1 What is Kerberos?
2 Why Kerberos in PowerFolder?
3 Preconditions
4 Installation and Configuration
- - 4.1.1 Update Password
- 4.2 Create Keytab-Files
  - 4.2.1 Check the Keytab-File
  - 4.2.2 Check the authentication
  - 4.2.3 Check the ticket
5 Download JDBC Driver for SQL Server
6 Setup “Java Authentication and Authorization Service (JAAS)”
7 Update PowerFolder.config
8 Change PowerFolder.sh

What is Kerberos?

Kerberos is a network authentication protocol designed to provide secure authentication over insecure networks. It uses symmetric key cryptography to enable secure exchange of credentials between clients and servers, ensuring that both parties can trust each other without transmitting passwords. Kerberos relies on a trusted third-party service called the Key Distribution Center (KDC) to authenticate users and grant them "tickets" for accessing resources on the network.

Why Kerberos in PowerFolder?

In the PowerFolder.config the username and password is stored for the database connection, server-admin can select the ticket-authentication-method using Kerberos.

The advantage of using the Kerberos is that username and password is not required in the PowerFolder.config.

Preconditions

Create a Kerberos account, e.g. powerfolderdbadmin
Change the required settings, e.g. timezone, time-server and name server

Installation and Configuration

Please follow the following steps (Linux server):

apt update; apt -y upgrade; root@kerbtest:~# apt install -y krb5-user
cat > /etc/krb5.conf

Change the configuration as follows:

Please take care of the case-sensitive behaviour of the REALM-entries

i[libdefaults]
default_realm	= EXAMPLE.COM dns_lookup_realm	= false dns_lookup_kdc	= true
forwardable	= yes
proxiable	= true
rdns	= false
permitted_enctypes = aes256-sha1 aes128-sha1

[domain_realm]
.example.com	= EXAMPLE.COM example.com	= EXAMPLE.COM

[realms]
EXAMPLE.COM  =  {
                  kdc = srv1.example.com
                  kdc = srv2.example.com 
                  kdc = srv3.example.com
                  admin_server = srv1.example.com
                }

Update Password

kpasswd powerfolderdbadmin@EXAMPLE.COM

Create Keytab-Files

The hash of the password is saved in this file. The password should be the same in the ADS.

Follow the steps:

Check the Keytab-File

Check the authentication

Check the ticket

Download JDBC Driver for SQL Server

For msSQL Server 2022: https://learn.microsoft.com/en-us/sql/connect/jdbc/download-microsoft-jdbc-driver-for-sql-server?view=sql-server- ver16&viewFallbackFrom=sql-server-ver22

Setup “Java Authentication and Authorization Service (JAAS)”

https://docs.oracle.com/javase/8/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/Krb5LoginModule.html

cat > ~powerfolderdbadm/jaas.conf

Update PowerFolder.config

Change PowerFolder.sh

Use the new variable “KERBEROS" in the PowerFolder.sh

Database Connection using Kerberos