Apache Kerberos Authentication - Revision history

Michael.mast: /* VHOST Config */

2019-05-07T00:00:26Z

VHOST Config

Michael.mast: /* VHOST Config */

2019-05-06T20:07:32Z

VHOST Config

Michael.mast: /* Docker */

2019-05-06T14:55:11Z

Docker

Michael.mast: /* Host config */

2019-02-13T13:37:45Z

Host config

Michael.mast at 21:49, 27 November 2018

2018-11-27T21:49:48Z

Michael.mast at 19:33, 15 September 2018

2018-09-15T19:33:06Z

Michael.mast: /* On the web server */

2018-09-15T17:49:32Z

On the web server

Michael.mast: /* Keytab Creation */

2018-09-15T17:47:16Z

Keytab Creation

Michael.mast: /* MultiRealm Authentication */

2018-09-12T17:48:50Z

MultiRealm Authentication

Michael.mast: /* MultiRealm Authentication */

2018-09-12T17:23:55Z

MultiRealm Authentication

@@ Line 109: / Line 109: @@
 Here I tried using the principle from the keytab, but for some reason the kvno kept getting logged as 3 instead of 6. So for now I told Apache to use any service name. Need to research security risks related to this. Also I might need to keep it at ANY if I can not specify more than one principal.
 <pre>
-<IF "'%{REMOTE_ADDR}' != '<trusted IP here>' && '%{REQUEST_URI}' != '/wp-admin'">
+<IF "'%{REQUEST_URI}' != '/wp-admin'">
 AuthType Kerberos
 AuthName "Kerberos authenticated site"
@@ Line 123: / Line 123: @@
 </pre>
-If you want to allow access regardless of authentication (i.e. If you use the apache variable as part of your own authentication, but allow manual login if this fails)
+If you want to allow access regardless of authentication (i.e. If you use the apache variable as part of your own authentication, but allow manual login if this fails) you are limited in options. In my case I ended up allowing a subnet and a single IP to access without kerberos authentication, but all others would be required to use it.
 <ref>https://www.jeffgeerling.com/blogs/jeff-geerling/apache-kerberos-authentication</ref>
 <ref>https://wiki.apache.org/httpd/BypassAuthenticationOrAuthorizationRequirements</ref>
 <ref>https://httpd.apache.org/docs/trunk/mod/mod_access_compat.html</ref>
 <pre>
-<IF "'%{REMOTE_ADDR}' != '<trusted IP here>' && '%{REQUEST_URI}' != '/wp-admin'">
+<IF "'%{REQUEST_URI}' != '/wp-admin'">
 AuthType Kerberos
 AuthName "Kerberos authenticated site"
@@ Line 136: / Line 136: @@
 Krb5KeyTab /etc/httpd/merged.keytab
 KrbMethodNegotiate On
-KrbMethodK5Passwd Off
+KrbMethodK5Passwd On
-Satisfy Any
+Require valid-user
 </IF>
 </pre>

@@ Line 122: / Line 122: @@
 </pre>
 ==Docker==
 ===Host config===

@@ Line 132: / Line 132: @@
 sudo realm join -U <username> <fqdn>
 sudo reboot
 </pre>

@@ Line 127: / Line 127: @@
 <pre>
 sudo yum -y upgrade
-sudo yum -y install yum-cron oddjob oddjob-mkhomedir sssd samba-common-tools realmd docker amazon-efs-utils docker firewalld
+sudo yum -y install yum-cron oddjob oddjob-mkhomedir sssd samba-common-tools realmd docker amazon-efs-utils firewalld
 sudo systemctl enable firewalld
 sudo systemctl enable docker

← Older revision		Revision as of 21:49, 27 November 2018
Line 121:		Line 121:
	</IF>		</IF>

		+	</pre>
		+	==Docker==
		+	===Host config===
		+	In this example we are using Amazon Linux
		+	<pre>
		+	sudo yum -y upgrade
		+	sudo yum -y install yum-cron oddjob oddjob-mkhomedir sssd samba-common-tools realmd docker amazon-efs-utils docker firewalld
		+	sudo systemctl enable firewalld
		+	sudo systemctl enable docker
		+	sudo realm join -U <username> <fqdn>
		+	sudo reboot
	</pre>		</pre>

@@ Line 17: / Line 17: @@
 intranet.tld
 ===Keytab Creation===
 ====On the domain controllers====
 On domain1.tld, create a user object that will be used for the service. Then create the keytab and map it to the user.

@@ Line 35: / Line 35: @@
 ktutil:  write_kt merged.keytab
 ktutil:  exit
 </pre>

@@ Line 16: / Line 16: @@
 *web server
 intranet.tld
 ===krb5.conf===
 The server I am using was enrolled in domain1 using sssd and the "realm join" command many a year ago. We will be editing the krb5.conf file that was created during this process.

@@ Line 72: / Line 72: @@
 		DOMAIN1.TLD = .
+	}
 </pre>