Using PAM and Kerberos to Serve Up Authentication 197

Using PAM and Kerberos to Serve Up Authentication

If your local network doesn’t include a Windows domain controller, PAM can still streamline authentication and increase your network security using Kerberos. Kerberos is a security protocol that uses a trusted third party to verify authentication information. With PAM and Kerberos working together, you get a single, secure network-wide login system, which can save a lot of time.

This technique is best suited to large networks. You should have a domain in place and a DNS server up and running to take advantage of the benefits of using Kerberos with PAM for authentication.

With this setup, Kerberos makes the login more secure, and PAM makes ticket management automatic. Users first access a kerberized server, where they must prove their identity to the Key Distribution Center (KDC). Only after the verification can users obtain a ticket that represents their fully authenticated identity.

After users log in, they can log in to any machine running Kerberos authentication or use a kerberized server on a remote machine without manually obtaining a ticket for the session. That means you (or your users) log in once and can access any kerberized server on your network without proving your identity again for that login session.

Kerberos tickets expire over time, so at the end of an eight-hour day, the ticket can’t be reused by an intruder.

The process of setting up Kerberos to work with PAM has several phases. Here’s an overview of what you need to do:

1. Synchronize the system times.

2. Test the DNS.

3. Set up a KDC.

4. Set up PAM for automagic ticket management.

5. Add users to the KDC.

The following sections explain each step in more detail.

Establishing synchronized system times

For extra security, Kerberos tickets are time sensitive. Just like a real passport, your Kerberos ticket expires after some period of time (you have to prove your identity to the KDC every once in a while to prevent a nefarious hacker from using an old passport that you’ve left sitting around somewhere).

The time-sensitive nature of Kerberos tickets means that all your kerberized servers (and the KDC) must agree on the current date and time. If the time varies by just five minutes between a Kerberos client machine and the KDC, Kerberos will deny an otherwise valid ticket. To ensure a consistent time, start the NTP daemon and enable the Network Time Protocol on all the computers on your network. (The following steps show you how in just a few quick steps.)

The Network Time Protocol (NTP) visits a server located on the Internet and retrieves time updates. It synchronizes the clock on the local machine with the clock on the time server. Setting up the NTP daemon on all the machines on your network to synchronize their clocks with the same time server ensures a consistent time for Kerberos.

Before you enable the Network Time Protocol, you need to start the NTP daemon:

1. Open the Main menu and choose System Settings Server Settings Services

A dialog opens, prompting you for the root password.

2. Enter your root password and click OK.

The Service Configuration window opens, as shown in Figure 29-3.

198 Technique 29: Securing a Large Network with Custom Authentication

•Figure 29-3: The Service Configuration window.

3.Use the scroll bar in the left frame to scroll through the list of services until you find the entry for ntpd.

4.Check the box next to the ntpd entry and click the Start button (on the toolbar).

An Information dialog opens, telling you that the ntpd started successfully.

5.Click OK to close the dialog.

6.Click the Save button to save the changes to your services.

7.Close the Service Configuration window.

Now that the ntpd daemon is running, you’re ready to enable the Network Time Protocol. To synchronize your systems time, follow these steps:

1. Open the Main Menu and choose System Settings Date & Time.

A dialog opens, prompting you for the root password.

2. Enter the root password and click OK.

The Date/Time Properties window opens, as shown in Figure 29-4.

3. Check the Enable Network Time Protocol box.

The Server drop-down list becomes activated.

4. Use the Server drop-down list to choose a network time server, or add the name of your own network time server.

• Figure 29-4: The Date/Time Properties window.

The kind people at Red Hat provide two time servers for public use. We recommend using the same server to synchronize all the machines on your network.

Alternatively, if your entire network doesn’t have Internet access, you can set up a time server on one of your own computers and synchronize to it, but it’s a bit of work. For more information about establishing your own time server, visit www.ntp.org.

5. Click OK.

A confirmation screen verifies that the update is taking place, as shown in Figure 29-5. After some thought, your machine updates the time settings to synchronize with the server. When the update completes, the Date/Time Properties window closes.

• Figure 29-5: Confirmation of contact.

Using PAM and Kerberos to Serve Up Authentication 199

If you configure all your machines to synchronize to the same server, time won’t interfere with your Kerberos logins.

Testing your domain name server (DNS)

Kerberos makes extensive use of the DNS server. Before you set up Kerberos, it’s a good idea to be sure that all your computers are on a first name basis.

Every computer on your network can talk to any other computer just by knowing its IP address, but with Kerberos, your computers must know each other by name. The easiest way to verify that DNS is working is with a series of pings:

Use the Ctrl-C combination to stop pinging.

