kerberos_主从配置

《kerberos_主从配置》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、Kerberos主从配置（一）环境：名称版本CentOSCentOSrelease5.4(Final)Kerberoskrb5-devel-1.6.1-70.el5krb5-libs-1.6.1-70.el5krb5-server-1.6.1-70.el5pam_krb5-2.2.14-10krb5-devel-1.6.1-70.el5pam_krb5-2.2.14-10krb5-workstation-1.6.1-70.el5krb5-libs-1.6.1-70.el5名称作用192.168.116.129Kerberosmaster192.168

2、.116.137Kerberosslave（二）配置1）主机名称配置在master和slave服务器上添加主机名称及对应的域名#vim/etc/hosts192.168.116.129kerberos.example.comkerberos192.168.116.129kdc.example.comkdc192.168.116.137kerberos2.example.comkerberos22）master配置---从初始化安装开始/etc/krb5.conf[logging]default=FILE:/var/log/krb5libs.logkd

3、c=FILE:/var/log/krb5kdc.logadmin_server=FILE:/var/log/kadmind.log[libdefaults]default_realm=EXAMPLE.COMdns_lookup_realm=falsedns_lookup_kdc=falseticket_lifetime=24hforwardable=yes[realms]EXAMPLE.COM={kdc=kerberos.example.com:88kdc=kerberos2.example.com:88admin_server=kerberos.e

4、xample.com:749default_domain=example.com}[domain_realm].example.com=EXAMPLE.COMexample.com=EXAMPLE.COM[appdefaults]pam={debug=falseticket_lifetime=36000renew_lifetime=36000forwardable=truekrb4_convert=false}/var/kerberos/krb5kdc/kdc.conf[kdcdefaults]v4_mode=nopreauthkdc_tcp_por

5、ts=88[realms]EXAMPLE.COM={master_key_type=aes256-ctsacl_file=/var/kerberos/krb5kdc/kadm5.acldict_file=/usr/share/dict/wordsadmin_keytab=/var/kerberos/krb5kdc/kadm5.keytabsupported_enctypes=aes256-cts:normalaes128-cts:normaldes3-hmac-sha1:normalarcfour-hmac:normaldes-hmac-sha1:n

6、ormaldes-cbc-md5:normaldes-cbc-crc:normaldes-cbc-crc:v4des-cbc-crc:afs3}3)生成master服务器上的kdcdatabase[root@kerberos~]#kdb5_utilcreate-rEXAMPLE.COM-s将在/var/kerberos/krb5kdc/目录下生成多个文件，相关生成文件的说明为：4）master服务器上，添加admin用户[root@kerberos~]#kadmin.localKadmin.local:addprincadmin/admin@EXAM

7、PLE.com5)启动kdc服务和kadmin服务[root@kerberos~]#servicekrb5kdcstart[root@kerberos~]#servicekadminstart6）使用kinit命令，测试admin账户是否生成成功[root@kerberos~]#kinitadmin/admin@EXAMPLE.COM7)安装slaveKDC的相关配置（7-1）创建hostkeytab文件在master服务器上[root@kerberos~]#kadminkadmin:addprinc-randkeyhost/kerberos.exa

8、mple.com#添加principalkadmin：ktaddhost/kerberos.example.