3 ms·

> Use kerberos auth with LDAP Do you know of a good guide for how to set this up on Linux? Or a good book that covers the topic? I've looked into this before a

by Pyxl101 10y ago

> Use kerberos auth with LDAP Do you know of a good guide for how to set this up on Linux? Or a good book that covers the topic? I've looked into this before and it's seemed to be an absolute jungle. I'd like to explore setting this up at my company but don't know where to start. I'd be looking for something that's comparably easy to understand and employ as Facebook's recent post about SSH with certificates: https://code.facebook.com/posts/365787980419535/scalable-and-secure-access-with-ssh/ https://code.facebook.com/posts/365787980419535/scalable-and... What's the best straightforward way to set up LDAP, Kerberos, etc from scratch?

jlgaddis 10y ago
You might look into FreeIPA [0]. [0]: https://www.freeipa.org/page/Main_Page https://www.freeipa.org/page/Main_Page
etcet 10y ago
I recommend FreeIPA. You can find thorough documentation here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/introduction.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... You'd need to install and configure a FreeIPA server. They make it easy to setup master-master replication which you'll likely want to do. You'd create a user, add a HOTP secret (from a Yubikey or Authenticator app), and force the use of 2FA. Then once you add a client to the domain you'll have to log in using your password and a HOTP token.
emmelaich 10y ago
There is no easy route to learning and using kerberos. That said, you could start with say the Redhat admin guides. https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Services.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... Most of it would be applicable to any modern Linux distro. (Speaking of someone who setup and maintained Kerberos authenticated webapps, clients and servers for the last 10 years, with Microsoft AD as the ultimate backend). As an aside AD is fine if you have someone to maintain it, but in the past various changes in AD, Linux and Java have made for interesting times.

by Pyxl101 10y ago

jlgaddis 10y ago

You might look into FreeIPA [0]. [0]: https://www.freeipa.org/page/Main_Page https://www.freeipa.org/page/Main_Page

etcet 10y ago

I recommend FreeIPA. You can find thorough documentation here: https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/Linux_Domain_Identity_Authentication_and_Policy_Guide/introduction.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... You'd need to install and configure a FreeIPA server. They make it easy to setup master-master replication which you'll likely want to do. You'd create a user, add a HOTP secret (from a Yubikey or Authenticator app), and force the use of 2FA. Then once you add a client to the domain you'll have to log in using your password and a HOTP token.

emmelaich 10y ago

There is no easy route to learning and using kerberos. That said, you could start with say the Redhat admin guides. https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/System-Level_Authentication_Guide/Configuring_Services.html https://access.redhat.com/documentation/en-US/Red_Hat_Enterp... Most of it would be applicable to any modern Linux distro. (Speaking of someone who setup and maintained Kerberos authenticated webapps, clients and servers for the last 10 years, with Microsoft AD as the ultimate backend). As an aside AD is fine if you have someone to maintain it, but in the past various changes in AD, Linux and Java have made for interesting times.