Recently, the esteemed Jonathan Frappier (@jfrappier) posted an article on setting up Kerberos for use with Ansible. My Kerberos senses started to tingle…
While Jonathan was referring to Ansible, it made me remember that this question comes up a lot when trying to use Kerberos with Linux clients.
Kerberos isn’t necessarily easy
When using Kerberos with Active Directory and Windows clients, it’s generally pretty straightforward, as the GUI does most of the work for you. When you add a Windows box to a domain, the SPN and machine account principal is auto-populated from the AD KDC.
The keytab file gets ported over to the client and, provided you have a valid Windows login, you can start using Kerberos without ever actually knowing you are using it. In fact, most people don’t realize they’re using it until it breaks.
Additionally, even if Kerberos isn’t working in Windows, there is the fallback option of NTLM authentication, so if you can’t get a ticket to access a share, you could always use the less secure auth method (unless you disabled it in the domain).
As a result, in 90% of the cases, you never even have to think about Kerberos in a Windows-only environment, much less know how it works. I know this from experience as a Windows administrator in my earlier IT days. Once I started working for NetApp support, I realized how little I actually knew about how Windows authentication worked.
So, say what you will about Windows, but it is *way* simpler in most cases for daily tasks like authentication.
Linux isn’t necessarily hard
One of the main things I’ve learned about Linux as I transitioned from solely being a “Windows guy” into a hybrid-NAS guy is that Linux isn’t really that hard. It’s just… different.
And by “different,” I mean it in terms of management. The core operating systems of Windows and Linux are essentially identical in terms of functionality:
- They both boot from a kernel and load configurations via config files
- They both leverage file system partitions and services
- They both can be run on hardware or software (virtualized)
- They both require resources like memory and CPU
The main differences between the two, in my opinion, are the open source aspect and the way you manage them. Naturally, there are a ton of other differences and I’m not interested in debating the merits of the OS. My point is simply this: Linux is only hard if you aren’t familiar with it.
That said, some things in Linux can be very manual processes. Kerberos configuration, for example, used to be a very convoluted process. In older Linux clients, you had to roughly do the following to get it to work:
- Create a user or machine account in the KDC manaually (the Kerberos principal)
- Assign SPNs manually to the principal
- Configure the desired enctypes on the principal manually
- Create the keytab for the principal manually (using something like ktpass)
- Copy the keytab to the Linux client
- Install the keytab to the client manually (using something like ktutil)
- Configure the client to use secure NFS and configure the KDC realm information manually
- Start the GSSD service manually and configure it to start on boot
- Configure DNS
- Ensure the time skew is within 5 minutes/configure NTP
- Configure LDAP on the NFS client manually
That’s all off the top of my head. I’m sure I’m missing something, mainly because that’s a LONG LIST. But, Linux is getting better and automating more of these tasks. CentOS7/RHEL7 took a big leap in that regard by including realmd.
If you’re looking for the easiest way to configure Kerberos…
Use realmd. It’s brilliant.
It automates most the Kerberos client configuration tasks I listed above. Sure, you still have to install it and a few other tools (like SSSD, Kerberos workstation, etc) and configure the realm information, NTP and DNS settings, but after that, it’s as simple as running “realm join.”
This acts a lot like a Windows domain join in that it:
- Creates a machine account for you
- Creates the SPNs for you
- Creates the keytab for you
- Adds the keytab file to the client manually
- Configures SSSD to use Windows AD for LDAP/Identity management for you
Super simple. I cover it in the next update of TR-4073 (update to that coming soon… stay tuned) as it pertains to NetApp storage systems, but there are plenty of how-to guides for just the client portion out there.
Happy Kerberizing!
Why Is The Internet Broken? 