FreeTDS Development Group

[Steve Langasek <vorlon AT netexpress.net>]

On Wed, Jun 12, 2002 at 07:43:43PM -0400, James K. Lowden wrote:

> > > LDAP is not bad actually, when used within a certain context, like
> > > user information.  Where I work it's hard to remember not being able
> > > to pull user info from a central store.  Using it as a corporate-wide 
> > > authentication source is very compelling.

> > Nah, LDAP isn't a good fit for authentication, even though people are
> > making it work.  LDAP is designed as a /directory/ service, with all
> > that implies (semi-public, etc).  For a centralized authentication
> > source, use Kerberos instead. :)

> Once upon a time (remember those long domain-login discussions?) I thought
> maybe we'd emulate domain logins with Kerberos.  AFAIK, Sybase still
> relies 100% on clear text passwords, but that's no reason to have to embed
> them in scripts and whatnot.  

At some point, using Kerberos for domain logins will no longer be
'emulation', since Active Directory is built entirely on top of
Kerberos.  Would that we only had to worry about supporting Kerberos,
and not NTLM! :)

> But I'm still looking for the Kerberos document for People Who Don't Care
> Very Much.  The Kerberos folks, bless their untrusting little hearts, want
> to authenticate everything and everyone, which is fine I guess, but the
> learning curve looks like the face of Mount Rushmore to me.  :/

I occasionally tease the maintainer of the Debian Kerberos packages for
making it /too/ easy to set up a Kerberos realm: you install the
'krb5-admin-server' package; run /usr/sbin/krb5_newrealm to create the
realm; add your initial admin principal with
kadmin.local -q "addprinc jklowden/admin"

; uncomment the suggested line from /etc/krb5kdc/kadm5.acl; and start
creating service principals on each of your servers with

kadmin -p jklowden/admin -q "addprinc -randkey host/<fqdn>"
kadmin -p jklowden/admin -q "ktadd host/<fqdn>"

.

Is that concise enough for People Who Don't Care Very Much? :)

Steve Langasek
postmodern programmer

Attachment: pgp1wGOJ0zQdi.pgp
Description: PGP signature