diff options
Diffstat (limited to 'crypto/heimdal/doc/misc.texi')
| -rw-r--r-- | crypto/heimdal/doc/misc.texi | 42 |
1 files changed, 19 insertions, 23 deletions
diff --git a/crypto/heimdal/doc/misc.texi b/crypto/heimdal/doc/misc.texi index e926536..994f6f2 100644 --- a/crypto/heimdal/doc/misc.texi +++ b/crypto/heimdal/doc/misc.texi @@ -1,14 +1,16 @@ +@c $Id: misc.texi,v 1.5 2001/01/28 22:11:23 assar Exp $ + @node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top @chapter Things in search for a better place @section Making things work on Ciscos Modern versions of Cisco IOS has some support for authenticating via -Kerberos 5. This can be used both to verify passwords via a ticket -exchange Kerberos 5 (boring), and to use Kerberos authenticated telnet -to access your router (less boring). The following has been tested on -IOS 11.2(12), things might be different with other versions. Old -versions are known to have bugs. +Kerberos 5. This can be used both by having the router get a ticket when +you login (boring), and by using Kerberos authenticated telnet to access +your router (less boring). The following has been tested on IOS +11.2(12), things might be different with other versions. Old versions +are known to have bugs. To make this work, you will first have to configure your router to use Kerberos (this is explained in the documentation). A sample @@ -24,31 +26,25 @@ kerberos server FOO.SE 10.0.0.1 kerberos instance map admin 15 @end example -This tells you (among other things) that the when logging in, the router -should try to authenticate with kerberized telnet, and if that fails try +This tells you (among other things) that when logging in, the router +should try to authenticate with kerberised telnet, and if that fails try to verify a plain text password via a Kerberos ticket exchange (as -opposed to a local database or RADIUS or something similar), and if that +opposed to a local database, RADIUS or something similar), and if that fails try the local enable password. If you're not careful when you specify the `login default' authentication mechanism, you might not be -able to login. The `instance map' and `authorization exec' lines says -that people with `admin' instances should be given `enabled' shells when -logging in. +able to login at all. The `instance map' and `authorization exec' lines +says that people with `admin' instances should be given `enabled' shells +when logging in. + +The numbers after the principal on the `srvtab' line are principal type, +timestamp (in seconds since 1970), key version number (4), keytype (1 == +des), key length (always 8 with des), and then the key. To make the Heimdal KDC produce tickets that the Cisco can decode you might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the KDC. You will also have to specify that the router can't handle anything -but @samp{des-cbc-crc}. There currently isn't an easy way to do -this. The best you can do is to dump your database (with @samp{kadmin -l -dump}), remove all entries for keys other than @samp{des-cbc-crc}, and -then reloading the database (@samp{kadmin -l load}). An example should -clarify this. You should have something like (again, truncated): -@example -host/router.foo.se@@FOO.SE 4:0:1:...:-:... - - - - - - - 126 -@end example -Change this to: -@example -host/router.foo.se@@FOO.SE 4:0:1:...:- - - - - - - - 126 -@end example +but @samp{des-cbc-crc}. This can be done with the @samp{del_enctype} +command of @samp{kadmin}. This all fine and so, but unless you have an IOS version with encryption (available only in the U.S) it doesn't really solve any problems. Sure |
