Novell Kerberos KDC

July 1, 2005
1.0 Installation
1.1 Prerequisites
1.2 Installing Novell Kerberos KDC
2.0 Known Issues and Limitations
2.1 kadmin Issues
2.1.1 The keepold Option in cpw
2.1.2 The history option in Password Policy
2.2 kadmin.local Installation Issue
2.3 Creating Realms and Service Principals
2.4 iManager Issues
2.5 Unsupported Characters in Principal Names
2.6 eDirectory Login and Account Policies
2.7 Log File Size Issue
2.8 Realm Subtree Issue in kdb5_util
2.9 Password and Ticket Policy Object outside the Subtree
3.0 Documentation
4.0 Documentation Conventions
5.0 Legal Notices


1.0 Installation


1.1 Prerequisites

  • One of the following:
    • Open Enterprise Server (OES) 9.0
    • SLES 9
    • SLES 8
    • Red Hat* Advanced Server 3
  • Novell eDirectoryTM 8.7.3 or later on Linux
  • Root privileges to install Novell Kerberos KDC
  • Synchronize network server time

    You must synchronize the time on eDirectory, KDC, Administrator server, Password server, kerberized applications, and the client hosts.For information on synchronizing network time, refer to the Novell eDirectory 8.7.3 Administration Guide.

For installing iManager plug-ins:


1.2 Installing Novell Kerberos KDC

Download and untar the NovellKDC.tar.gz file from the Novell download site.

Execute the following command from the untarred_path/NovellKerberosKDC/setup directory:

./kdc-install

For more information on the installation and configuration, refer to the Novell Kerberos KDC Quick Start Guide available with the product.


2.0 Known Issues and Limitations


2.1 kadmin Issues


2.1.1 The keepold Option in cpw

The keepold option in cpw is currently not supported.


2.1.2 The history option in Password Policy

Irrespective of the value for "history" (number of old passwords to be maintained) in the password policy for a principal, Kerberos password management utilities consider only the previous password. The reason is that the old keys are not kept.


2.2 kadmin.local Installation Issue

When you install Kerberos Clients separately on a system, kadmin.local does not load. This happens because some dependent files are not installed.

To work around this problem, you need to manually install the novell-kerberos-base package available in the untarred_path/NovellKerberosKDC/setup directory as follows:

rpm -Uvh novell-kerberos-base-1.0.1.i386.rpm

To run kadmin.local, you need to export the LD_LIBRARY_PATH as follows:

export LD_LIBRARY_PATH=/opt/novell/kerberos/lib:/opt/novell/ lib:$LD_LIBRARY_PATH


2.3 Creating Realms and Service Principals

Realm and Service principal names are case insensitive. Therefore, you cannot have two Realms or Service principals of the same name and different only in case.


2.4 iManager Issues

  • Stashing the password for Service objects of KDC, Administration Server and Password Server is not supported.

    Use kdb5_util to perform this operation (setsrvpw command)

  • If the Principals have more than one key the Export key task does not work.
  • Deleting user principals by selecting options such as "Select Multiple Objects" or "Advanced Selection" is not supported.
  • Delete Principal task works only with Single Object selection.
  • Set Password task does not update the History.


2.5 Unsupported Characters in Principal Names

  • Principal names cannot have the special characters + \ / # as the first character.
  • If you are creating a principal name that contains \ include escape character(\) before it.


2.6 eDirectory Login and Account Policies

eDirectory Login and Account policies are currently not enforced for Kerberos principals, except for Login Disabled, Login Expiration Time and Password Expiration Time.


2.7 Log File Size Issue

The size of the Kerberos services (KDC, Administration Server, Password Server) log file cannot exceed 2 GB.


2.8 Realm Subtree Issue in kdb5_util

Realm creation using kdb5_util fails when a locality or a country object is made as the subtree for the realm. But, the realm can be created without setting the subtree and later modifying it to set a locality or country object as the subtree.


2.9 Password and Ticket Policy Object outside the Subtree

If the Password and Ticket Policy object is outside the subtree and is attached to a Principal or a Realm, then ensure that the KDC service, Admin service and Password service objects have sufficient rights over the Password and Ticket Policy object.


3.0 Documentation

The Novell Kerberos KDC documentation is present at the Novell Documentation Website.


4.0 Documentation Conventions

In this documentation, a greater-than symbol (>) is used to separate actions within a step and items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark; an asterisk (*) denotes a third-party trademark.


5.0 Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.

You may not use, export, or re-export this product in violation of any applicable laws or regulations including, without limitation, U.S. export regulations or the laws of the country in which you reside.

Copyright © 2005 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents/ and one or more additional patents or pending patent applications in the U.S. and in other countries.

eDirectory is a registered trademark of Novell, Inc.

NMAS is a registered trademark of Novell, Inc.

Novell is a registered trademark of Novell, Inc. in the United States and other countries.

Novell Directory Services and NDS are registered trademarks of Novell, Inc. in the United States and other countries.

SUSE is a registered trademark of SUSE LINUX AG, a Novell business.

All third-party trademarks are the property of their respective owners.

Copyright © 1985-2002 by the Massachusetts Institute of Technology. Export of software employing encryption from the United States of America may require a specific license from the United States Government. It is the responsibility of any person or organization contemplating export to obtain such a license before exporting.

WITHIN THAT CONSTRAINT, permission to use, copy, modify, and distribute this software and its documentation for any purpose and without fee is hereby granted, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of M.I.T. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Furthermore if you modify this software you must label your software as modified software and not distribute it in such a fashion that it might be confused with the original MIT software. M.I.T. makes no representations about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty.

The implementation of the Yarrow pseudo-random number generator in src/lib/crypto/yarrow has the following copyright:

Copyright 2000 by Zero-Knowledge Systems, Inc.

Permission to use, copy, modify, distribute, and sell this software and its documentation for any purpose is hereby granted without fee, provided that the above copyright notice appear in all copies and that both that copyright notice and this permission notice appear in supporting documentation, and that the name of Zero-Knowledge Systems, Inc. not be used in advertising or publicity pertaining to distribution of the software without specific, written prior permission. Zero-Knowledge Systems, Inc. makes no representations about the suitability of this software for any purpose. It is provided "as is" without express or implied warranty.

ZERO-KNOWLEDGE SYSTEMS, INC. DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE, INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS, IN NO EVENT SHALL ZERO-KNOWLEDGE SYSTEMS, INC. BE LIABLE FOR ANY SPECIAL, INDIRECT OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTUOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

Kerberos V5 includes documentation and software developed at the University of California at Berkeley, which includes this copyright notice: Copyright © 1983 Regents of the University of California. All rights reserved.

Redistribution and use in source and binary forms, with or without modification, are permitted provided that the following conditions are met: Redistributions of source code must retain the above copyright notice, this list of conditions and the following disclaimer. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and the following disclaimer in the documentation and/or other materials provided with the distribution. All advertising materials mentioning features or use of this software must display the following acknowledgement: This product includes software developed by the University of California, Berkeley and its contributors. Neither the name of the University nor the names of its contributors may be used to endorse or promote products derived from this software without specific prior written permission.

Permission is granted to make and distribute verbatim copies of this manual provided the copyright notices and this permission notice are preserved on all copies.

Permission is granted to copy and distribute modified versions of this manual under the conditions for verbatim copying, provided also that the entire resulting derived work is distributed under the terms of a permission notice identical to this one.

Permission is granted to copy and distribute translations of this manual into another language, under the above conditions for modified versions.