過程 140.1. 安裝NIS伺服器

1. ypserv

   				
   # yum install ypserv -y
   				
   				

2. /etc/hosts

   				
   [root@nis ~]# hostname nis.example.com				
   [root@nis ~]# echo "192.168.3.5 nis.example.com" >> /etc/hosts
   [root@nis ~]# cat /etc/hosts
   # Do not remove the following line, or various programs
   # that require network functionality will fail.
   127.0.0.1 datacenter.example.com datacenter localhost.localdomain localhost
   ::1 localhost6.localdomain6 localhost6
   127.0.0.1 kerberos.example.com
   192.168.3.5 nis.example.com
   				
   				

3. 設置NIS域名

   				
   # nisdomainname example.com
   # nisdomainname
   example.com
   				
   				

   加入 /etc/rc.local 開機腳本

   				
   # echo '/bin/nisdomainname example.com' >> /etc/rc.local
   # echo 'NISDOMAIN=example.com' >> /etc/sysconfig/network
   				
   				

4. 設置/etc/ypserv.conf主配置檔案

   				
   # vim /etc/ypserv.conf
   
   127.0.0.0/255.255.255.0 : * : * : none
   192.168.3.0/255.255.255.0 : * : * : none
   * : * : * : deny
   				
   				

5. 創建 /var/yp/securenets 檔案

   securenets 安全配置檔案

   				
   # vim /var/yp/securenets
   host 127.0.0.1
   255.255.255.0 192.168.3.0
   				
   				

6. 啟動NIS伺服器

   NIS伺服器需要portmap服務的支持，並且需要啟動ypserv和yppasswdd兩個服務

   				
   [root@nis ~]# service portmap status
   portmap (pid 2336)
   is running...
   [root@nis ~]# service ypserv start
   Starting YP
   server services: [ OK ]
   [root@nis ~]# service yppasswdd start
   Starting YP passwd service: [ OK ]
   				
   				

7. 構建NIS資料庫

   32bit: /usr/lib/yp/ypinit -m

   64bit: /usr/lib64/yp/ypinit -m

   				
   [root@nis ~]# /usr/lib64/yp/ypinit -m
   
   At this point, we have to construct a list of the hosts which will run NIS
   servers.  nis.example.com is in the list of NIS server hosts.  Please continue to add
   the names for the other hosts, one per line.  When you are done with the
   list, type a <control D>.
           next host to add:  nis.example.com
           next host to add:
           next host to add:
   The current list of NIS servers looks like this:
   
   nis.example.com
   
   
   Is this correct?  [y/n: y]
   We need a few minutes to build the databases...
   Building /var/yp/example.com/ypservers...
   Running /var/yp/Makefile...
   gmake[1]: Entering directory `/var/yp/example.com'
   Updating passwd.byname...
   Updating passwd.byuid...
   Updating group.byname...
   Updating group.bygid...
   Updating hosts.byname...
   Updating hosts.byaddr...
   Updating rpc.byname...
   Updating rpc.bynumber...
   Updating services.byname...
   Updating services.byservicename...
   Updating netid.byname...
   Updating protocols.bynumber...
   Updating protocols.byname...
   Updating mail.aliases...
   gmake[1]: Leaving directory `/var/yp/example.com'
   
   nis.example.com has been set up as a NIS master server.
   
   Now you can run ypinit -s nis.example.com on all slave server.
   
   				
   				

   檢查

   				
   # ls /var/yp/
   binding example.com Makefile nicknames securenets ypservers				
   				
   				

8. Service

   				
   [root@datacenter ~]# chkconfig --list | grep yp
   ypbind          0:off   1:off   2:off   3:off   4:off   5:off   6:off
   yppasswdd       0:off   1:off   2:off   3:off   4:off   5:off   6:off
   ypserv          0:off   1:off   2:off   3:off   4:off   5:off   6:off
   ypxfrd          0:off   1:off   2:off   3:off   4:off   5:off   6:off
   
   [root@nis ~]# chkconfig ypserv on
   [root@nis ~]# chkconfig yppasswdd on
   				
   				

過程 140.2. 安裝NIS客戶端軟件

1. NIS客戶機需要安裝ypbind和yp-tools兩個軟件包

   				
   # yum install ypbind yp-tools -y
   				
   				

2. NIS域名

   				
   # nisdomainname example.com
   				
   				

3. /etc/hosts

   				
   192.168.3.5 nis.example.com
   				
   				

4. /etc/yp.conf

   				
   # vim /etc/yp.conf
   domain example.com server nis.example.com
   				
   				

5. /etc/nsswitch.conf

   				
   # vim /etc/nsswitch.conf
   passwd: files nis
   shadow: files nis
   group: files nis
   hosts: files nis dns
   				
   				

6. 啟動ypbind服務程序

   				
   [root@test ~]# service portmap status
   portmap is stopped
   [root@test ~]# service portmap start
   Starting portmap: [ OK ]
   [root@test ~]# service ypbind start
   Turning on allow_ypbind SELinux boolean
   Binding to the NIS domain: [ OK ]
   Listening for an NIS domain server..
   				
