There are a number of files that have to
be manually edited on the server.
Edit /etc/krb5.conf
The stock version of this file will have
EXAMPLE.COM or example.com everwhere you want to put your own
realm or domain name. The two sections in question are libdefaults and domain_realm.
The other sections do not need to be changed. In libdefaults, enter your
own kerberos realm name. You may want to set the clock skew to a lower value
(provided you are synchronizing time with ntp).
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
clockskew = 120
The realms section contains the settings for each realm. We have only one realm so it would look like the following. Note that you enter a kdc line for each Kerberos Domain Controller. You should have at least two.
[realms]
EXAMPLE.COM = {
kdc = coma.example.com:88
kdc = second.example.com:88
admin_server = coma.example.com:749
default_domain = example.com
}
In domain_realm, enter the mapping between DNS domains and your kerberos realm. If you are serving multiple DNS domains, you need to put them all here.
[domain_realm]
.zbox.example.com = EXAMPLE.COM
zbox.EXAMPLE.COM = EXAMPLE.COM
.example.com = EXAMPLE.COM
example.com = example.com
Finally, you may want to tweak the application defaults, for example to change the renew lifetime.
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
kinit = {
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
}
[libdefaults]
default_realm = EXAMPLE.COM
dns_lookup_realm = false
dns_lookup_kdc = false
clockskew = 120
The realms section contains the settings for each realm. We have only one realm so it would look like the following. Note that you enter a kdc line for each Kerberos Domain Controller. You should have at least two.
[realms]
EXAMPLE.COM = {
kdc = coma.example.com:88
kdc = second.example.com:88
admin_server = coma.example.com:749
default_domain = example.com
}
In domain_realm, enter the mapping between DNS domains and your kerberos realm. If you are serving multiple DNS domains, you need to put them all here.
[domain_realm]
.zbox.example.com = EXAMPLE.COM
zbox.EXAMPLE.COM = EXAMPLE.COM
.example.com = EXAMPLE.COM
example.com = example.com
Finally, you may want to tweak the application defaults, for example to change the renew lifetime.
[appdefaults]
pam = {
debug = false
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
krb4_convert = false
}
kinit = {
ticket_lifetime = 36000
renew_lifetime = 36000
forwardable = true
}