The Kerberos client machine should be time synced with KDC. Ensure to sync the KDC and
clients by using NTP. Time difference of five minutes or more leads to Kerberos authentication
failure and throws a clock skew error.
About this task
This step is a prerequisite on all the systems which are going to participate in Kerberos
authentication like NFS clients, hosts where NFS service containers are going to run.
Follow these steps to set up the Kerberos client.
Procedure
-
Check the required RPMs
[root@host ~]# rpm -qa | grep krb5
krb5-libs-1.20.1-9.el9_2.x86_64
krb5-pkinit-1.20.1-9.el9_2.x86_64
krb5-workstation-1.20.1-9.el9_2.x86_64
- Update the krb5.conf file similar to the one on KDC server:
[root@host ~]# cat /etc/krb5.conf
# To opt out of the system crypto-policies configuration of krb5, remove the
# symlink at /etc/krb5.conf.d/crypto-policies which will not be recreated.
includedir /etc/krb5.conf.d/
[logging]
default = [FILE:/var/log/krb5libs.log](file:///var/log/krb5libs.log)
kdc = [FILE:/var/log/krb5kdc.log](file:///var/log/krb5kdc.log)
admin_server = [FILE:/var/log/kadmind.log](file:///var/log/kadmind.log)
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
pkinit_anchors = [FILE:/etc/pki/tls/certs/ca-bundle.crt](file:///etc/pki/tls/certs/ca-bundle.crt)
spake_preauth_groups = edwards25519
dns_canonicalize_hostname = fallback
qualify_shortname = ""
default_realm = PUNE.IBM.COM
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
PUNE.IBM.COM = {
kdc = 10.0.210.222:88
admin_server = 10.0.210.222:749
}
[domain_realm]
.IBM.com = PUNE.IBM.COM
IBM.com = PUNE.IBM.COM
- Verification: Validate the client settings:
[root@host ~]# kinit admin/admin
Password for admin/admin@PUNE.IBM.COM:
[root@ceph-mani-o7fdxp-node5 ~]# klist
Ticket cache: KCM:0
Default principal: admin/admin@PUNE.IBM.COM
Valid starting Expires Service principal
10/25/23 08:49:12 10/26/23 08:49:08 krbtgt/PUNE.IBM.COM@PUNE.IBM.COM
renew until 10/25/23 08:49:12