2 Chapter 28. Using Kerberos with Amanda
3 Prev Part V. Technical Background Next
5 -------------------------------------------------------------------------------
7 Chapter 28. Using Kerberos with Amanda
17 XML-conversion;Updates
23 Amanda_2.5.0_-_KERBEROS_v4_SUPPORT_NOTES
33 Amanda_2.5.0_-_KERBEROS_v5_SUPPORT_NOTES
42 Destination_Host_Permissions_file
48 Refer to http://www.amanda.org/docs/kerberos.html for the current version of
51 Amanda 2.5.0 - KERBEROS v4 SUPPORT NOTES
56 The configure script defaults to:
58 # define SERVER_HOST_PRINCIPLE "amanda"
59 # define SERVER_HOST_INSTANCE ""
60 # define SERVER_HOST_KEY_FILE "/.amanda"
62 # define CLIENT_HOST_PRINCIPLE "rcmd"
63 # define CLIENT_HOST_INSTANCE HOSTNAME_INSTANCE
64 # define CLIENT_HOST_KEY_FILE KEYFILE
66 # define TICKET_LIFETIME 128
69 You can override these with configure options if you so desire, with:
71 --with-server-principal=ARG server host principal [amanda]
72 --with-server-instance=ARG server host instance []
73 --with-server-keyfile=ARG server host key file [/.amanda]
74 --with-client-principal=ARG client host principal [rcmd]
75 --with-client-instance=ARG client host instance
77 --with-client-keyfile=ARG client host key file [KEYFILE]
78 --with-ticket-lifetime=ARG ticket lifetime [128]
81 The configure script will search under /usr/kerberos/lib, /usr/cygnus/lib, /
82 usr/lib, and /opt/kerberos/lib for libkrb.a. (in that order) for the kerberos
83 bits. If it finds them, kerberos support will be added in, if it doesn't, it
84 won't. If the kerberos bits are found under some other hierarchy, you can
85 specify this via the --with-krb4-security=DIR, where DIR is where the kerberos
86 bits live. It'll look under the 'lib' directory under this hierarchy for
91 The kerberized Amanda service uses a different port on the client hosts. The /
97 And the /etc/inetd.conf line is:
99 kamanda dgram udp wait root /usr/local/libexec/amanda/amandad amandad -
103 Note that you're running this as root, rather than as your dump user. Amanda
104 will set it's uid down to the dump user at times it doesn't need to read the
105 srvtab file, and give up root permissions entirely before it goes off and runs
106 dump. Alternately you can change your srvtab files to be readable by user
111 The following dumptype options apply to krb4:
113 auth "krb4" # use krb4 auth for this host
114 # (you can mingle krb hosts & bsd .rhosts in one conf)
115 kencrypt # encrypt this filesystem over the net using the krb4
116 # session key. About 2x slower. Good for those root
117 # partitions containing your keyfiles. Don't want to
118 # give away the keys to an ethernet sniffer!
119 # This is currently always enabled. There is no
120 # way to disable it. This is a bug.
124 Amanda 2.5.0 - KERBEROS v5 SUPPORT NOTES
129 You must specify --with-krb5-security to configure, otherwise there will be no
130 attempt to look for kerberos binaries. You may specify a path that the system
131 should look for the kerberos libraries, or leave it to the default.
132 By default, when --with-krb5-security is specified with with no path, the
133 configure script will search under /usr/kerberos/lib, /usr/cygnus/lib, /usr/
134 lib, and /opt/kerberos/lib for libkrb.a. (in that order) for the kerberos bits.
135 If it finds them, kerberos support will be added in, if it doesn't, it won't.
136 If the kerberos bits are found under some other hierarchy, you can specify this
137 via the --with-krb5-security=DIR, where DIR is where the kerberos bits live.
138 It'll look under the 'lib' directory under this hierarchy for libkrb.a.
139 The krb5 driver script defaults to:
142 * The lifetime of our tickets in minutes.
144 #define Amanda_TKT_LIFETIME (12*60)
147 * The name of the service in /etc/services.
149 #define Amanda_KRB5_SERVICE_NAME "k5amanda"
152 You can currently only override these by editing the source.
153 The principal and keytab file that the amanda uses are genearlly set in the
154 amanda.conf file (see below). You can hardcode this in the source if you really
155 want to and that's described in common-src/krb5-security.c
159 The kerberized Amanda service uses a different port on the client hosts. The /
160 etc/services line is:
165 And the /etc/inetd.conf line is:
167 k5amanda stream tcp nowait root /usr/local/libexec/amanda/amandad amandad -
171 Note that you're running this as root, rather than as your dump user. Amanda
172 will set it's uid down to the dump user at times it doesn't need to read the
173 keytab file, and give up root permissions entirely before it goes off and runs
174 dump. Alternately you can change your keytab files to be readable by user
175 amanda. You should understand the security implications of this before changing
176 the permissions on the keytab.
180 The following dumptype options apply to krb5:
182 auth "krb5" # use krb5 auth for this host
183 # (you can mingle krb hosts & bsd .rhosts in one conf)
186 The following two configuration directives are required in the amanda.conf file
187 for kerberos 5 dumps to work:
195 krb5keytab "/etc/krb5.keytab-amanda"
196 krb5principal "amanda/saidin.omniscient.com"
199 The principal in the second option must be contained in the first. The keytab
200 should be readable by the amanda user. (and definitely not world readable!)
201 This is (obviously) on the server. In MIT's kadmin, the following:
203 addprinc -randkey amanda/saidin.omniscient.com
204 ktadd -k /etc/krb5.keytab-amanda amanda/saidin.omniscient.com
207 will do the trick. You will obviously want to change the principal name to
208 reflect something appropriate for the conventions at your site.
209 You must also configure each client to allow the amanda principal in for dumps.
210 This is described in section 4.
212 Destination Host Permissions file
214 There are several ways to go about authorizing a server to connect to a client.
215 The normal way is via a .k5amandausers file or a .k5login file in the client
216 user's home directory. The determination of which file to use is based on the
217 way you ran configure on Amanda. By default, Amanda will use .k5amandahosts,
218 but if you configured with --without-amandahosts, Amanda will use .k5login.
219 (similar to the default for .rhosts/.amandahosts-style security). The .k5login
220 file syntax is a superset of the default krb5 .k5login. The routines to check
221 it are implemented in amanda rather than using krb5_kuserok because the
222 connections are actually gssapi based.
223 This .k5amandahosts/.k5login is a hybrid of the .amandahosts and a .k5login
224 file. You can just list principal names, as in a .k5login file and the
225 principal will be permitted in from any host. If you do NOT specify a realm,
226 then there is no attempt to validate the realm (this is only really a concern
227 if you have cross-realm authentication set up with another realm or something
228 else that allows you multiple realms in your kdc. If you do specify a realm,
229 only that principal@realm will be permitted to connect.
230 You may prepend this with a hostname and whitespace, and only that principal
231 (with optional realm as above) will be permitted to access from that hostname.
232 Here are examples of valid entries in the .k5amandahosts:
235 service/amanda@TEST.COM
236 dumpmaster.test.com service/amanda
237 dumpmaster.test.com service/amanda@TEST.COM
240 Rather than using a .k5amandahosts or .k5login file, the easiest way is to use
241 a principal named after the destination user, (such as amanda@TEST.COM in our
242 example) and not have either a .k5amandahosts or .k5login file in the
243 destination user's home directory.
247 There is no attempt to verify the realm in this case (only a concern if you
248 have cross-realm authentication setup).
249 -------------------------------------------------------------------------------
252 Chapter 27. Virtual Tape API Home Part VI. Historical files