3 ms·

> The same extends to anyone using password auth with LDAP. So don't do that. Use kerberos auth with LDAP, and use native kerberos support in apps, don't use k

• Pyxl101 10y ago
  > Use kerberos auth with LDAP Do you know of a good guide for how to set this up on Linux? Or a good book that covers the topic? I've looked into this before and it's seemed to be an absolute jungle. I'd like to explore setting this up at my company but don't know where to start. I'd be looking for something that's comparably easy to understand and employ as Facebook's recent post about SSH with certificates: https://code.facebook.com/posts/365787980419535/scalable-and-secure-access-with-ssh/ https://code.facebook.com/posts/365787980419535/scalable-and... What's the best straightforward way to set up LDAP, Kerberos, etc from scratch?
  • jlgaddis 10y ago
    You might look into FreeIPA [0]. [0]: https://www.freeipa.org/page/Main_Page https://www.freeipa.org/page/Main_Page
  • etcet 10y ago
    I recommend FreeIPA. You can find thorough documentation here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/introduction.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... You'd need to install and configure a FreeIPA server. They make it easy to setup master-master replication which you'll likely want to do. You'd create a user, add a HOTP secret (from a Yubikey or Authenticator app), and force the use of 2FA. Then once you add a client to the domain you'll have to log in using your password and a HOTP token.
  • emmelaich 10y ago
    There is no easy route to learning and using kerberos. That said, you could start with say the Redhat admin guides. https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Services.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... Most of it would be applicable to any modern Linux distro. (Speaking of someone who setup and maintained Kerberos authenticated webapps, clients and servers for the last 10 years, with Microsoft AD as the ultimate backend). As an aside AD is fine if you have someone to maintain it, but in the past various changes in AD, Linux and Java have made for interesting times.
• inferiorhuman 10y ago
  > So don't do that. Use kerberos auth with LDAP, and use native kerberos support in apps, don't use kerberos with pam. Or buy into the Hashicorp ecosystem and use Vault + one-time passwords (SSH) and dynamically generated credentials (everything else like database creds).
• Tharkun 10y ago
  Yeah, that sounds like a lot of fun for a masochist. As if LDAP isn't a big enough pain in the arse to set up, Kerberos is even worse. Not to mention how much of a pain it is to integrate it in an application.
  • 4ad 10y ago
    What's so hard about Kerberos? Kerberos is orders of magnitude easier to deploy and manage than LDAP. It takes literally minutes (if you have done it before and know what you are doing). In fact it's so easy, that I recommend anyone to use Kerberos even if they don't want to manage the complexity of LDAP. If you use NFS in any meaningful capacity, you have to implement Kerberos, even if you don't have LDAP, otherwise you're implementing a security footgun. Luckily, Kerberos is easy to set up in this configuration, without LDAP. It's true that LDAP+Kerberos is too hard to deploy and manage, but that's LDAP's fault, not Kerberos'. What important application doesn't have Kerberos support already? If you talk about adding Kerberos support to your own applications, I have that to be pretty easy.