacy database, use the following command, as shown in Listing 3 . For detailed information on IBM NAS administration, please refer to the IBM NAS Version 1.4 Administration’s and User’s Guide, shipped with the AIX Version 5.3 Expansion Pack CD.

   
   
   Listing 3. Configuration of the NAS KDC server
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# export PATH=/usr/krb5/bin/:/usr/krb5/sbin/:$PATH bash-2.05b# config.krb5 -S -r ADFSAIX1.IN.IBM.COM -d in.ibm.com Initializing configuration... Creating /etc/krb5/krb5_cfg_type... Creating /etc/krb5/krb5.conf... Creating /var/krb5/krb5kdc/kdc.conf... Creating database files... Initializing database '/var/krb5/krb5kdc/principal' for realm 'ADFSAIX1.IN.IBM.COM' master key name 'K/M@ADFSAIX1.IN.IBM.COM' You are prompted for the database Master Password. It is important that you DO NOT FORGET this password. Enter database Master Password: Re-enter database Master Password to verify: WARNING: no policy specified for admin/admin@ADFSAIX1.IN.IBM.COM; defaulting to no policy. Note that policy may be overridden by ACL restrictions. Enter password for principal "admin/admin@ADFSAIX1.IN.IBM.COM": Re-enter password for principal "admin/admin@ADFSAIX1.IN.IBM.COM": Principal "admin/admin@ADFSAIX1.IN.IBM.COM" created. Creating keytable... Creating /var/krb5/krb5kdc/kadm5.acl... Starting krb5kdc... krb5kdc was started successfully. Starting kadmind... kadmind was started successfully. The command completed successfully.

   
   

   You can also configure the NAS KDC server using the AIX mkkrb5srv command. For more information, please refer to mkkrb5srv man page.

   While running this command, the system asks for a master database password and a password for the administrative principal called admin. Record the name and chosen password in a secure place, as these principals are essential for your NAS environment.

3. Set up the NFS domain name.

   You must have the NFS domain name set before you can use NFS Version 4.

   
   
   Listing 4. NFS setup server
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# chnfsdom in.ibm.com bash-2.05b# chnfsdom Current local domain: in.ibm.com

   
   
4. Add NFS domain-to-realm mapping on the NFS Version 4 server.

   In the AIX 5.3 implementation of NFS Version 4, you need to have a cross-relation definition between the NFS domain and the Kerberos realm that is used.

   
   
   Listing 5. NFS domain-to-realm mapping
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# chnfsrtd -a ADFSAIX1.IN.IBM.COM in.ibm.com bash-2.05b# chnfsrtd -a MSKERBEROS.IN.IBM.COM in.ibm.com bash-2.05b# chnfsrtd adfsaix1.in.ibm.com in.ibm.com mskerberos.in.ibm.com in.ibm.com

   
   
5. Create the NFS server principal on AIX KDC and then create the NFS server keytab file entry.

   For each NFS server in your KDC environment, you must define a principal of type nfs/<full_qualified_hostname>@REALM, and then create the server keytab file entry, as follows:

   
   
   Listing 6. Creating the NFS server principal
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# kadmin.local kadmin.local: ank nfs/adfsaix1.in.ibm.com WARNING: no policy specified for nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM; defaulting to no policy. Note that policy may be overridden by ACL restrictions. Enter password for principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM": Re-enter password for principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM": Principal "nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM" created. kadmin.local: kadmin.local: ktadd nfs/adfsaix1.in.ibm.com Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab. Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type ArcFour with HMAC/md5 added to keytab WRFILE:/etc/krb5/krb5.keytab. Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type AES-256 CTS mode with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab. Entry for principal nfs/adfsaix1.in.ibm.com with kvno 2, encryption type DES cbc mode with RSA-MD5 added to keytab WRFILE:/etc/krb5/krb5.keytab. kadmin.local: q bash-2.05b# klist -k Keytab name: FILE:/etc/krb5/krb5.keytab KVNO Principal ---- --------- 2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM 2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM 2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM 2 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM

   
   
6. Set up the gssd daemon on the NFS Version 4 server.

   To enable NFS Version 4 using RPCSEC_GSS, you have to create the map file between the server’s keytab file and the NFS server principal, as shown below:

   
   
   Listing 7. Enabling NFS Version 4 using RPSEC-GSS
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# nfshostkey -p nfs/adfsaix1.in.ibm.com -f /etc/krb5/krb5.keytab bash-2.05b# bash-2.05b# nfshostkey -l nfs/adfsaix1.in.ibm.com /etc/krb5/krb5.keytab

   
   
7. Stop and restart the NFS daemons (gssd and nfsrgyd) so that all changes take effect and the daemons get started on subsequent machine reboots.
   
