Next: NFS Server 架設 Up: Network File System, NFS Previous: NFS 簡介 Contents DYWANG_HOME
[root@kvm5 ~]# vim /etc/hosts [root@kvm5 ~]# tail -2 /etc/hosts 192.168.122.5 kvm5.deyu.wang 192.168.122.7 kvm7.deyu.wang
[root@kvm5 ~]# yum install -y krb5-server krb5-workstation pam_krb5
master_key_type = aes256-cts，並在章節 [realms] 貼上 default_principal_flags = +preauth。
[root@kvm5 ~]# vim /var/kerberos/krb5kdc/kdc.conf
[root@kvm5 ~]# sed -i 's/EXAMPLE.COM/DEYU.WANG/g' /var/kerberos/krb5kdc/kdc.conf
[root@kvm5 ~]# sed -i 's/#//g' /var/kerberos/krb5kdc/kdc.conf
[root@kvm5 ~]# sed -i 's/\(^\[realms\]$\)/\1\n default_principal_flags = \+preauth/g' \
/var/kerberos/krb5kdc/kdc.conf
[root@kvm5 ~]# grep 'DEYU' -A3 -B2 /var/kerberos/krb5kdc/kdc.conf
[realms]
default_principal_flags = +preauth
DEYU.WANG = {
master_key_type = aes256-cts
acl_file = /var/kerberos/krb5kdc/kadm5.acl
dict_file = /usr/share/dict/words
[root@kvm5 ~]# vim /etc/krb5.conf
[root@kvm5 ~]# sed -i 's/EXAMPLE.COM/DEYU.WANG/g' /etc/krb5.conf
[root@kvm5 ~]# sed -i 's/#//g' /etc/krb5.conf
[root@kvm5 ~]# sed -i 's/example.com/deyu.wang/g' /etc/krb5.conf
[root@kvm5 ~]# sed -i 's/kerberos\(.deyu.wang\)/kvm5\1/g' /etc/krb5.conf
[root@kvm5 ~]# cat /etc/krb5.conf
[logging]
default = FILE:/var/log/krb5libs.log
kdc = FILE:/var/log/krb5kdc.log
admin_server = FILE:/var/log/kadmind.log
[libdefaults]
dns_lookup_realm = false
ticket_lifetime = 24h
renew_lifetime = 7d
forwardable = true
rdns = false
default_realm = DEYU.WANG
default_ccache_name = KEYRING:persistent:%{uid}
[realms]
DEYU.WANG = {
kdc = kvm5.deyu.wang
admin_server = kvm5.deyu.wang
}
[domain_realm]
.deyu.wang = DEYU.WANG
deyu.wang = DEYU.WANG
[root@kvm5 ~]# vim /var/kerberos/krb5kdc/kadm5.acl [root@kvm5 ~]# sed -i 's/EXAMPLE.COM/DEYU.WANG/g' /var/kerberos/krb5kdc/kadm5.acl [root@kvm5 ~]# cat /var/kerberos/krb5kdc/kadm5.acl */admin@DEYU.WANG *
[root@kvm5 ~]# kdb5_util destroy -f ** Database '/var/kerberos/krb5kdc/principal' destroyed.
[root@kvm5 ~]# kadmin.local -q 'delete_principal -force nfs/kvm5.deyu.wang@DEYU.WANG' [root@kvm5 ~]# kadmin.local -q 'delete_principal -force nfs/kvm7.deyu.wang@DEYU.WANG' [root@kvm5 ~]# kadmin.local -q 'ktremove -k /etc/krb5.keytab nfs/kvm5.deyu.wang@DEYU.WANG' [root@kvm5 ~]# kadmin.local -q 'ktremove -k /etc/kvm7.keytab nfs/kvm7.deyu.wang@DEYU.WANG'
Ctrl+c 中斷。
[root@kvm5 ~]# kdb5_util create -s -r DEYU.WANG Loading random data ^C
[root@kvm5 ~]# mv /dev/random /dev/xrandom [root@kvm5 ~]# ln -s /dev/urandom /dev/random [root@kvm5 ~]# ll /dev/urandom /dev/random lrwxrwxrwx. 1 root root 12 Aug 9 20:59 /dev/random -> /dev/urandom crw-rw-rw-. 1 root root 1, 9 Aug 9 07:37 /dev/urandom
[root@kvm5 ~]# kdb5_util create -s -r DEYU.WANG Loading random data Initializing database '/var/kerberos/krb5kdc/principal' for realm 'DEYU.WANG', master key name 'K/M@DEYU.WANG' You will be prompted for the database Master Password. It is important that you NOT FORGET this password. Enter KDC database master key: Re-enter KDC database master key to verify:
[root@kvm5 ~]# systemctl enable krb5kdc.service kadmin.service
[root@kvm5 ~]# systemctl start krb5kdc.service kadmin.service
[root@kvm5 ~]# kadmin.local Authenticating as principal root/admin@DEYU.WANG with password. kadmin.local:
kadmin.local: addprinc root/admin WARNING: no policy specified for root/admin@DEYU.WANG; defaulting to no policy Enter password for principal "root/admin@DEYU.WANG": Re-enter password for principal "root/admin@DEYU.WANG": Principal "root/admin@DEYU.WANG" created.
