DevOps | Cloud | Analytics | Open Source | Programming





How To Install & Configure Kerberos Server & Client in Linux ?


In this post , we will explore How To Install & Configure Kerberos Server & Client in Linux. Kerberos is an Open sourced Authentication System developed in MIT. Many Big Data Systems use Kerberos in Network Security for server to server communications.

It works on a Ticket based system to reduce the chances of password sniffing or password stealing. Let’s see how we can install , set-up and configure Kereros in a Cluster. We will install Kerberos Server in one machine. And Kerberos client in rest of the machines.  

Step 1 – Install Kerberos Client

We need to install Kerberos Client On all the Nodes or machines in the Cluster


$ yum install krb5-workstation krb5-libs krb5-auth-dialog
 

Step2 – Install Kerberos Server

Kerberos Server can be installed in Master Node . But that is not a strict rule. Alternatively it can be installed in any server within the Cluster.


$ yum install krb5-server
 

Step 3 - Configure Kerberos

As part of the configuration , we will need to make changes to two files -

3.1 kdc.conf Changes:

$ vi /var/kerberos/krb5kdc/kdc.conf In the highlighted, use your own Realm name. For our example - we choose Realm name as TESTREALM.LOCAL


{
           **\[kdcdefaults\]**
               kdc\_ports = 88
               kdc\_tcp\_ports = 88
           **\[realms\]**
               **TESTREALM.LOCAL**\= {
               #master\_key\_type = aes256-cts
               acl\_file = /var/kerberos/krb5kdc/kadm5.acl
               dict\_file = /usr/share/dict/words
               admin\_keytab = /var/kerberos/krb5kdc/kadm5.keytab
supported\_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal
       }
 

3.2 krb5.conf Changes:

$ vi /etc/krb5.conf The values to be changed are marked 1,2 ,3 & 4 (see below). 1,2 are self-explanatory 3, 4 tells which machines are part of our Realm . e.g any machine with hostname g1.testdomain.local , abc.testdomain.local , gk.testdomain.local as well testdomain.local is mapped to TESTREALM.LOCAL.


\# {

     \[logging\]
         default \= FILE:/var/log/krb5libs.log 
         kdc \= FILE:/var/log/krb5libs.log
         admin\_server \= FILE:/var/log/kadmind.log

     \[libdefaults\]
          default\_realm \= **TESTREALM.LOCAL**
          dns\_lookup\_realm \= false
          dns\_lookup\_kdc \= false
          ticket\_lifetime \= 24h
          renew\_lifetime \= 7d
          forwardable \= true 

     \[realms\]
           TESTREALM.LOCAL\= {
            **kdc = **<K**DC-IPaddress> (USE KDC Server IP eg:10.39.252.9)  <-----1**
           ** admin\_server = **<**KDC-hostname> (eg:myserver-104.bdlocal)** **<------ 2**
             }

     \[domain\_realm\]
           **.testdomain.local= TESTREALM.LOCAL**   **<-----3**
           **testdomain.local= TESTREALM.LOCAL**  **<-----4**

    }
 

Step 4 - Create Kerberos KDC Database:

In this step , we will create a KDC - Key Distribution Centre database. This database is used by the Kerberos server. So it is a crucial point in our installation steps.


$ kdb5 util create -r TESTREALM.LOCAL -s
It will ask for setting up a Master Password . Follow as asked and note down the password. This password is needed for any KDC database related activities like restart or any DB changes later etc.

Step 5 - ACL Changes:

$ vi /var/kerberos/krb5kdc/kadm5.acl Modify with your Realm name. In our case as , it is -


\*/admin@**TESTREALM.LOCAL**        \*

Step 6 - Add Admin for KDC:

Note this Step MUST BE Executed only in the KDC Server machine - NOT in any Kerberos client machines.


$ kadmin.local
This will bring you to kadmin.local prompt . In that prompt , use the highlighted command. Note you have to use your own Realm name.


kadmin.local: addprinc   root/[email protected]
To see list of all principals created -


kadmin.local : listprincs
 

Step 7 : Restart the Kerberos Admin & KDC Server:

Note these steps MUST be done in KDC Server machine. Restart KDC Server


$ service krb5kdc start
Restart KADMIN Server


$ service kadmin start
We are done with the Set-up . We will test it from Kerberos as well Client servers.