   Listing 8. Stopping and restarting the NFS daemons
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# chnfs -s 0513-004 The Subsystem or Group, gssd, is currently inoperative. bash-2.05b# chnfs -S -B 0513-059 The gssd Subsystem has been started. Subsystem PID is 389192. bash-2.05b# chnfs -v 0513-044 The nfsrgyd Subsystem was requested to stop. bash-2.05b# chnfs -V 0513-059 The nfsrgyd Subsystem has been started. Subsystem PID is 413862.

   
   

   Enter lssrc -g nfs to make sure all of the NFS daemons are active.

8. Export the directory from NFS server that can be accessed by Kerberos authenticated users or applications only.
   
   Listing 9. Exporting the directory
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# exportfs -i -o vers=4,sec=krb5 /home/guest bash-2.05b# exportfs /home/guest -vers=4,sec=krb5

   
   
9. Mount the exported directory locally to test that it is accessible with Kerberos authentication.

   Get the Kerberos credentials for the user and then mount the NFSv4 exported directory on ‘/mnt’.

   
   
   Listing 10. Mounting the exported directory locally
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# kinit admin/admin Password for admin/admin@ADFSAIX1.IN.IBM.COM: bash-2.05b# mount -o vers=4,sec=krb5 adfsaix1.in.ibm.com:/home/guest/ /mnt bash-2.05b# bash-2.05b# cd /mnt bash-2.05b# ls -l total 0 bash-2.05b# touch file.txt bash-2.05b# ls file.txt bash-2.05b# klist Ticket cache: FILE:/var/krb5/security/creds/krb5cc_0 Default principal: admin/admin@ADFSAIX1.IN.IBM.COM Valid starting Expires Service principal 08/24/07 01:25:11 08/25/07 01:24:56 krbtgt/ADFSAIX1.IN.IBM.COM@ADFSAIX1.IN.IBM.COM 08/24/07 01:25:21 08/25/07 01:24:56 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM

   
   

   For further details on AIX NFS Version 4 configuration with Kerberos, please refer to the Securing NFS in AIX—An Introduction to NFS V4 in AIX 5L Version 5.3 Redbook (see Resources).

Setting up Microsoft Active Directory

For setting up Microsoft Active Directory on Microsoft Windows Server 2003, refer to the relevant Microsoft Windows documentation available on Microsoft Developer Network Web site (see Resources). For this scenario, we configured Active Directory on a machine with hostname windce20.in.ibm.com and named the Active Directory Domain MSKERBEROS.IN.IBM.COM, which we also refer it as Microsoft Kerberos Realm running on Microsoft Active Directory.

Inter-realm settings on IBM NAS KDC Server and Microsoft Active Directory

The following steps are required on both the KDC machines to set up an inter-realm between the two realms that have been configured so far.

1. Add the krbtgt service principal to NAS KDC server.

   For a KDC of one realm to authenticate its Kerberos users in a different realm, it must share a key with the KDC in the other realm. So, you need to create krbtgt service principals for cross realms access. It is important that these principals all have the same passwords.

   
   
   Listing 11. Adding the krbtgt service principal to NAS KDC server
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# kadmin.local kadmin.local: ank -pw f1lesystem krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM WARNING: no policy specified for krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM; defaulting to no policy. Note that policy may be overridden by ACL restrictions. Principal "krbtgt/MSKERBEROS.IN.IBM.COM@ADFSAIX1.IN.IBM.COM" created. kadmin.local: kadmin.local: ank -pw f1lesystem krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM WARNING: no policy specified for krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM; defaulting to no policy. Note that policy may be overridden by ACL restrictions. Principal "krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM" created.

   
   
2. Edit the NAS KDC server /etc/krb5/krb5.conf file, as follows:

   Change the Kerberos client file configuration to have entries of both the realms. In this case, we added MSKERBEROS.IN.IBM.COM stanza in the [realms] section and windce20.in.ibm.com = MSKERBEROS.IN.IBM.COM entry in the [domain_realm] section.

