-I am not the right person to write this page but here is a start:
+Kerberos is a network authentication system which is available for Unix, Windows, Macintosh, and I'm sure lots of other platforms.
-The MIT web site for Kerberos is <http://web.mit.edu/kerberos/www>. The FAQ is at <http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html>.
+How does this relate to [[OpenAFS]]? [[OpenAFS]] uses Kerberos to perform strong authentication for clients connecting to the AFS filespace. If you're new to Kerberos, you should take a look at the Kerberos FAQ located at <http://www.nrl.navy.mil/CCS/people/kenh/kerberos-faq.html>. For the impatient, a quick list of useful Kerberos-related terms will be available at [[KerberosTerms]].
-[[KenHornstein]]'s AFS-Kerberos5 migration toolkit is here: <ftp://ftp.cmf.nrl.navy.mil/pub/kerberos5/>.
+Note that there are two versions of Kerberos in wide usage. The latest is [[KerberosV]], but AFS, for historical reasons, uses a modified version of Kerberos 4 (see [[KaServer]]). However, AFS can be integrated into a [[KerberosV]] realm, and in fact is highly suggested for any new installations of AFS. See [[SettingUpAuthentication]].
--- [[TedAnderson]] - 22 Jan 2002
+Installing [[KerberosV]] along with [[OpenAFS]] will provide the basis for many other very cool features, such as a single repository for all authentication information for an administrative domain, integration with the Windows 2000/XP login mechanism, and even single-sign-on capability. Note that the further down you get in that list, the harder things become. :)
+
+The installation documentation on the [[OpenAFS]] web site unfortunately does not include any information on integrating AFS into a [[KerberosV]] realm. (Work on install document & gotchas page later)
+
+If you already have a working AFS cell using [[KaServer]], check out [[DerrickBrashear]]'s document for converting from the [[KaServer]] to [[HeimdalKTH]] [here](http://lost-contact.mit.edu/afs/net/project/afs32/andrew.cmu.edu/usr/shadow/ka2heim.txt): <file:/afs/andrew.cmu.edu/usr/shadow/ka2heim.txt>
+
+For now a few links... explanations to follow later:
+
+- Setting up [[OpenSSH]] to use [[KerberosV]] authentication: you can either use PAM to authenticate people (boring) or you can add the patches at <http://www.sxw.org.uk/computing/patches/openssh.html> to use existing [[KerberosV]] tickets for single-sign-on and automatic ticket forwarding (interesting). Note that by default this patch won't grab tickets when logging in via password - post small patch to enable this later.
+- If you're having trouble with [[KenHornstein]]'s AFS-Kerberos5 migration kit available at <ftp://ftp.cmf.nrl.navy.mil/pub/kerberos5/>, see <http://www.mathematik.uni-karlsruhe.de/~iwrmm/Persons/Schulz/Unix/afs/afs-krb5.html> for tips. In particular check out the Makefile patches.
+- An older AFS link page: <http://www-2.cs.cmu.edu/afs/andrew.cmu.edu/usr/shadow/www/afs.html>
Some other issues to explain:
- encryption types -- this is a per key property and V5 supports several (while V4 only supported one, namely what V5 calls des-cbc-crc). However, this is not the V5 default (which I think is des3) so you need to ensure that the AFS principal uses des-cbc-crc.
- [[StringToKey]] differences
--- [[TedAnderson]] - 23 Jan 2002
+-- [[TedAnderson]] - 22 Jan 2002 -- [[DerrickBrashear]] - 23 Jan 2002 -- [[TedAnderson]] - 23 Jan 2002 -- [[JasonGarman]] - 30 Jan 2002 -- [[TedAnderson]] - 31 Jan 2002
----
git://git.openafs.org / openafs-wiki.git / blobdiff