Testing 1: Test Kerberos from Server:

Test the Kerberos installation. Use the below command - Check if any Ticket exists


$ klist
If no tickets exist in the cache , create a new one


$ kinit root/admin
Check again if you have any ticket


$ klist
Hopefully now you can see tickets listed here. If you want to destroy any ticket , use


$ kdestroy
 

Testing 2 : Test Kerberos from Client machine:

In previous step , we tested Kerberos from Kerberos server itself. In this step , we will test Kerberos from the client machine. This step is important because in most cases you will use the client machines as a user. And if the user tries to access any services in the network , it will need Kerberos authentication. So let's try this .

1. Create a non-admin user:

So , we will use a non-admin user . Use below commands in KDC server to create a normal user (i.e. user with no admin access).


$ kadmin.local
In kadmin.local prompt use -


kadmin.local: addprinc [email protected]
so we have created a normal user testuser1.

2. Create a keytab file for the user :

We will create a keytab file for the user testuser1


$ kadmin.local
In kadmin.local prompt , use below


kadmin.local: xst -norandkey -k /tmp/testuser1.keytab [email protected]
It will create a keytab file testuser1.keytab in /tmp directory for the testuser1.

3. Test Kerberos from client machine  :

In previous step , we created the testuser1.keytab file in KDC SERVER machine. Copy the keytab file to the client machine. Lets place it in /usr/local/testuser1.keytab in client machine (You can place in any dir). Now in the client machine , open command prompt Create a kerberos ticket


$ kinit -kt /usr/local/testuser1.keytab [email protected]
Check if ticket created


$ klist
  I Hope you can see the Ticket created . This marks end to our post on Install Configure Kerberos Server Client Linux. Hope you find this post helpful.  

Additional Posts you might want to read from this Blogs-

     


kerberos installation ,kerberos installation ubuntu ,kerberos installation centos 7 ,kerberos installation linux ,kerberos installation windows ,kerberos install mac ,kerberos install debian ,kerberos setup linux ,setup configure kerberos ,install and configure kerberos centos ,install and configure kerberos in centos ,install and configure kerberos on ubuntu ,kerberos setup ,kerberos setup windows ,kerberos setup for kafka ,kerberos setup mac ,kerberos setup in hadoop ,kerberos setup cloudera ,kerberos setup windows server 2012 ,kerberos setup debian ,kerberos setup hortonworks ,kerberos configure ,kerberos configure spn ,kerberos configure linux ,configure kerberos client command ,configure kerberos authentication ,configure kerberos client ,configure kerberos authentication ubuntu ,configure kerberos constrained delegation ,configure kerberos on windows server 2016 ,configure kerberos authentication windows server 2016 , ,kerberos ,kerberos authentication ,kerberos authentication process ,kerberos meaning ,kerberos port ,kerberos keytab file ,kerberos client keytab file ,kerberos pronounce ,kerberos architecture ,kerberos pre-authentication failed , , ,install kerberos ,install kerberos ubuntu ,install kerberos centos 7 ,install kerberos windows ,install kerberos client ubuntu ,install kerberos linux ,install kerberos ubuntu 20.04 ,install kerberos centos 8 ,install kerberos mac ,install kerberos alpine ,install kerberos aix ,install kerberos ambari ,install kerberos ansible ,