   
   
   Listing 12. Editing the NAS KDC server /etc/krb5/krb5.conf file
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# cat /etc/krb5/krb5.conf [libdefaults] default_realm = ADFSAIX1.IN.IBM.COM default_keytab_name = FILE:/etc/krb5/krb5.keytab default_tkt_enctypes = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc default_tgs_enctypes = des3-cbc-sha1 arcfour-hmac aes256-cts des-cbc-md5 des-cbc-crc [realms] ADFSAIX1.IN.IBM.COM = { kdc = adfsaix1.in.ibm.com:88 admin_server = adfsaix1.in.ibm.com:749 default_domain = in.ibm.com } MSKERBEROS.IN.IBM.COM = { kdc = windce20.in.ibm.com:88 admin_server = windce20.in.ibm.com:749 default_domain = in.ibm.com } [domain_realm] adfsaix1.in.ibm.com = ADFSAIX1.IN.IBM.COM windce20.in.ibm.com = MSKERBEROS.IN.IBM.COM [logging] kdc = FILE:/var/krb5/log/krb5kdc.log admin_server = FILE:/var/krb5/log/kadmin.log default = FILE:/var/krb5/log/krb5lib.log

   
   

   If you have more than one AIX machine acting as NFS Version 4 server, make sure to add their hostname entry in the [domain_realm] section.

3. Stop and restart the krb5 daemons so that all of the changes take effect.
   
   Listing 13. Stopping and restarting the krb5 daemons
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# stop.krb5 Stopping /usr/krb5/sbin/krb5kdc... /usr/krb5/sbin/krb5kdc was stopped successfully. Stopping /usr/krb5/sbin/kadmind... /usr/krb5/sbin/kadmind was stopped successfully. The command completed successfully. bash-2.05b# start.krb5 Starting krb5kdc... krb5kdc was started successfully. Starting kadmind... kadmind was started successfully. The command completed successfully.

   
   
4. Verify the Active Directory configuration on the Windows machine.

   Figure 2 lists the existing setup of the Active Directory on windce20.in.ibm.com.

   
   
   Figure 2. Existing setup of Active Directory on windce20.in.ibm.com
   
   
   
5. Set up the configuration for the foreign Kerberos realm using the following command on Windows Active Directory machine.

   Figure 3 lists the output of adding KDC in Active Directory on windce20.in.ibm.com.

   
   
   Figure 3. KDC in Active Directory on windce20.in.ibm.com
   
   
   
6. Create a trusted domain relationship with the AIX NAS realm on the Windows Active Directory.

   Log on to the Windows 2003 Server machine (windce20.in.ibm.com) hosting the Active Directory and do the following:

   • Start the Domain Tree Management tool. Click Programs, Administrative tools, and then Active Directory Domains and Trusts.
   • Right-click on the Properties of your domain, and then select the Trusts tab and press New Trust. Enter your AIX NAS realm that you want to add in the ADS trust list.
   • Select Realm trust as the trust type, Nontransitive as the trust transitivity, Two-way as the trust direction, and then in the Trust password, type the password you passed while creating krbtgt service principals above, for example, f1lesystem.
   • After this the entry is created for your trusted realm, verify the properties of it.

   Figure 4 lists the final output after adding the trust between the Active Directory realm and NAS realm on the Active Directory.

   
   
   Figure 4. Final output after adding the trust on the Active Directory
   
   
   
7. Confirm that you are able to get the TGT for the ADS principal (administrator) from the NAS server machine.

   
   
   Listing 14. Confirming that you are able to get the TGT for the ADS principal file
   

   bash-2.05b# hostname adfsaix1.in.ibm.com bash-2.05b# kinit administrator@MSKERBEROS.IN.IBM.COM Password for administrator@MSKERBEROS.IN.IBM.COM: bash-2.05b# klist Ticket cache: FILE:/var/krb5/security/creds/krb5cc_0 Default principal: administrator@MSKERBEROS.IN.IBM.COM Valid starting Expires Service principal 08/24/07 01:26:44 08/24/07 11:27:04 krbtgt/MSKERBEROS.IN.IBM.COM@MSKERBEROS.IN.IBM.COM Renew until 08/25/07 01:26:44

   
   

