1@c $Id: misc.texi,v 1.13 2003/03/30 21:30:59 lha Exp $ 2 3@node Things in search for a better place, Kerberos 4 issues, Setting up a realm, Top 4@chapter Things in search for a better place 5 6@section Making things work on Ciscos 7 8Modern versions of Cisco IOS has some support for authenticating via 9Kerberos 5. This can be used both by having the router get a ticket when 10you login (boring), and by using Kerberos authenticated telnet to access 11your router (less boring). The following has been tested on IOS 1211.2(12), things might be different with other versions. Old versions 13are known to have bugs. 14 15To make this work, you will first have to configure your router to use 16Kerberos (this is explained in the documentation). A sample 17configuration looks like the following: 18 19@example 20aaa new-model 21aaa authentication login default krb5-telnet krb5 enable 22aaa authorization exec krb5-instance 23kerberos local-realm FOO.SE 24kerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 25kerberos server FOO.SE 10.0.0.1 26kerberos instance map admin 15 27@end example 28 29This tells you (among other things) that when logging in, the router 30should try to authenticate with kerberised telnet, and if that fails try 31to verify a plain text password via a Kerberos ticket exchange (as 32opposed to a local database, RADIUS or something similar), and if that 33fails try the local enable password. If you're not careful when you 34specify the `login default' authentication mechanism, you might not be 35able to login at all. The `instance map' and `authorization exec' lines 36says that people with `admin' instances should be given `enabled' shells 37when logging in. 38 39The numbers after the principal on the `srvtab' line are principal type, 40time stamp (in seconds since 1970), key version number (4), keytype (1 == 41des), key length (always 8 with des), and then the key. 42 43To make the Heimdal KDC produce tickets that the Cisco can decode you 44might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the 45KDC. You will also have to specify that the router can't handle anything 46but @samp{des-cbc-crc}. This can be done with the @samp{del_enctype} 47command of @samp{kadmin}. 48 49This all fine and so, but unless you have an IOS version with encryption 50(available only in the U.S) it doesn't really solve any problems. Sure 51you don't have to send your password over the wire, but since the telnet 52connection isn't protected it's still possible for someone to steal your 53session. This won't be fixed until someone adds integrity to the telnet 54protocol. 55 56A working solution would be to hook up a machine with a real operating 57system to the console of the Cisco and then use it as a backwards 58terminal server. 59 60@section Making things work on Transarc/OpenAFS AFS 61 62@subsection How to get a KeyFile 63 64@file{ktutil -k AFSKEYFILE:KeyFile get afs@@MY.REALM} 65 66or you can extract it with kadmin 67 68@example 69kadmin> ext -k AFSKEYFILE:/usr/afs/etc/KeyFile afs@@My.CELL.NAME 70@end example 71 72You have to make sure you have a @code{des-cbc-md5} encryption type since that 73is the key that will be converted. 74 75@subsection How to convert a srvtab to a KeyFile 76 77You need a @file{/usr/vice/etc/ThisCell} containing the cellname of you 78AFS-cell. 79 80@file{ktutil copy krb4:/root/afs-srvtab AFSKEYFILE:/usr/afs/etc/KeyFile}. 81 82If keyfile already exists, this will add the new key in afs-srvtab to 83KeyFile. 84 85@section Using 2b tokens with AFS 86 87@subsection What is 2b ? 88 892b is the name of the proposal that was implemented to give basic 90Kerberos 5 support to AFS in rxkad. Its not real Kerberos 5 support 91since it still uses fcrypt for data encryption and not Kerberos 92encryption types. 93 94Its only possible (in all cases) to do this for DES encryption types because 95only then the token (the AFS equivalent of a ticket) will be be smaller 96than the maximum size that can fit in the token cache in 97OpenAFS/Transarc client. Its so tight fit that some extra wrapping on the ASN1/DER encoding is removed from the Kerberos ticket. 98 992b uses a Kerberos 5 EncTicketPart instead of a Kerberos 4 ditto for 100the part of the ticket that is encrypted with the service's key. The 101client doesn't know what's inside the encrypted data so to the client it doesn't matter. 102 103To differentiate between Kerberos 4 tickets and Kerberos 5 tickets 2b 104uses a special kvno, 213 for 2b tokens and 255 for Kerberos 5 tokens. 105 106Its a requirement that all AFS servers that support 2b also support 107native Kerberos 5 in rxkad. 108 109@subsection Configuring Heimdal to use 2b tokens 110 111Support for 2b tokens are turned on for specific principals by adding 112them to the string list option @code{[kdc]use_2b} in the kdc's 113@file{krb5.conf} file. 114 115@example 116[kdc] 117 use_2b = @{ 118 afs@@SU.SE = yes 119 afs/it.su.se@@SU.SE = yes 120 @} 121@end example 122 123@subsection Configuring AFS clients 124 125There is no need to configure AFS clients. The only software that 126needs to be installed/upgrade is a Kerberos 5 enabled @file{afslog}. 127