| Table of Contents | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
What is Kerberos?
Kerberos is a network authentication protocol designed to provide secure authentication over insecure networks. It uses symmetric key cryptography to enable secure exchange of credentials between clients and servers, ensuring that both parties can trust each other without transmitting passwords. Kerberos relies on a trusted third-party service called the Key Distribution Center (KDC) to authenticate users and grant them "tickets" for accessing resources on the network.
Why Kerberos in PowerFolder?
In the PowerFolder.config the username and password is stored for the database connection, server-admin can select the ticket-authentication-method using Kerberos.
The advantage of using the Kerberos is that username and password is not required in the PowerFolder.config.
Preconditions
Create a Kerberos account, e.g. powerfolderdbadmin
Change the required settings, e.g. timezone, time-server and name server
Installation and Configuration
Please follow the following steps (Linux server):
...
| Code Block |
|---|
i[libdefaults]
default_realm = EXAMPLE.COM dns_lookup_realm = false dns_lookup_kdc = true
forwardable = yes
proxiable = true
rdns = false
permitted_enctypes = aes256-sha1 aes128-sha1
[domain_realm]
.example.com = EXAMPLE.COM example.com = EXAMPLE.COM
[realms]
EXAMPLE.COM = {
kdc = srv1.example.com
kdc = srv2.example.com
kdc = srv3.example.com
admin_server = srv1.example.com
} |
Update Password
| Code Block |
|---|
kpasswd powerfolderdbadmin@EXAMPLE.COM |
Create Keytab-Files
The hash of the password is saved in this file. The password should be the same in the ADS.
...
| Code Block |
|---|
ktutil add_entry -password -p powerfolderdbadmin@EXAMPLE.COM -k 1 -f list write_kt ~powerfolderdbadmin/powerfolderdbadmin.keytab quit |
Check the Keytab-File
| Code Block |
|---|
klist -keKCt ~powerfolderdbadmin/powerfolderdbadmin.keytab |
Check the authentication
| Code Block |
|---|
kinit -Vkt ~powerfolderdbadm/powerfolderdbadm.keytab powerfolderdbadmin@EXAMPLE.COM |
Check the ticket
| Code Block |
|---|
klist -CeA |
Download JDBC Driver for SQL Server
For msSQL Server 2022: https://learn.microsoft.com/en-us/sql/connect/jdbc/download-microsoft-jdbc-driver-for-sql-server?view=sql-server- ver16&viewFallbackFrom=sql-server-ver22
| Code Block |
|---|
wget -O sqljdbc.tgz https://go.microsoft.com/fwlink/?linkid=2283563 tar -xvzf sqljdbc.tgz cp sqljdbc_12.8/enu/jars/mssql-jdbc-12.8.1.jre11.jar ~powerfolderdbadm chmod 755 ~powerfolderdbadm/mssql-jdbc-12.8.1.jre11.ja chown powerfolderdbadm:powerfolderdbadm ~powerfolderdbadm/mssql-jdbc-12.8.1.jre11.jar |
Setup “Java Authentication and Authorization Service (JAAS)”
...
| Code Block |
|---|
SQLJDBCDriver { com.sun.security.auth.module.Krb5LoginModule required debug=false
principal=powerfolderdbadmin@EXAMPLE.COM renewTGT="true"
useTicketCache="true" useKeyTab="true"
keyTab="/home/powerfolderdbadm/powerfolderdbadm.keytab" doNotPrompt="true";
}; |
Update PowerFolder.config
| Code Block |
|---|
hibernate.connection.password= hibernate.connection.username= hibernate.connection.url=jdbc:sqlserver://sql.example.com:1433;databaseName=powerfolderdb;encrypt=true;integratedSecurity=true;trustServerCertificate=true;authenticationScheme=JavaKerberos;jaasConf igurationName=SQLJDBCDriver |
Change PowerFolder.sh
Use the new variable “KERBEROS" in the PowerFolder.sh
...