Setting up IBM NAS client and AIX NFS Version 4 client : Testing the scenario

1. Install krb5 client and modcrypt filesets on the AIX 5.3 client machine.

   The command we used to install was:

   
   
   Listing 15. Installing krb5 client and modcrypt filesets
   

   bash-2.05b# hostname nfsaix02.in.ibm.com bash-2.05b# installp -aqXgYd . krb5.client modcrypt.base

   
   
2. Configure the AIX NAS client, as follows:

   
   
   Listing 16. Configuring the AIX NAS client
   

   bash-2.05b# hostname nfsaix02.in.ibm.com bash-2.05b# export PATH=/usr/krb5/bin/:/usr/krb5/sbin/:$PATH bash-2.05b# config.krb5 -C -r ADFSAIX1.IN.IBM.COM -d in.ibm.com -s adfsaix1.in.ibm.com -c adfsaix1.in.ibm.com Initializing configuration... Creating /etc/krb5/krb5_cfg_type... Creating /etc/krb5/krb5.conf... The command completed successfully.

   
   

   The AIX NAS client can also be configured using the AIX mkkrb5clnt command. For more information, please refer to the mkkrb5clnt man page.

   Then modify the client /etc/krb5/krb5.conf file, as previously mentioned for the NAS server.
3. Set up the NFS domain name and add the NFS domain-to-realm mapping on the NFSv4 client machine:
   
   Listing 17. Setting up the NFS domain name and adding the NFS domain-to-realm mapping
   

   bash-2.05b# hostname nfsaix02.in.ibm.com bash-2.05b# chnfsdom in.ibm.com bash-2.05b# chnfsdom Current local domain: in.ibm.com bash-2.05b# chnfsrtd -a ADFSAIX1.IN.IBM.COM in.ibm.com bash-2.05b# chnfsrtd -a MSKERBEROS.IN.IBM.COM in.ibm.com bash-2.05b# chnfsrtd adfsaix1.in.ibm.com in.ibm.com mskerberos.in.ibm.com in.ibm.com

   
   
4. Stop and restart the NFS daemons (gssd and nfsrgyd) so that all changes take effect and the daemons get started on subsequent machine reboots.
   
   Listing 18. Stopping and restarting the NFS daemons
   

   bash-2.05b# hostname nfsaix02.in.ibm.com bash-2.05b# chnfs -s 0513-004 The Subsystem or Group, gssd, is currently inoperative. bash-2.05b# chnfs -S -B 0513-059 The gssd Subsystem has been started. Subsystem PID is 413932. bash-2.05b# chnfs -v 0513-044 The nfsrgyd Subsystem was requested to stop. bash-2.05b# chnfs -V 0513-059 The nfsrgyd Subsystem has been started. Subsystem PID is 258122.

   
   

   Make sure all of the NFS daemons are active now by running lssrc -g nfs. Also ensure that all the machines are in sync with the same time.

5. Get the TGT for the user in Microsoft realm and use it to access the NFS exported data with krb5 security residing on IBM NAS realm.

   
   
   Listing 19. Getting the TGT for the user
   

   bash-2.05b# hostname nfsaix02.in.ibm.com bash-2.05b# kinit administrator@MSKERBEROS.IN.IBM.COM Password for administrator@MSKERBEROS.IN.IBM.COM: bash-2.05b# mount -o vers=4,sec=krb5 adfsaix1.in.ibm.com:/home/guest/ /mnt bash-2.05b# cd /mnt bash-2.05b# touch new.txt bash-2.05b# ls file.txt new.txt bash-2.05b# klist Ticket cache: FILE:/var/krb5/security/creds/krb5cc_0 Default principal: administrator@MSKERBEROS.IN.IBM.COM Valid starting Expires Service principal 08/24/07 01:26:44 08/24/07 11:27:04 krbtgt/MSKERBEROS.IN.IBM.COM@MSKERBEROS.IN.IBM.COM Renew until 08/25/07 01:26:44 08/24/07 01:26:44 08/24/07 11:27:04 krbtgt/ADFSAIX1.IN.IBM.COM@MSKERBEROS.IN.IBM.COM Renew until 08/25/07 01:26:44 08/24/07 01:27:25 08/24/07 11:27:04 nfs/adfsaix1.in.ibm.com@ADFSAIX1.IN.IBM.COM Renew until 08/25/07 01:26:44

   
   

Conclusion

In this article, you have seen how you can configure Kerberos (IBM NAS and Microsoft Active Directory) to facilitate the use of AIX NFS Version 4 across organizational boundaries to work in a heterogeneous environment.