install kerberos authentication ,install kerberos apt ,ipa-client-install kerberos authentication failed ,install kerberos client on aix ,brew install kerberos ,install kerberos client ,install kerberos client windows 10 ,install kerberos client centos 8 ,install kerberos client debian ,install kerberos client mac ,install kerberos client centos ,install kerberos debian ,install kerberos dockerfile ,setup kerberos delegation ,install kerberos ubuntu docker ,install kerberos.io on debian ,apt-get install kerberos docker ,debian install kerberos server ,debian install kerberos 5 ,pip install kerberos error ,pip install kerberos error windows ,npm install kerberos error ,python install kerberos error ,pip install pywinrm kerberos error ,pip install requests kerberos error ,pip3 install pywinrm kerberos error ,pip install kerberos gcc error ,install kerberos for ansible ,install kerberos fedora ,install kerberos for windows ,install kerberos freebsd ,setup kerberos for kafka ,setup kerberos file ,pip install kerberos fails ,install mit kerberos for windows ,pip install kerberos gcc ,npm install kerberos gssapi ,install kerberos hortonworks ,install kerberos hdp ,install kerberos hadoop ,install heimdal kerberos ,install kerberos on hadoop cluster ,install mit kerberos hortonworks ,kerberos setup hortonworks ,pip install hdfs kerberos ,install kerberos in ubuntu ,install kerberos in windows ,install kerberos.io ubuntu ,install kerberos in linux ,install kerberos in centos 7 ,install kerberos in mac ,install kerberos in python ,install kerberos client in linux ,install kerberos kali linux ,install kerberos kali ,install kerberos kinit ,install kerberos keytab ,install kerberos kdc ,set up kerberos keytab ,ubuntu install kerberos kdc ,pip install keystoneauth1 kerberos ,install kerberos linux client ,setup kerberos linux ,install python kerberos library ,install mit kerberos linux ,install kerberos oracle linux ,install kerberos suse linux ,install kerberos mac os x ,install kerberos mit ,install kerberos module ,install mit kerberos windows ,install mit kerberos client on windows ,install mit kerberos centos ,install kerberos on centos 7 ,install kerberos on windows ,install kerberos on ubuntu ,install kerberos on mac ,install kerberos on linux ,install kerberos on rhel ,install kerberos on debian ,install kerberos python ,install kerberos packages ubuntu ,install kerberos packages ,install pywinrm kerberos ,install python kerberos linux ,install requests kerberos python ,install kerberos using pip ,install kerberos rhel 8 ,install kerberos redhat 7 ,install kerberos raspbian ,install kerberos rhel ,install requests\_kerberos ,setup kerberos realm ,install kerberos client rhel ,kerberos setup rhel ,install kerberos server ,install kerberos server ubuntu ,install kerberos server windows ,install kerberos server centos 7 ,install kerberos server ubuntu 16.04 ,kerberos install steps ,install kerberos windows server 2016 ,install kerberos ticket ,install kerberos ubuntu 16.04 ,install kerberos unix ,install urllib2\_kerberos ,setup kerberos ubuntu ,install kerberos windows server ,install kerberos workstation ,install kerberos with npm ,setup kerberos windows server 2016 ,setup kerberos when starting mongodb ,setup kerberos windows 10 ,yum install kerberos ,yum install kerberos client ,install mit kerberos ubuntu ,



setup kerberos authentication ubuntu ,ubuntu 20.04 install kerberos client ,ubuntu 18.04 install kerberos client ,how to install kerberos ubuntu ,ubuntu install kerberos libraries ,linux ubuntu install kerberos ,install kerberos on ubuntu 16.04 ,installing kerberos on ubuntu server ,setup kerberos on ubuntu ,setup kerberos server ubuntu ,install kerberos client centos 7 ,setup kerberos authentication centos 7 ,how to install kerberos on centos 7 ,install krb5-config centos ,install kerberos client rhel 7 ,installing kerberos on centos 7 ,install krb5-libs centos 7 ,install kerberos client on centos 7 ,install kerberos client on centos ,how to install kerberos on centos 6 ,pip install kerberos centos ,install krb5-user centos 7 ,install krb5-workstation centos 7 ,install kerberos centos 6 ,setup kerberos windows server ,install mit kerberos windows 10 ,setup kerberos authentication windows server 2016 ,enable kerberos authentication windows 2016 ,setup kerberos authentication windows server 2012 ,setup kerberos authentication windows 10 ,enable kerberos authentication windows 10 ,enable kerberos authentication windows 2012 ,setup kerberos authentication windows server 2012 r2 ,enable kerberos authentication windows ,setup kerberos in windows ,enable kerberos logging windows server 2016 ,enable kerberos logging windows 10 ,enable kerberos logging windows server 2012 ,install kerberos on windows server ,installing kerberos on windows server 2016 ,setup kerberos on windows ,enable kerberos on windows server ,enable kerberos on windows 10 ,enable kerberos on windows ,setup kerberos on windows server 2016 ,pip install kerberos windows ,enable kerberos windows server 2016 ,enable kerberos windows server 2012 ,enable kerberos windows server 2008 r2 ,enable kerberos windows server ,how to install kerberos client on ubuntu ,install kerberos client in ubuntu ,install kerberos client on ubuntu ,how to install kerberos kdc server and client on ubuntu 18.04 ,install kerberos 5 linux ,setup kerberos authentication linux ,alpine linux install kerberos ,setup kerberos client linux , , , ,install and configure kerberos centos ,install and configure kerberos in centos ,install and configure kerberos on ubuntu ,setup configure kerberos authentication ,setup configure kerberos backup ,setup configure kerberos build ,setup configure kerberos database ,setup configure kerberos delegation ,setup configure kerberos ec2 ,setup configure kerberos email ,setup configure kerberos example ,setup configure kerberos gateway ,setup configure kerberos github ,setup configure kerberos gpu ,setup configure kerberos host ,setup configure kerberos in linux ,setup configure kerberos java ,setup configure kerberos jenkins ,setup configure kerberos jwt ,setup configure kerberos key ,setup configure kerberos keycloak ,setup configure kerberos kubernetes ,setup configure kerberos license ,setup configure kerberos linux ,setup configure kerberos login ,setup configure kerberos module ,setup configure kerberos monitor ,setup configure kerberos plugin ,setup configure kerberos query ,setup configure kerberos raspberry pi ,setup configure kerberos router ,setup configure kerberos script ,setup configure kerberos server ,setup configure kerberos service ,setup configure kerberos syntax ,setup configure kerberos ubuntu ,setup configure kerberos uipath ,setup configure kerberos user ,



