HowToSetupFermiKrb < Main

Tags: view all tags
---+ How to setup Fermi Krberos

Desktop PC&#x3092;static IP&#x3067;&#x30EC;&#x30B8;&#x30B9;&#x30BF;&#x30FC;&#x3059;&#x308B;&#x3002;

http://appora.fnal.gov/pls/default/node_registration.html

&#x3053;&#x306E;&#x6642;subnet/Area&#x306F;&#x3001;&#x4F8B;&#x3048;&#x3070;131.225.176.0 &#x3068;&#x304B;&#x306B;&#x3059;&#x308B;&#x3002;

sshd &#x3092;disable&#x3057;&#x3066;&#x30CD;&#x30C3;&#x30C8;&#x30EF;&#x30FC;&#x30AF;&#x306B;&#x7D99;&#x3050;

/etc/sshd_config &#x306E;&#x8A2D;&#x5B9A;&#x3092;&#x4EE5;&#x4E0B;&#x306E;&#x3088;&#x3046;&#x306B;&#x5909;&#x66F4;(CernCentOS7&#x306E;&#x4F8B;)
<verbatim>--- sshd_config    2019-02-19 17:13:33.599951233 +0100
+++ sshd_config_orig    2019-02-19 05:51:14.000000000 +0100
@@ -39,7 +39,7 @@
 #Authentication:
 
 #LoginGraceTime 2m
-PermitRootLogin no
+PermitRootLogin yes
 #StrictModes no
 #MaxAuthTries 6
 #MaxSessions 10
@@ -66,7 +66,7 @@
 PasswordAuthentication no
 
 # Change to no to disable s/key passwords
-ChallengeResponseAuthentication no
+ChallengeResponseAuthentication yes
 
 # Kerberos options
 #KerberosAuthentication no
@@ -80,7 +80,7 @@
 #GSSAPICleanupCredentials yes
 GSSAPICleanupCredentials yes
 #GSSAPIStrictAcceptorCheck yes
-GSSAPIKeyExchange yes
+#GSSAPIKeyExchange no
 
 # Set this to 'yes' to enable PAM authentication, account processing,
 # and session processing. If this is enabled, PAM authentication will
@@ -91,7 +91,7 @@
 # If you just want the PAM account and session checks to run without
 # PAM authentication, then enable this but set PasswordAuthentication
 # and ChallengeResponseAuthentication to 'no'.
-UsePAM no
+UsePAM yes
 
 # Accept locale-related environment variables
 AcceptEnv LANG LC_CTYPE LC_NUMERIC LC_TIME LC_COLLATE LC_MONETARY LC_MESSAGES

</verbatim>

&#x3053;&#x308C;&#x3067;sshd &#x3092;enable&#x3057;&#x3066;&#x3001;&#x4ED6;&#x306E;PC&#x304B;&#x3089;&#x30ED;&#x30B0;&#x30A4;&#x30F3;&#x3092;&#x3057;&#x3066;&#x307F;&#x308B;&#x3002;

passwd &#x3092;&#x805E;&#x304B;&#x308C;&#x305F;&#x3089;kerberize &#x3055;&#x308C;&#x3066;&#x306A;&#x3044;&#x306E;&#x3067;&#x76F4;&#x306B;sshd &#x3092;&#x30AA;&#x30D5;&#x306B;&#x3059;&#x308B;&#x3002;&#x6B63;&#x3057;&#x304F;&#x8A2D;&#x5B9A;&#x3067;&#x304D;&#x3066;&#x3044;&#x308B;&#x3068;&#x3001;
<literal>Permission denied (publickey,gssapi-keyex,gssapi-with-mic).<br /><br /></literal>

access &#x3057;&#x305F;&#x3044;&#x30DE;&#x30B7;&#x30FC;&#x30F3;&#x3092;kerberize&#x3059;&#x308B;&#x305F;&#x3081;&#x306B;&#x7533;&#x8ACB;&#x3092;&#x51FA;&#x3059;&#x3002;

https://fermi.service-now.com/wp/?id=evg_home

&#x3053;&#x3053;&#x3067;&#x3001; access to kerberized Machines &#x3092;&#x30B5;&#x30FC;&#x30C1;&#x3057;&#x3066;&#x3001;&#x7533;&#x8ACB;&#x753B;&#x9762;&#x3067;&#x3001;Host and FTP Principals&#x306B;&#x30C1;&#x30A7;&#x30C3;&#x30AF;host&#x540D;&#x3092;&#x5165;&#x308C;&#x3066;submit

passwd&#x304C;&#x3067;&#x304D;&#x305F;&#x3089;&#x3001;

kadmin -p host/atlaspc10.fnal.gov -q "ktadd host/atlaspc10.fnal.gov"<br />&#x3067;&#x30D1;&#x30B9;&#x30EF;&#x30FC;&#x30C9;&#x3092;&#x6253;&#x3063;&#x3066;&#x767B;&#x9332;&#x3002;(&#x4E00;&#x5EA6;&#x9593;&#x9055;&#x3048;&#x308B;&#x3068;&#x4E8C;&#x5EA6;&#x3068;&#x4F7F;&#x3048;&#x306A;&#x3044;&#x306E;&#x3067;&#x6CE8;&#x610F;)

&#x30AF;&#x30E9;&#x30A4;&#x30A2;&#x30F3;&#x30C8;&#x306E;PC&#x3067; kinit [user]@FNAL.GOV &#x3067;&#x30D1;&#x30B9;&#x30EF;&#x30FC;&#x30C9;&#x3092;&#x6253;&#x3064;&#x3001;&#x3042;&#x3068;&#x306F;&#x666E;&#x901A;&#x306B;ssh &#x3067;&#x30ED;&#x30B0;&#x30A4;&#x30F3;&#x3067;&#x304D;&#x308B;&#x3002;

-- %USERSIG{KojiNakamura - 2019-02-19}%

---++ Comments

%COMMENT%
Topic revision: r1 - 2019-02-19 - KojiNakamura