   				

7. yp-tools 測試工具

   yptest 命令可對NIS伺服器進行自動測試

   				
   # yptest	
   				
   				

   ypwhich 命令可顯示NIS客戶機所使用的NIS伺服器的主機名稱和資料庫檔案列表

   				
   # ypwhich
   # ypwhich -x			
   				
   				

   ypcat命令顯示資料庫檔案列表和指定資料庫的內容

   				
   # ypcat -x
   # ypcat passwd				
   				
   				

8. NIS Client Service

   				
   # chkconfig ypbind on				
   				
   				

1. First, install the OpenLDAP server daemon slapd and ldap-utils, a package containing LDAP management utilities:

   sudo apt-get install slapd ldap-utils				
   				

   By default the directory suffix will match the domain name of the server. For example, if the machine's Fully Qualified Domain Name (FQDN) is ldap.example.com, the default suffix will be dc=example,dc=com. If you require a different suffix, the directory can be reconfigured using dpkg-reconfigure. Enter the following in a terminal prompt:

   sudo dpkg-reconfigure slapd				
   				

2. example.com.ldif

   dn: ou=people,dc=example,dc=com
   objectClass: organizationalUnit
   ou: people
   
   dn: ou=groups,dc=example,dc=com
   objectClass: organizationalUnit
   ou: groups
   
   dn: uid=john,ou=people,dc=example,dc=com
   objectClass: inetOrgPerson
   objectClass: posixAccount
   objectClass: shadowAccount
   uid: john
   sn: Doe
   givenName: John
   cn: John Doe
   displayName: John Doe
   uidNumber: 1000
   gidNumber: 10000
   userPassword: password
   gecos: John Doe
   loginShell: /bin/bash
   homeDirectory: /home/john
   shadowExpire: -1
   shadowFlag: 0
   shadowWarning: 7
   shadowMin: 8
   shadowMax: 999999
   shadowLastChange: 10877
   mail: john.doe@example.com
   postalCode: 31000
   l: Toulouse
   o: Example
   mobile: +33 (0)6 xx xx xx xx
   homePhone: +33 (0)5 xx xx xx xx
   title: System Administrator
   postalAddress: 
   initials: JD
   
   dn: cn=example,ou=groups,dc=example,dc=com
   objectClass: posixGroup
   cn: example
   gidNumber: 10000
   				

3. To add the entries to the LDAP directory use the ldapadd utility:

   ldapadd -x -D cn=admin,dc=example,dc=com -W -f example.com.ldif
   				

   We can check that the content has been correctly added with the tools from the ldap-utils package. In order to execute a search of the LDAP directory:

   ldapsearch -xLLL -b "dc=example,dc=com" uid=john sn givenName cn
   
   dn: uid=john,ou=people,dc=example,dc=com
   cn: John Doe
   sn: Doe
   givenName: John				
   				

1. libnss-ldap

   sudo apt-get install libnss-ldap
   				

2. reconfigure ldap-auth-config

   sudo dpkg-reconfigure ldap-auth-config
   				

3. auth-client-config

   sudo auth-client-config -t nss -p lac_ldap				
   				

4. pam-auth-update.

   sudo pam-auth-update
   				

過程 140.4. Kerberos Server 配置步驟

1. Create the Database

   創建Kerberos的本地資料庫

   kdb5_util create -r EXAMPLE.COM -s

   [root@datacenter ~]# kdb5_util create -r EXAMPLE.COM -s
   Loading random data
   Initializing database '/var/kerberos/krb5kdc/principal' for realm 'EXAMPLE.COM',
   master key name 'K/M@EXAMPLE.COM'
   You will be prompted for the database Master Password.
   It is important that you NOT FORGET this password.
   Enter KDC database master key:
   Re-enter KDC database master key to verify:		
   				

2. /etc/krb5.conf

   # cp /etc/krb5.conf /etc/krb5.conf.old
   # vim /etc/krb5.conf
   [logging]
    default = FILE:/var/log/krb5libs.log
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmind.log
   
   [libdefaults]
    default_realm = EXAMPLE.COM
    dns_lookup_realm = false
    dns_lookup_kdc = false
    ticket_lifetime = 24h
    forwardable = yes
   
