diff options
Diffstat (limited to 'crypto/heimdal/doc/misc.texi')
| -rw-r--r-- | crypto/heimdal/doc/misc.texi | 72 |
1 files changed, 2 insertions, 70 deletions
diff --git a/crypto/heimdal/doc/misc.texi b/crypto/heimdal/doc/misc.texi index 83c2a4a..ea22609 100644 --- a/crypto/heimdal/doc/misc.texi +++ b/crypto/heimdal/doc/misc.texi @@ -1,6 +1,6 @@ -@c $Id: misc.texi,v 1.13 2003/03/30 21:30:59 lha Exp $ +@c $Id: misc.texi 12197 2003-05-04 13:32:37Z lha $ -@node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top +@node Things in search for a better place, Kerberos 4 issues, Applications, Top @chapter Things in search for a better place @section Making things work on Ciscos @@ -56,71 +56,3 @@ protocol. A working solution would be to hook up a machine with a real operating system to the console of the Cisco and then use it as a backwards terminal server. - -@section Making things work on Transarc/OpenAFS AFS - -@subsection How to get a KeyFile - -@file{ktutil -k AFSKEYFILE:KeyFile get afs@@MY.REALM} - -or you can extract it with kadmin - -@example -kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@@My.CELL.NAME -@end example - -You have to make sure you have a @code{des-cbc-md5} encryption type since that -is the key that will be converted. - -@subsection How to convert a srvtab to a KeyFile - -You need a @file{/usr/vice/etc/ThisCell} containing the cellname of you -AFS-cell. - -@file{ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile}. - -If keyfile already exists, this will add the new key in afs-srvtab to -KeyFile. - -@section Using 2b tokens with AFS - -@subsection What is 2b ? - -2b is the name of the proposal that was implemented to give basic -Kerberos 5 support to AFS in rxkad. Its not real Kerberos 5 support -since it still uses fcrypt for data encryption and not Kerberos -encryption types. - -Its only possible (in all cases) to do this for DES encryption types because -only then the token (the AFS equivalent of a ticket) will be be smaller -than the maximum size that can fit in the token cache in -OpenAFS/Transarc client. Its so tight fit that some extra wrapping on the ASN1/DER encoding is removed from the Kerberos ticket. - -2b uses a Kerberos 5 EncTicketPart instead of a Kerberos 4 ditto for -the part of the ticket that is encrypted with the service's key. The -client doesn't know what's inside the encrypted data so to the client it doesn't matter. - -To differentiate between Kerberos 4 tickets and Kerberos 5 tickets 2b -uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens. - -Its a requirement that all AFS servers that support 2b also support -native Kerberos 5 in rxkad. - -@subsection Configuring Heimdal to use 2b tokens - -Support for 2b tokens are turned on for specific principals by adding -them to the string list option @code{[kdc]use_2b} in the kdc's -@file{krb5.conf} file. - -@example -[kdc] - use_2b = @{ - afs@@SU.SE = yes - afs/it.su.se@@SU.SE = yes - @} -@end example - -@subsection Configuring AFS clients - -There is no need to configure AFS clients. The only software that -needs to be installed/upgrade is a Kerberos 5 enabled @file{afslog}. |
