Page History

root@ubuntu:/etc/samba# apt-get install krb5-user krb5-admin-server krb5-kdc

Am Ende der Installation der Kerberos-Pakete wird versucht die Dienste "krb5-kdc" und "krb5-admin-server" zu starten.
Dies schlägt erstmal fehl. Das kann aber ignoriert werden!!

---------------

krb5-kdc (1.12+dfsg-2ubuntu5.2) wird eingerichtet ...
 * Starting Kerberos KDC krb5kdc                                                                                                                  
krb5kdc: cannot initialize realm ubuntu.fritz.box - see log file for details

                                                                                                                                            [fail]

Trigger für ureadahead (0.100.0-16) werden verarbeitet ...
krb5-admin-server (1.12+dfsg-2ubuntu5.2) wird eingerichtet ...
 * Starting Kerberos administrative servers kadmind                                                                                               
kadmind: Datei oder Verzeichnis nicht gefunden while initializing, aborting

                                                                                                                                            [fail]
Trigger für libc-bin (2.19-0ubuntu6.6) werden verarbeitet ...
Trigger für ureadahead (0.100.0-16) werden verarbeitet ...
root@ubuntu:~#

#Server neu starten
init 6

root@ubuntu:~# krb5_newrealm
This script should be run on the master KDC/admin server to initialize
a Kerberos realm.  It will ask you to type in a master key password.
This password will be used to generate a key that is stored in
/etc/krb5kdc/stash.  You should try to remember this password, but it
is much more important that it be a strong password than that it be
remembered.  However, if you lose the password and /etc/krb5kdc/stash,
you cannot decrypt your Kerberos database.
Loading random data

Initializing database '/var/lib/krb5kdc/principal' for realm 'ubuntu.fritz.box',
master key name 'K/M@ubuntu.fritz.box'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key: 
Re-enter KDC database master key to verify: 
 * Starting Kerberos KDC krb5kdc                                                                                                            [ OK ] 
 * Starting Kerberos administrative servers kadmind                                                                                         [ OK ] 

Now that your realm is set up you may wish to create an administrative
principal using the addprinc subcommand of the kadmin.local program.
Then, this principal can be added to /etc/krb5kdc/kadm5.acl so that
you can use the kadmin program on other computers.  Kerberos admin
principals usually belong to a single user and end in /admin.  For
example, if jruser is a Kerberos administrator, then in addition to
the normal jruser principal, a jruser/admin principal should be
created.

Don't forget to set up DNS information so your clients can find your
KDC and admin servers.  Doing so is documented in the administration
guide.
root@ubuntu:~#

#vorhandenen Nameserver anzeigen
root@ubuntu:~# cat /etc/resolv.conf 
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 192.168.101.1
search fritz.box
root@ubuntu:~#
 
#neuen Nameserver setzen auf den eigenen Server (localhost)
#Damit wird der von Samba bereitgestellte Nameservice genutzt. 
root@ubuntu:~# echo nameserver 127.0.0.1|resolvconf -a eth0
root@ubuntu:~# cat /etc/resolv.conf 
# Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8)
#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
nameserver 127.0.0.1
search fritz.box
root@ubuntu:~#

root@ubuntu:/etc/samba# kadmin.local
Authenticating as principal root/admin@ubuntu.fritz.box with password.
kadmin.local:  addprinc Administrator
WARNING: no policy specified for Administrator@ubuntu.fritz.box; defaulting to no policy
Enter password for principal "Administrator@ubuntu.fritz.box": 
Re-enter password for principal "Administrator@ubuntu.fritz.box": 
Principal "Administrator@ubuntu.fritz.box" created.
kadmin.local:  exit
root@ubuntu:/etc/samba#

Administrator/admin *

root@ubuntu:/etc/samba# service krb5-admin-server restart
 * Restarting Kerberos administrative servers kadmind                                                           [ OK ] 
root@ubuntu:/etc/samba#

root@ubuntu:~# kinit Administrator
Password for Administrator@ubuntu.fritz.box: 
root@ubuntu:~# klist
Ticket cache: FILE:/tmp/krb5cc_0
Default principal: Administrator@ubuntu.fritz.box

