1b528cefcSMark Murray@node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top 2b528cefcSMark Murray@chapter Things in search for a better place 3b528cefcSMark Murray 4b528cefcSMark Murray@section Making things work on Ciscos 5b528cefcSMark Murray 6b528cefcSMark MurrayModern versions of Cisco IOS has some support for authenticating via 7b528cefcSMark MurrayKerberos 5. This can be used both to verify passwords via a ticket 8b528cefcSMark Murrayexchange Kerberos 5 (boring), and to use Kerberos authenticated telnet 9b528cefcSMark Murrayto access your router (less boring). The following has been tested on 10b528cefcSMark MurrayIOS 11.2(12), things might be different with other versions. Old 11b528cefcSMark Murrayversions are known to have bugs. 12b528cefcSMark Murray 13b528cefcSMark MurrayTo make this work, you will first have to configure your router to use 14b528cefcSMark MurrayKerberos (this is explained in the documentation). A sample 15b528cefcSMark Murrayconfiguration looks like the following: 16b528cefcSMark Murray 17b528cefcSMark Murray@example 18b528cefcSMark Murrayaaa new-model 19b528cefcSMark Murrayaaa authentication login default krb5-telnet krb5 enable 20b528cefcSMark Murrayaaa authorization exec krb5-instance 21b528cefcSMark Murraykerberos local-realm FOO.SE 22b528cefcSMark Murraykerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 23b528cefcSMark Murraykerberos server FOO.SE 10.0.0.1 24b528cefcSMark Murraykerberos instance map admin 15 25b528cefcSMark Murray@end example 26b528cefcSMark Murray 27b528cefcSMark MurrayThis tells you (among other things) that the when logging in, the router 28b528cefcSMark Murrayshould try to authenticate with kerberized telnet, and if that fails try 29b528cefcSMark Murrayto verify a plain text password via a Kerberos ticket exchange (as 30b528cefcSMark Murrayopposed to a local database or RADIUS or something similar), and if that 31b528cefcSMark Murrayfails try the local enable password. If you're not careful when you 32b528cefcSMark Murrayspecify the `login default' authentication mechanism, you might not be 33b528cefcSMark Murrayable to login. The `instance map' and `authorization exec' lines says 34b528cefcSMark Murraythat people with `admin' instances should be given `enabled' shells when 35b528cefcSMark Murraylogging in. 36b528cefcSMark Murray 37b528cefcSMark MurrayTo make the Heimdal KDC produce tickets that the Cisco can decode you 38b528cefcSMark Murraymight have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the 39b528cefcSMark MurrayKDC. You will also have to specify that the router can't handle anything 40b528cefcSMark Murraybut @samp{des-cbc-crc}. There currently isn't an easy way to do 41b528cefcSMark Murraythis. The best you can do is to dump your database (with @samp{kadmin -l 42b528cefcSMark Murraydump}), remove all entries for keys other than @samp{des-cbc-crc}, and 43b528cefcSMark Murraythen reloading the database (@samp{kadmin -l load}). An example should 44b528cefcSMark Murrayclarify this. You should have something like (again, truncated): 45b528cefcSMark Murray@example 46b528cefcSMark Murrayhost/router.foo.se@@FOO.SE 4:0:1:...:-:... - - - - - - - 126 47b528cefcSMark Murray@end example 48b528cefcSMark MurrayChange this to: 49b528cefcSMark Murray@example 50b528cefcSMark Murrayhost/router.foo.se@@FOO.SE 4:0:1:...:- - - - - - - - 126 51b528cefcSMark Murray@end example 52b528cefcSMark Murray 53b528cefcSMark MurrayThis all fine and so, but unless you have an IOS version with encryption 54b528cefcSMark Murray(available only in the U.S) it doesn't really solve any problems. Sure 55b528cefcSMark Murrayyou don't have to send your password over the wire, but since the telnet 56b528cefcSMark Murrayconnection isn't protected it's still possible for someone to steal your 57b528cefcSMark Murraysession. This won't be fixed until someone adds integrity to the telnet 58b528cefcSMark Murrayprotocol. 59b528cefcSMark Murray 60b528cefcSMark MurrayA working solution would be to hook up a machine with a real operating 61b528cefcSMark Murraysystem to the console of the Cisco and then use it as a backwards 62b528cefcSMark Murrayterminal server. 63