kerberos service (httpd using mod_auth_kerb) in DMZ

FM dist-list at LEXUM.UMontreal.CA
Mon Nov 14 12:48:08 EST 2005


Hello,

I'm trying to use mod_auth_kerb to authenticate users with kerberos. But 
when I try to authenticat myself http error_log show :
[error] [client 192.168.4.171] krb5_verify_init_creds() failed: Key 
table entry not found

I already use mod_ath_kerb with success bun only from LAN to LAN (same 
setup), now I'd like to move this server to the DMZ

My network :
LAN : 192.168.4.x/24 (DNS = lan.pri)
DMZ : 192.168.3.x/24 (DNS=dmz.pri)

Kerberos is in my LAN : kerberos.lan.pri
http server is in the DMZ : nagios.dmz.pri

In Kerberos I created : http/nagios.dmz.lexum.pri and exported to a keytab.

httpd config :
      AuthName        "Nagios Kerberos Login"
      KrbAuthRealms   KERBEROS.DOMAIN
      Krb5Keytab      "/etc/httpd/conf/httpd.keytab"
      AuthGroupFile   "/etc/httpd/conf/auth-nagios"
      require         valid-user
      KrbServiceName  "http"

krb5.conf :
[realms]
 KERBEROS.DOMAIN = {
  kdc = kerberos.lan.pri:88
  admin_server = kerberos.lan.pri:749
  default_domain = kerberos.domain
 }

[domain_realm]
.lan.pri = KERBEROS.DOMAIN
 lan.pri  = KERBEROS.DOMAIN
 .dmz.pri = KERBEROS.DOMAIN
 dmz.pri  = KERBEROS.DOMAIN


thanks !!


More information about the Kerberos mailing list