forked from linux/documentation
32 lines
1.2 KiB
Markdown
32 lines
1.2 KiB
Markdown
# Additional Kerberos Aliases and Services
|
|
|
|
It is possible to extend the system keytab `/etc/krb5.keytab` with additional aliases and services.
|
|
|
|
## Additional Kerberos Aliases
|
|
|
|
By default only the real hostname is known to the AD and the system keytab.
|
|
If a host is known in DNS with additional hostnames, then Kerberos does not work if these are used.
|
|
|
|
Below configuration will add the respective aliases to the AD and the system keytab:
|
|
|
|
```yaml
|
|
kerberos::aliases:
|
|
- 'login.psi.ch'
|
|
- 'llc.psi.ch'
|
|
```
|
|
Note that the short name without the domain part is automatically added.
|
|
|
|
|
|
## Additional Kerberos Services
|
|
|
|
Also additional Kerberos Services might be introduced with the Hiera key `kerberos::additional_services`:
|
|
|
|
```yaml
|
|
kerberos::additional_services:
|
|
- 'http'
|
|
```
|
|
|
|
By doing so, the respective service principal will be added to the AD and the system keytab (/etc/krb5.keytab). The service keytab should then be extracted from the system keytab and used for the respective service, e.g. Apache HTTPD.
|
|
|
|
The ownership and permissions of the extracted service keytab should be set appropriately to the user running the service to ensure security. Afterwards the service can be configured to use the extracted keytab for e.g. authentication.
|