Setting up a Key Distribution Center

Kerberos can make authentication on a large network quick and easy. The centerpiece to Kerberos authentication is the trusted third party — the Key Distribution Center (KDC). All the other machines on your network look to the KDC for authentication services.

Time is crucial to using Kerberos successfully — the KDC and all the other Kerberos client and server machines must agree on the current time. Be sure that the NTP (Network Time Protocol) is up and running on all your computers. See the earlier section, “Establishing synchronized system times,” for details.

Ping the Key Distribution Center by name from You should also test your DNS, which we also explain

each potential client.

Ping each client machine by name from the Key Distribution Center.

Each potential client should ping any other potential client (by name) that it will access.

Just in case you’re not familiar with pinging, a ping is like a handshake across the network. To ping a machine, open the terminal window and enter the following command:

$ ping machinename

Your machine sends a note to the other machine telling it to send back a packet of data. If the DNS service is working properly, you start getting a stream of replies that looks something like this:

earlier in “Testing your domain name server (DNS).”

Here’s how to set up a Key Distribution Center:

1. Log in to the computer that you want to use as the KDC.

You can do this at the console, or by using SSH to log in over the network.

2. Open a terminal window and give yourself superuser privileges with the su command.

3. Insert and mount the Fedora distribution disc.

4. Move to the directory containing the RPM packages (/mnt/cdrom/Fedora/RPMS) and use the following commands to install the Kerberos packages:

# rpm -Uhv krb5-libs-1.3.1-6.i386.rpm

$ ping bastille

PING bastille (192.168.0.28): 56 data bytes

64 bytes from 192.168.0.28: icmp_seq=0 ttl=64 time=34.893 ms

64 bytes from 192.168.0.28: icmp_seq=1 ttl=64 time=2.918 ms

--- bastille ping statistics ---

2 packets transmitted, 2 packets received,

0% packet loss

round-trip min/avg/max = 2.918/18.905/ 34.893 ms

#rpm -Uhv krb5-server-1.3-1.6.i386.rpm

#rpm -Uhv krb5-workstation-

1.3-1.6.i386.rpm

5. To begin creating a script that will automatically update a few of the configuration files that the KDC needs to operate, open your favorite editor and create a file named /tmp/ fixrealm:

# kedit /tmp/fixrealm

200 Technique 29: Securing a Large Network with Custom Authentication

You can make all these changes manually, but to save a bit of time, we’ve added a quick script to update the configuration files. This tool works only if your DNS server is running and you have a domain in place.

6. Add the following code to /tmp/fixrealm:

#!/bin/bash

OLDDOMAIN=example.com

OLDREALM=EXAMPLE.COM

OLDKDC=kerberos.example.com

NEWDOMAIN=$(dnsdomainname) NEWREALM=$(echo $NEWDOMAIN | tr

“[:lower:]” “[:upper:]”) NEWKDC=$(hostname)

function fixup()

{

cp $1 $1.orig

echo “Fixing $1 (original saved in $1.orig)”

sed s/$OLDREALM/$NEWREALM/ $1.orig | sed s/$OLDDOMAIN/$NEWDOMAIN/ |

sed s/$OLDKDC/$NEWKDC/ > $1

}

fixup /etc/krb5.conf

fixup /var/kerberos/krb5kdc/kdc.conf fixup /var/kerberos/krb5kdc/kadm5.acl

7. Save the file and close the editor.

Double-check your typing before you save the code. (We managed to wipe out our Kerberos configuration files with just a few typos.)

8. Make the script executable with the following command:

#chmod a+x /tmp/fixrealm

9.Run the script with the following command:

#/tmp/fixrealm

The script saves a copy of the originals and updates the working configuration files by using default values it finds on your network. fixrealm shows you its progress as it works.

10. Create the KDC database with the following command:

# kdb5_util create -s

You’re prompted for the KDC database masterkey.

11. Type a password and press Enter.

You’re prompted for the KDC database masterkey again to verify the entry.

12. Retype the password and press Enter.

Don’t forget this password. It’s important!

13. Add your own user name to the KDC database with the following command:

# kadmin.local -q “addprinc username”

14. Enter the password that you want to use when you log in.

15. Reenter your password when prompted.

The creation of your user account is verified by Kerberos.

Now, you need to start the KDC with the Service Configuration tool. To start the KDC services, follow these steps:

1. Open the Main Menu and choose System Settings Server Settings Services.

A dialog opens prompting you for the root password.

2. Enter the root password and click OK.

3. Use the scroll bar to find the following services:

krb524

krb5kdc

kadmin

4. One service at a time, check the box next to the service and click the Start icon.