   [realms]
    EXAMPLE.COM = {
     kdc = kerberos.example.com:88
     admin_server = kerberos.example.com:749
     default_domain = example.com
    }
   
   [domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM
   
   [appdefaults]
    pam = {
      debug = false
      ticket_lifetime = 36000
      renew_lifetime = 36000
      forwardable = true
      krb4_convert = false
    }
   				

   檢查下面配置檔案 /var/kerberos/krb5kdc/kadm5.acl

   [root@datacenter ~]# cat /var/kerberos/krb5kdc/kadm5.acl
   */admin@EXAMPLE.COM     *
   				

   格式

   The format of the file is:
   
        Kerberos_principal      permissions     [target_principal]	[restrictions]
   				

3. Add Administrators to the Kerberos Database

   創建賬號

   [root@datacenter ~]# kadmin.local
   Authenticating as principal root/admin@EXAMPLE.COM with password.
   kadmin.local:  addprinc admin/admin@EXAMPLE.COM
   WARNING: no policy specified for admin/admin@EXAMPLE.COM; defaulting to no policy
   Enter password for principal "admin/admin@EXAMPLE.COM":
   Re-enter password for principal "admin/admin@EXAMPLE.COM":
   Principal "admin/admin@EXAMPLE.COM" created.
   kadmin.local:
   				

   也同樣可以使用下面命令

   kadmin.local -q "addprinc username/admin"

   [root@datacenter ~]# kadmin.local -q "addprinc krbuser"
   Authenticating as principal admin/admin@EXAMPLE.COM with password.
   WARNING: no policy specified for krbuser@EXAMPLE.COM; defaulting to no policy
   Enter password for principal "krbuser@EXAMPLE.COM":
   Re-enter password for principal "krbuser@EXAMPLE.COM":
   Principal "krbuser@EXAMPLE.COM" created.
   				

4. Create a kadmind Keytab

   				
   [root@datacenter ~]# kadmin.local -q  "ktadd -k /var/kerberos/krb5kdc/kadm5.keytab => kadmin/admin kadmin/changepw"
   Authenticating as principal admin/admin@EXAMPLE.COM with password.
   kadmin.local: Principal => does not exist.
   Entry for principal kadmin/admin with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
   Entry for principal kadmin/admin with kvno 3, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
   Entry for principal kadmin/changepw with kvno 3, encryption type Triple DES cbc mode with HMAC/sha1 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.
   Entry for principal kadmin/changepw with kvno 3, encryption type DES cbc mode with CRC-32 added to keytab WRFILE:/var/kerberos/krb5kdc/kadm5.keytab.				
   				
   				

5. Start the Kerberos Daemons on the Master KDC

   啟動 Kerberos進程

   [root@datacenter ~]# sudo /etc/init.d/krb524 start
   Starting Kerberos 5-to-4 Server:                           [  OK  ]
   
   [root@datacenter ~]# sudo /etc/init.d/krb5kdc restart
   Stopping Kerberos 5 KDC:                                   [  OK  ]
   Starting Kerberos 5 KDC:                                   [  OK  ]
   
   [root@datacenter ~]# sudo /etc/init.d/kadmin start
   Starting Kerberos 5 Admin Server:                          [  OK  ]
   				

6. Log 檔案

   [root@datacenter ~]# cat /var/log/krb5kdc.log
   
   [root@datacenter ~]# cat /var/log/krb5libs.log
   
   [root@datacenter ~]# cat /var/log/kadmind.log
   				

過程 140.5. Kerberos Client 配置步驟

1. Ticket Management

   1. Obtaining Tickets with kinit

      [root@datacenter ~]# kinit admin/admin
      Password for admin/admin@EXAMPLE.COM:				
      				

   2. Viewing Your Tickets with klist

      [root@datacenter ~]# klist
      Ticket cache: FILE:/tmp/krb5cc_0
      Default principal: admin/admin@EXAMPLE.COM
      
      Valid starting     Expires            Service principal
      03/25/10 16:15:18  03/26/10 16:15:18  krbtgt/EXAMPLE.COM@ZEXAMPLECOM
      
      
      Kerberos 4 ticket cache: /tmp/tkt0
      klist: You have no tickets cached
      				

   3. Destroying Your Tickets with kdestroy

      [root@datacenter ~]# kdestroy
      [root@datacenter ~]# klist
      klist: No credentials cache found (ticket cache FILE:/tmp/krb5cc_0)
      
      
      Kerberos 4 ticket cache: /tmp/tkt0
      klist: You have no tickets cached
      				

2. Password Management

   Changing Your Password

    
   				   
   [root@datacenter ~]# kpasswd
   Password for admin/admin@EXAMPLE.COM:
   Enter new password:
   Enter it again:
   Password changed.