[root@kvm5 ~]# kadmin.local -q "addprinc -pw 123qwe nfs/kvm5.deyu.wang" Authenticating as principal nfs/admin@DEYU.WANG with password. WARNING: no policy specified for nfs/kvm5.deyu.wang@DEYU.WANG; defaulting to no policy Principal "nfs/kvm5.deyu.wang@DEYU.WANG" created.
[root@kvm5 ~]# kadmin.local -q "addprinc -pw 123qwe nfs/kvm7.deyu.wang" Authenticating as principal nfs/admin@DEYU.WANG with password. WARNING: no policy specified for nfs/kvm7.deyu.wang@DEYU.WANG; defaulting to no policy Principal "nfs/kvm7.deyu.wang@DEYU.WANG" created.
[root@kvm5 ~]# kadmin.local -q 'ktadd -k /etc/kvm5.keytab nfs/kvm5.deyu.wang@DEYU.WANG' Authenticating as principal nfs/admin@DEYU.WANG with password. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type camellia256-cts-cmac added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type camellia128-cts-cmac added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/kvm5.keytab. Entry for principal nfs/kvm5.deyu.wang@DEYU.WANG with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/etc/kvm5.keytab.
[root@kvm5 ~]# kadmin.local -q 'ktadd -k /etc/kvm7.keytab nfs/kvm7.deyu.wang@DEYU.WANG' Authenticating as principal nfs/admin@DEYU.WANG with password. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type arcfour-hmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type camellia256-cts-cmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type camellia128-cts-cmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal nfs/kvm7.deyu.wang@DEYU.WANG with kvno 2, encryption type des-cbc-md5 added to keytab WRFILE:/etc/kvm7.keytab.
[root@kvm5 ~]# klist -kte /etc/kvm5.keytab Keytab name: FILE:/etc/kvm5.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (aes256-cts-hmac-sha1-96) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (aes128-cts-hmac-sha1-96) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (des3-cbc-sha1) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (arcfour-hmac) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (camellia256-cts-cmac) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (camellia128-cts-cmac) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (des-hmac-sha1) 2 12/04/2015 21:04:28 nfs/kvm5.deyu.wang@DEYU.WANG (des-cbc-md5)
[root@kvm5 ~]# klist -kte /etc/kvm7.keytab Keytab name: FILE:/etc/kvm7.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (aes256-cts-hmac-sha1-96) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (aes128-cts-hmac-sha1-96) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (des3-cbc-sha1) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (arcfour-hmac) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (camellia256-cts-cmac) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (camellia128-cts-cmac) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (des-hmac-sha1) 2 12/04/2015 21:04:31 nfs/kvm7.deyu.wang@DEYU.WANG (des-cbc-md5)
[root@kvm5 ~]# ll /etc/krb5.keytab -rw-------. 1 root root 562 Sep 4 11:56 /etc/krb5.keytab
[root@kvm5 ~]# kadmin.local -q "addprinc -pw 123qwe deyu3@DEYU.WANG" Authenticating as principal nfs/admin@DEYU.WANG with password. WARNING: no policy specified for deyu3@DEYU.WANG; defaulting to no policy Principal "deyu3@DEYU.WANG" created.
[root@kvm5 ~]# kadmin.local -q 'ktadd -k /etc/kvm7.keytab deyu3@DEYU.WANG'Authenticating as principal nfs/admin@DEYU.WANG with password. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type aes256-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type aes128-cts-hmac-sha1-96 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type des3-cbc-sha1 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type arcfour-hmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type camellia256-cts-cmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type camellia128-cts-cmac added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type des-hmac-sha1 added to keytab WRFILE:/etc/kvm7.keytab. Entry for principal deyu3@DEYU.WANG with kvno 3, encryption type des-cbc-md5 added to keytab WRFILE:/etc/kvm7.keytab.
[root@kvm5 ~]# klist -kte /etc/kvm7.keytab Keytab name: FILE:/etc/kvm7.keytab KVNO Timestamp Principal ---- ------------------- ------------------------------------------------------ 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (aes256-cts-hmac-sha1-96) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (aes128-cts-hmac-sha1-96) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (des3-cbc-sha1) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (arcfour-hmac) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (camellia256-cts-cmac) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (camellia128-cts-cmac) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (des-hmac-sha1) 2 12/14/2015 11:54:09 nfs/kvm7.deyu.wang@DEYU.WANG (des-cbc-md5) 3 12/14/2015 19:30:37 deyu3@DEYU.WANG (aes256-cts-hmac-sha1-96) 3 12/14/2015 19:30:37 deyu3@DEYU.WANG (aes128-cts-hmac-sha1-96) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (des3-cbc-sha1) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (arcfour-hmac) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (camellia256-cts-cmac) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (camellia128-cts-cmac) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (des-hmac-sha1) 3 12/14/2015 19:30:38 deyu3@DEYU.WANG (des-cbc-md5)
[root@kvm5 ~]# ll /var/kerberos/krb5kdc/ total 32 -rw-------. 1 root root 20 Aug 30 20:06 kadm5.acl -rw-------. 1 root root 484 Aug 30 20:06 kdc.conf -rw-------. 1 root root 16384 Aug 30 20:06 principal -rw-------. 1 root root 8192 Aug 30 20:06 principal.kadm5 -rw-------. 1 root root 0 Aug 30 20:06 principal.kadm5.lock -rw-------. 1 root root 0 Aug 30 20:06 principal.ok
DYWANG_HOME