Specific process of configuring Kerberos for the telnet service (1)

In some service settings, we usually use other environments to complete some operations. For example, we will talk about configuring Kerberos for the telnet service. In the Kerberos environment, each Kerberos service is represented by a service entity. This service subject is only a common Kerberos subject and holds the key used to decrypt the response sent by the Kerberos server. This is also true for the telnet service. You need to create the telnet service principal on the telnet server and perform some configuration steps. Perform the following steps to configure Kerberos for the telnet service.

If you have used the AIX 'mkkrb5clnt 'command to configure the Kerberos client, you do not need to perform steps 1 and 2. Run the 'mkkrb5clnt 'command to create and store the host service principal in the/var/krb5/security/keytab/

On the computer running the telnet service (fsaix005.in.ibm.com), create a telnet service subject named "host/<FQDN_telnetd_hostname>. In this example, it will be "host/fsaix005.in.ibm.com ".

Using the Fully Qualified Domain Name, FQDN) is critical to the normal operation of this setting.

 
 

  
  
bash-2.05b# hostname  
  
  
fsaix005.in.ibm.com  
  
  
bash-2.05b# kadmin -p admin/admin  
  
  
Authenticating as principal admin/admin with password.  
  
  
Password for admin/admin@ISL.IN.IBM.COM:  
  
  
kadmin:  addprinc -randkey host/fsaix005.in.ibm.com  
  
  
WARNING: no policy specified for host/fsaix005.in.ibm.com@ISL.IN.IBM.COM;  
  
  
defaulting to no policy. Note that policy may be overridden by  
  
  
ACL restrictions.  
  
  
Principal "host/fsaix005.in.ibm.com@ISL.IN.IBM.COM" created. 
 
 

Add the telnet service principal to the keytab file (/etc/krb5/krb5.keytab.

 
 

  
  
kadmin:  ktadd host/fsaix005.in.ibm.com  
  
  
Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type Triple DES  
  
  
cbc  
  
  
mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab.  
  
  
Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type ArcFour  
  
  
with  
  
  
HMAC/md5 added to keytab WRFILE:/etc/krb5/krb5.keytab.  
  
  
Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type AES-256  
  
  
CTS  mode  
  
  
with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.  
  
  
Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type DES cbc  
  
  
mode  
  
  
with RSA-MD5 added to keytab WRFILE:/etc/krb5/krb5.keytab.  
  
  
Entry for principal host/fsaix005.in.ibm.com with kvno 3, encryption type AES-128  
  
  
CTS mode  
  
  
with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.  
  
  
kadmin:  q  
  
  
bash-2.05b# 
 
 

If "kadmin" cannot be run for some reason, create a service principal on KDC and add it to the keytab file (/etc/krb5/krb5.keytab, the keytab file is then transmitted to the computer running telnetd. For this example, It is fsaix005.in.ibm.com.

Run '/usr/krb5/bin/klist-k' on the computer running the telnet service (fsaix005.in.ibm.com) and check the entries.

 
 

  
  
bash-2.05b# hostname  
  
  
fsaix005.in.ibm.com  
  
  
bash-2.05b# /usr/krb5/bin/klist -k  
  
  
Keytab name:  FILE:/etc/krb5/krb5.keytab  
  
  
KVNO Principal  
  
  
---- ---------  
  
  
3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM  
  
  
3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM  
  
  
3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM  
  
  
3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM  
  
  
3 host/fsaix005.in.ibm.com@ISL.IN.IBM.COM  
  
  
bash-2.05b# 
 
 

On the computer running the telnet service (fsaix005.in.ibm.com), create a new user "vipin" and you will use this user to remotely log on to fsaix005. Change the password of the user.

 
 

  
  
bash-2.05b# hostname  
  
  
fsaix005.in.ibm.com  
  
  
bash-2.05b# mkuser -R files vipin  
  
  
bash-2.05b# passwd vipin  
  
  
Changing password for "vipin"  
  
  
vipin's New password:  
  
  
Enter the new password again:  
  
  
bash-2.05b# 
 
 

Create a Kerberos principal with the same name "vipin. You can perform this operation on any computer master KDC or client in the Kerberos field.