1@c $Id$ 2 3@node Things in search for a better place, Kerberos 4 issues, Applications, Top 4@chapter Things in search for a better place 5 6@section Making things work on Ciscos 7 8Modern versions of Cisco IOS has some support for authenticating via 9Kerberos 5. This can be used both by having the router get a ticket when 10you login (boring), and by using Kerberos authenticated telnet to access 11your router (less boring). The following has been tested on IOS 1211.2(12), things might be different with other versions. Old versions 13are known to have bugs. 14 15To make this work, you will first have to configure your router to use 16Kerberos (this is explained in the documentation). A sample 17configuration looks like the following: 18 19@example 20aaa new-model 21aaa authentication login default krb5-telnet krb5 enable 22aaa authorization exec krb5-instance 23kerberos local-realm FOO.SE 24kerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 25kerberos server FOO.SE 10.0.0.1 26kerberos instance map admin 15 27@end example 28 29This tells you (among other things) that when logging in, the router 30should try to authenticate with kerberised telnet, and if that fails try 31to verify a plain text password via a Kerberos ticket exchange (as 32opposed to a local database, RADIUS or something similar), and if that 33fails try the local enable password. If you're not careful when you 34specify the `login default' authentication mechanism, you might not be 35able to login at all. The `instance map' and `authorization exec' lines 36says that people with `admin' instances should be given `enabled' shells 37when logging in. 38 39The numbers after the principal on the `srvtab' line are principal type, 40time stamp (in seconds since 1970), key version number (4), keytype (1 == 41des), key length (always 8 with des), and then the key. 42 43To make the Heimdal KDC produce tickets that the Cisco can decode you 44might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the 45KDC. You will also have to specify that the router can't handle anything 46but @samp{des-cbc-crc}. This can be done with the @samp{del_enctype} 47command of @samp{kadmin}. 48 49This all fine and so, but unless you have an IOS version with encryption 50(available only in the U.S) it doesn't really solve any problems. Sure 51you don't have to send your password over the wire, but since the telnet 52connection isn't protected it's still possible for someone to steal your 53session. This won't be fixed until someone adds integrity to the telnet 54protocol. 55 56A working solution would be to hook up a machine with a real operating 57system to the console of the Cisco and then use it as a backwards 58terminal server. 59