Resources

Learn

• IBM Redbooks: Securing NFS in AIX: An Introduction to NFS Version 4 in AIX 5L Version 5.3: Get a broad understanding of NFS Version 4 and specific AIX NFS Version 4 implementation details.
  
  
• Configuring AIX 5L for Kerberos Based Authentication Using Windows Kerberos Service: This white paper describes how to use Kerberos as an alternative authentication mechanism to AIX using Windows 2000/2003 server Kerberos Service.
  
  
• "A Kerberos Primer" (developerWorks, Nov 2001): This article introduces Kerberos technology and Distributed Computing Environment-based applications.
  
  
• Network File System (NFS) Version 4 Protocol: For details on NFS Version 4, see IETF Request for Comments (RFC) 3530.
  
  
• Windows Server 2003 Terminal Services: Learn about Terminal Services in Windows Server 2003, which provides new options for application deployment, more efficient access to data over low bandwidth, reuse of older hardware, remote management, and other tasks.
  
  
• Popular content: See what AIX and UNIX® content your peers find interesting.
  
  
• AIX and UNIX: The AIX and UNIX developerWorks zone provides a wealth of information relating to all aspects of AIX systems administration and expanding your UNIX skills.
  
  
• New to AIX and UNIX?: Visit the "New to AIX and UNIX" page to learn more about AIX and UNIX.
  
  
• AIX Wiki: A collaborative environment for technical information related to AIX.
  
  
• Search the AIX and UNIX library by topic:
  • System administration
  • Application development
  • Performance
  • Porting
  • Security
  • Tips
  • Tools and utilities
  • Java™ technology
  • Linux
  • Open source
  
  
• Safari bookstore: Visit this e-reference library to find specific technical resources.
  
  
• developerWorks technical events and webcasts: Stay current with developerWorks technical events and webcasts.
  
  
• Podcasts: Tune in and catch up with IBM technical experts.
  
  

Get products and technologies

• AIX 5L Expansion Pack and Web Download Pack: Start downloading now.
  
  
• IBM trial software: Build your next development project with software for download directly from developerWorks.
  
  

Discuss

• Participate in the developerWorks blogs and get involved in the developerWorks community.
  
  
• Participate in the AIX and UNIX forums:
  • AIX —technical forum
  • AIX 6 Open Beta
  • AIX for Developers Forum
  • Cluster Systems Management
  • IBM Support Assistant
  • Performance Tools—technical
  • Virtualization—technical
  • More AIX and UNIX forums
  
  

About the authors

Sandeep Ramesh Patil works as an Advisory Software Engineer for the IBM India Software Labs. He has worked for IBM for the past six years, focusing on distributed technology including DCE, SARPC, and security products, such as the IBM Network Authentication Service (IBM Kerberos). He is currently developing new features and implementing security-related RFC for the IBM Network Authentication Service, along with its product support. Sandeep holds a Bachelor of Engineering degree in computer science from the University of Pune, India. You can contact him at rsandeep@in.ibm.com.

Prashant Sodhiya is a Staff Software Engineer for IBM India Software Labs. He has worked for IBM for the past two years and is currently developing new features and product support for the IBM Network Authentication Service (IBM Kerberos). Before joining IBM, he worked with the Centre for Development of Advanced Computing (CDAC) for three years in network security domain. Prashant holds a BS degree in computer science and engineering from the University of Gwalior, India. You can contact him at psodhiya@in.ibm.com.

Comments (Undergoing maintenance)

Back to top

Trademarks  |  My developerWorks terms and conditions

Table of contents

• Introduction
• Kerberos inter-realm configuration
• AIX NFS Version 4 with IBM NAS and Microsoft Active Directory—The scenario
• Configuration steps
• Conclusion
• Resources
• About the authors
• Comments

Local resources

• IBM Innovation Center - Austin, TX
• IBM Innovation Center - Chicago, IL
• IBM Innovation Center - Dallas, TX
• IBM Innovation Center - San Mateo, CA
• IBM Innovation Center - Waltham, MA
• Technical Briefings in North America

My developerWorks community

Dig deeper into AIX and UNIX on developerWorks

Calling all developers

Download no charge Lotus Domino Designer

Special offers