MIT Kerberos and Solaris 10 Kerberos

[Douglas E. Engert]

But IIRC the Solaris "su" can use PAM, and thus could use pam_krb5 or
some other PAM routine to acomplish the same thing as the MIT su?


Heilke, Rainer wrote:

> Thanks for the response. Please see inline...
> 
> 
>>In Solaris 10, all of the Kerberos services are already bundled,
>>there is no longer any external packages that need to be added.
> 
> 
> Right.
> 
> 
>>Whoever told you 'ksu' was part of the encryption kit was mistaken,
>>ksu has never been part of SEAM.
> 
> 
> OK, thanks for that clarification. It was a bit of a surprise to me when
> I was told it was there. So, does the Solaris 10 SEAM have any
> functionality similar to ksu, or just the standard su command?
> 
> 
>>The encryption kit for Solaris 10 enhances the overall crypto
>>capabilities of the system, the only benefit Kerberos gets is
>>that it can support AES-256 with the S10 encryption kit.
>>Without the S10 encryption kit, the strongest AES crypto
>>available for Kerberos in S10 is AES-128.
> 
> 
> And this fits more with what I understood, before my co-worker's
> comments.
> 
> 
>>On the S10 system, you must make sure to enable the "eklogin" service.
>>Run this command (as root):
>>
>># svcadm enable eklogin
> 
> 
> Hmm. That may be a good part of my problem. I added the inetd.conf entry
> for the old (MIT) eklogin, and ran inetconv. So, this is probably really
> confusing the system. I'll try to revert that, and do the svcadm.
> 
> 
>>For Solaris 8 with the SEAM rlogin daemon, make sure your 
>>inetd.conf entries
>>are correct.   
> 
> 
> We don't actually run SEAM on any Sol8 systems; it's all MIT.
> 
> 
>>Don't bother with inetd.conf in S10, S10 uses 
>>the new SMF
>>system for managing services (its very nice once you get used to it).
> 
> 
> I'm still getting used to it, but I like it. I just wish there was more
> info on how to convert from old-style to new-style (beyond running
> inetconv -i inetd.conf).
> 
> 
>>You indicated below that you are using and MIT kerberos KDC on the
>>Solaris 8 systems.  So, the key to making things work with the S8
>>SEAM kerberos clients is to make sure that the host principals
>>for those Solaris 8 systems are only issued DES keys.   The rlogin
>>servers in SEAM only support DES since that is all that was
>>available when the S8 SEAM packages were created.
>>
>>'kadmin -q 'addprinc -e des-cbc-md5:normal host/foo.bar.com"'
>>'kadmin -q 'ktadd -e des-cbc-md5:normal host/foo.bar.com"'
>>
>>(Im not sure if the syntax for those commands is exactly correct,
>>but you get the idea).
>>
>>Solaris 10 systems can be issued AES keys (AES-128 if the encryption
>>package is not installed, AES-256 otherwise) or RC4, 3DES, or DES.
> 
> 
> Can we force the Sol10 box to only use DES, to be compatible with the
> Sol8/MIT systems (which is everything but the one Sol10 box)?
> 
> 
>>SSH in Solaris 10 does support GSSAPI authentication and ticket
>>forwarding, you may need to enable debugging to get more information
>>about why the GSS auth is failing (ssh -vvv  hostname).   If the host
>>keys on S10 are AES-256, but the system doesnt have the enhanced
>>crypto package, then that may be causing the failure, but I would
>>check the debug output from ssh first.
> 
> 
> OK, thanks. I'll poke harder at this once I have the previous issues
> resolved. I'll make SSH a separate problem. (I think I can do that...)
> 
> 
>>>Solaris 10, SEAM going one way, Solaris 8/MIT going the other.
>>
>>We have tested this and it does work, but you have to make sure
>>that the S8 system has only DES keys.
> 
> 
> All Solaris 8 systems are MIT, so if I understood your earlier comments,
> they already are DES; is that correct?
> 
> 
>>>Solaris 8, MIT for rlogind in one direction, and Solaris 
>>
>>10/SEAM in the
>>
>>>other. Typically, I am SSH'ing in to the Solaris 10 system initially
>>>(from our production lab) and then trying to rlogin to the 
>>
>>Solaris 8/MIT
>>
>>>systems in the test lab (where the Solaris 10 system sits). 
>>
>>I have also
>>
>>>SSH'd to a test lab Solaris 8/MIT system, and tried to rlogin to the
>>>Solaris 10/SEAM system.
>>
>>All of this should work, start by getting detailed log 
>>information from the
>>SSH session to see why that part is failing.
> 
> 
> Thank you for all of the help. I'll look at correcting the eklogin
> service first, and move down the list from there. :-) Answers to the
> above questions/clarifications will be greatly appreciated along the
> way. :-)
> 
> Thanks again.
> Rainer
> 
> ________________________________________________
> Kerberos mailing list           Kerberos at mit.edu
> https://mailman.mit.edu/mailman/listinfo/kerberos
> 
> 
> 

-- 

  Douglas E. Engert  <DEEngert at anl.gov>
  Argonne National Laboratory
  9700 South Cass Avenue
  Argonne, Illinois  60439
  (630) 252-5444