Valid starting       Expires              Service principal
17.01.2016 20:04:13  18.01.2016 06:04:13  krbtgt/ubuntu.fritz.box@ubuntu.fritz.box
	renew until 18.01.2016 20:04:07
root@ubuntu:~#

root@ubuntu:~# service krb5-admin-server stop
 * Stopping Kerberos administrative servers kadmind                                                                                         [ OK ] 
root@ubuntu:~# service krb5-kdc stop
 * Stopping Kerberos KDC krb5kdc                                                                                                                   
root@ubuntu:~# service samba-ad-dc status
samba-ad-dc stop/waiting
root@ubuntu:~# service samba-ad-dc start
samba-ad-dc start/running, process 3489
root@ubuntu:~# service samba-ad-dc status
samba-ad-dc start/running, process 3489
root@ubuntu:~# service krb5-kdc start
 * Starting Kerberos KDC krb5kdc                                                                                                            [ OK ] 
root@ubuntu:~# service krb5-admin-server start
 * Starting Kerberos administrative servers kadmind                                                                                         [ OK ] 
root@ubuntu:~#

root@ubuntu:~# host -t SRV _ldap._tcp.ubuntu.fritz.box
_ldap._tcp.ubuntu.fritz.box has SRV record 0 100 389 ubuntu.ubuntu.fritz.box.
root@ubuntu:~# host -t SRV _kerberos._udp.ubuntu.fritz.box
_kerberos._udp.ubuntu.fritz.box has SRV record 0 100 88 ubuntu.ubuntu.fritz.box.
root@ubuntu:~# host -t A ubuntu.fritz.box
ubuntu.fritz.box has address 192.168.101.14
root@ubuntu:~#

root@ubuntu:~# smbclient //localhost/netlogon -UAdministrator -c 'ls'
Enter Administrator's password: 
Domain=[UB] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]
  .    -------
	netlogon        Disk      
	sysvol          Disk      
	IPC$       D     IPC   0  Sun Jan 17 17:29:13 2016
  ..IPC Service
Domain=[UB] OS=[Unix] Server=[Samba 4.1.6-Ubuntu]

	Server               Comment
	---------             -------

	Workgroup      D      Master
	---------  0  Sun Jan 17 17:29:20 2016

		59942 blocks of size 524288. 54112 blocks available
root@ubuntu:~#

Bitte beachten: Kerberos-Pricipals können sich am Kerberosservice anmelden und haben dort Berechtigungen, sind aber keine Domainbenutzer.

root@ubuntu:~# kadmin.local
Authenticating as principal root/admin@ubuntu.fritz.box with password.
kadmin.local:  addprinc klaus
WARNING: no policy specified for klaus@ubuntu.fritz.box; defaulting to no policy
Enter password for principal "klaus@ubuntu.fritz.box": 
Re-enter password for principal "klaus@ubuntu.fritz.box": 
Principal "klaus@ubuntu.fritz.box" created.
kadmin.local:  exit
root@ubuntu:~#

root@ubuntu:~# kadmin.local
Authenticating as principal root/admin@ubuntu.fritz.box with password.
kadmin.local:  delprinc klaus
Are you sure you want to delete the principal "klaus@ubuntu.fritz.box"? (yes/no): yes
Principal "klaus@ubuntu.fritz.box" deleted.
Make sure that you have removed this principal from all ACLs before reusing.
kadmin.local:  exit
root@ubuntu:~#

root@ubuntu:~# kadmin.local
Authenticating as principal root/admin@ubuntu.fritz.box with password.
kadmin.local:  cpw klaus
Enter password for principal "klaus@ubuntu.fritz.box": 
Re-enter password for principal "klaus@ubuntu.fritz.box": 
Password for "klaus@ubuntu.fritz.box" changed.
kadmin.local:  exit
root@ubuntu:~#