Centralized Authentication with Kerberos 5, Part I

This tells you if you need to use special configure options for your site. /usr/local/ is the default installation directory. If you need this software in another directory, use a --prefix=/new/path/to/directory flag in the next step.

5) In almost all cases, the default should be fine:

% ./configure

6) Compile the package with:

% make

I had a problem with one file in the krb5-1.3.4/src/kadmin/testing/util directory, which can be safely ignored. Restart the compilation with % make -i in this case.

7) Check whether everything compiled correctly with:

% make check

8) If everything looks okay, install the package with:

% sudo make install

Never compile code as root. Use root privileges only when necessary, as in these installation steps.

9) You now have MIT Krb5 installed in /usr/local/. Some additional directories need to be created by hand and their permissions set:

% sudo mkdir -p /usr/local/var/krb5kdc
% sudo chown root /usr/local/var/krb5kdc
% sudo chmod 700 /usr/local/var/krb5kdc

If you really need or want to compile your own PAM module, here are the steps to get a working version of the module shipped by Red Hat. Get the source (see Resources) and upack it with:

% tar zxf pam_krb5-1.3-rc7.tar.gz

% cd pam_krb5-1.3-rc7

Your $PATH environment variable has to have the Kerberos distribution of your choice first, in case you have more than one distribution on your computer. For example:

% PATH=/usr/local/bin:$PATH

if you have installed your own version in /usr/local. Then execute:

% ./configure

Then compile and install the package with:

% make
% sudo make install

A Kerberos realm is an administrative domain that has its own Kerberos database. Each Kerberos realm has its own set of Kerberos servers. The name of your realm can be anything, but it should reflect your place in the DNS world. If the new Kerberos realm is for your entire DNS domain example.com, you should give the same name (with all capital letters, this is a Kerberos convention) to your Kerberos realm: EXAMPLE.COM. Or, if your are setting up a new realm for your engineering department in example.com, a realm name of ENG.EXAMPLE.COM could be chosen.

The first step for creating your own realm is to create a /etc/krb5.conf file that contains all the necessary information about this realm. The krb5.conf file needs to be on every computer that wants access to your new Kerberos realm. Here is an example file for the realm EXAMPLE.COM with the KDC and administration servers running on machine kdc.example.com:

[libdefaults]
    # determines your default realm name
    default_realm = EXAMPLE.COM

[realms]
    EXAMPLE.COM = {
        # specifies where the servers are and on
        # which ports they listen (88 and 749 are
        # the standard ports)
        kdc = kdc.example.com:88
        admin_server = kdc.example.com:749
    }

[domain_realm]
    # maps your DNS domain name to your Kerberos
    # realm name
    .example.com = EXAMPLE.COM

[logging]
    # determines where each service should write its
    # logging info
    kdc = SYSLOG:INFO:DAEMON
    admin_server = SYSLOG:INFO:DAEMON
    default = SYSLOG:INFO:DAEMON

The next file, /usr/local/var/krb5kdc/kdc.conf, configures the KDC server. It needs to be on only the computer running the KDC dæmon. Every entry has a reasonable default. Creating an empty file should be sufficient for most cases:

% sudo touch /usr/local/var/krb5kdc/kdc.conf

The following commands need to be executed on the computer that will become your KDC. The command:

% sudo /usr/local/sbin/kdb5_util create -s