Using PAM and Kerberos to Serve Up Authentication 201

You must click the Start icon after checking each box. If you check all three and then click Start, Fedora starts only the last service you checked.

As each service starts, a dialog opens confirming that the service started successfully. Click OK (in the pop-up) and start the next service.

5. When all three services have been started, click the Save button (in the toolbar) and close the Service Configuration window.

Your KDC should be up and running and ready to distribute tickets. Don’t forget that you need to add each user (or program) that requests authentication to the KDC database.

Jump ahead to the section “Adding users to the Key Distribution Center” for details about adding principals to the KDC database.

Setting up automatic ticket management with Kerberos and PAM

After you’ve synched your clocks, tested your DNS, and established the Key Distribution Center (KDC) on your network (all explained in earlier sections), you’re ready to configure your workstation so that PAM manages your Kerberos login session tickets.

To set up Kerberos authentication, you need two pieces of information:

The workgroup name of the computers that trust authentication from your KDC (the Kerberos realm)

The name of the computer that is acting as your KDC

Follow these steps to enable Kerberos authentication:

1. Open the Main Menu and choose System Settings Authentication.

A dialog opens, prompting you for the root password.

2. Enter the root password and click OK.

The Authentication Configuration window opens.

3. Click the Authentication tab.

4. Check the Enable Kerberos Support box.

5. Click Configure Kerberos.

The Kerberos Settings dialog opens, as shown in Figure 29-6.

• Figure 29-6: The Kerberos Settings dialog.

Fill in the dialog with the information about your Kerberos realm.

6. Enter the Realm name in the Realm field.

7. Enter the KDC name in the KDCs field, followed by a colon and the port number 88.

computername:88

8. Enter the KDC name in the Admin Servers field, followed by a colon and the port number 749.

computername:749

9. Click OK to close the dialog and save the settings.

10. Click OK to close the Authentication

Configuration window.

202 Technique 29: Securing a Large Network with Custom Authentication

Now, each time you log in to your workstation, PAM automatically obtains a Kerberos ticket for you. The Kerberos infrastructure quietly passes that ticket from server to server as you move around your network — the ticket proves that you are who you claim to be.

Adding users to the Key Distribution Center

The KDC doesn’t hand out any session tickets unless it recognizes the user. Users must verify their identities to the KDC with a password. Only when they’re recognized are they issued a ticket.

To the KDC, the user is known as a principal. A principal can be a host, a user, or a program. A principal is anyone who trusts the KDC. If a program needs to honor tickets across the network, it must be defined as a principal.

After you follow the steps in the preceding four sections, you’re ready to add a principal to the KDC:

1. Log in to the KDC (as user root):

#ssh root@kdcname

2.Enter the following command:

#kadmin.local -q “addprinc username”

3.When prompted, enter the login password for the new principal.

4. When prompted, reenter the password.

The creation of the new principal is confirmed with a message.

5. Repeat Steps 2 through 4 to create more principals (users) and then log out of the KDC when you’re finished.

At this point, you have two passwords: the old login password and the new Kerberos password. If you give the old password when you log in, PAM doesn’t get a chance to do its work, and you won’t be granted a Kerberos ticket. If you give the new password, PAM obtains a ticket for you.

If you can successfully log in with the new (Kerberos) password, you know that the Kerberos and PAM setup is working. After you know things are running okay, you can remove the old login password.

To remove the old login, open the terminal window and give yourself superuser privileges with the su command. Then execute the following command:

# passwd -l username

Locking password for username. passwd: Success

After executing this command, only the new Kerberos password will work for logins.

30	Customizing
	Authentication
Technique	with PAM

Save Time By

Understanding the PAM configuration files

Building your own authentication rules

Searching the Web for PAM modules

Skipping the root password if you dare

Suppose that you’ve written the world’s spiffiest database program. You install it at a few sites, and your users love it. Now, you sell your database to a bank that uses a smart card to identify each user. You

have to modify your database to handle smart card authentication. A few months later, you run into a customer that wants to use a retinal scanner to protect access to his data. Again, you have to modify your database to handle retinal scanners. Next, someone wants to use voice authentication. More changes.

In this technique, we introduce you to PAM, which stands for Pluggable Authentication Modules (or methods). Flexible, well-rounded, and everexpandable, PAM is a great system resource to get to know. It was designed to hide authentication methods from an application. If you modify your database to interact with PAM, you don’t have to change your code just because an administrator wants to try out a fancy new authentication tool. With PAM, you can

Create complex login procedures (two or three passwords, challenge/response mechanisms, and so on).

Use high-tech methods like biometric scans to authenticate users.

You obviously need extra hardware to use mechanical authentication methods, but if the data is valuable enough to justify the cost of the protection, PAM can help manage the technology.

Avoid entering the root password when you need superuser privi-

leges. With just a few quick file changes, you’ll save time whenever you need to su (as well as when you need to use the Linux configuration tools). We don’t recommend using PAM to circumvent root for everyone, but if you’re working on a system that doesn’t need to have tight security, it can make administrative or system tasks a breeze.

This technique shows you how. If you’re interested in setting up a Linux host in a Windows domain network or if you want to use Kerberos to authenticate your users, take a peek at Technique 29 as well.