setup configure kerberos version ,setup configure kerberos vm ,setup configure kerberos vmware ,setup configure kerberos vpn ,setup configure kerberos windows ,setup configure kerberos windows 10 ,setup configure kerberos xcode ,setup configure kerberos xml ,setup configure kerberos yaml ,setup configure kerberos yum ,setup configure kerberos zendesk ,setup configure kerberos zerodha ,setup configure kerberos zimbra ,setup configure kerberos zip ,install mit kerberos for windows ,install mit kerberos hortonworks ,install mit kerberos linux ,install mit kerberos ubuntu ,install mit kerberos windows ,install mit kerberos windows 10 ,install python kerberos library ,install python kerberos linux ,install pywinrm kerberos ,install requests kerberos python ,install requests\_kerberos ,install urllib2\_kerberos ,ipa-client-install kerberos authentication failed ,kafka kerberos install ,kali install kerberos ,kerberos configuration manager install location ,kerberos configuration manager install path ,kerberos easy install ,kerberos install steps ,kerberos node js install ,kerberos setup fedora ,kerberos setup hortonworks ,kerberos setup rhel ,linux install kerberos ,linux install kerberos client ,linux ubuntu install kerberos ,mac install kerberos ,mac install kerberos client ,mit install kerberos ,npm install kerberos ,npm install kerberos error ,npm install kerberos gssapi ,opensuse install kerberos ,pip install hdfs kerberos ,pip install kerberos ,pip install kerberos centos ,pip install kerberos error ,pip install kerberos error windows ,pip install kerberos failed ,pip install kerberos fails ,pip install kerberos gcc ,pip install kerberos gcc error ,pip install kerberos krb5-config not found ,pip install kerberos windows ,pip install keystoneauth1 kerberos ,pip install pywinrm kerberos error ,pip install requests kerberos error ,pip install requests\_kerberos ,pip install snakebite kerberos ,pip3 install kerberos ,pip3 install pywinrm kerberos ,pip3 install pywinrm kerberos error ,please install mit kerberos devel package ,python install kerberos error ,redhat 8 install kerberos ,redhat install kerberos ,requests-kerberos install failed ,rhel 7 install kerberos ,rhel 8 install kerberos ,rhel install kerberos client ,running setup.py install for kerberos ... error ,samba install kerberos ,set up kerberos keytab ,setup kerberos delegation ,setup kerberos file ,setup kerberos for kafka ,setup kerberos linux ,setup kerberos realm ,setup kerberos ubuntu ,setup kerberos when starting mongodb ,setup kerberos windows 10 ,setup kerberos windows server ,setup kerberos windows server 2016 ,steps to install kerberos ,suse install kerberos ,ubuntu 18 install kerberos ,ubuntu 18.04 install kerberos client ,ubuntu 20.04 install kerberos ,ubuntu 20.04 install kerberos client ,ubuntu install kerberos ,ubuntu install kerberos kdc ,ubuntu install kerberos libraries ,unable to install kerberos ,windows install kerberos ,windows install kerberos client ,windows server 2016 install kerberos ,windows server install kerberos ,wsl install kerberos ,yum install kerberos ,yum install kerberos client ,yum install python-kerberos ,yum install pywinrm kerberos ,yum install requests-kerberos