用户觉得重新编译内核，对已使用的应用软件具有不确定性。测试Kerveros。

建议文档：
http://www.itp.uzh.ch/~dpotter/howto/kerberos
http://media.netapp.com/documents/tr-3764.pdf
http://media.netapp.com/documents/tr-3481.pdf

KDC配置

1. 编辑/etc/krb5.conf，如下所示
[logging]
 default = FILE:/var/log/krb5libs.log
 kdc = FILE:/var/log/krb5kdc.log
 admin_server = FILE:/var/log/kadmind.log

[libdefaults]
 default_realm = LAB.EXAMPLE.SH.CN
 dns_lookup_realm = false
 dns_lookup_kdc = false
 ticket_lifetime = 24h
 forwardable = yes

[realms]
 LAB.EXAMPLE.SH.CN= {
  kdc = krbserver.lab.example.sh.cn:88
  admin_server = krbserver.lab.example.sh.cn:749
  default_domain = lab.example.sh.cn
 }

[domain_realm]
 .lab.example.sh.cn = LAB.EXAMPLE.SH.CN
 lab.example.sh.cn = LAB.EXAMPLE.SH.CN

[appdefaults]
 pam = {
   debug = false
   ticket_lifetime = 36000
   renew_lifetime = 36000
   forwardable = true
   krb4_convert = false
 }

2. 编辑/var/kerberos/krb5kdc/kdc.conf，如下所示
[kdcdefaults]
 v4_mode = nopreauth
 kdc_tcp_ports = 88

[realms]
 LAB.EXAMPLE.SH.CN = {
  #master_key_type = des3-hmac-sha1
  acl_file = /var/kerberos/krb5kdc/kadm5.acl
  dict_file = /usr/share/dict/words
  admin_keytab = /var/kerberos/krb5kdc/kadm5.keytab
  supported_enctypes = des3-hmac-sha1:normal arcfour-hmac:normal des-hmac-sha1:normal des-cbc-md5:normal des-cbc-crc:normal des-cbc-crc:v4 des-cbc-crc:afs3
 }

3.编辑/var/kerberos/krb5kdc/kadm5.acl，如下所示：
*/admin@LAB.EXAMPLE.SH.CN        *

4.创建kerberos database
/usr/kerberos/sbin/kdb5_util create -s

5.创建管理用户
kadmin.local -q "addprinc root/admin"
需要设置一个口令，以后管理时需要输入该口令

6.启动相应服务
chkconfig kadmin on
service kadmin start
chkconfig krb5kdc on
service krb5kdc start

Kerveros客户端配置

1.从KDC复制krb5.conf
scp krbserver:/etc/krb5.conf /etc

2.添加相关principals
先运行kadmin，然后执行下面的子命令
addprinc -randkey -e des-cbc-crc:normal nfs/krbclient.lab.example.sh.cn@LAB.EXAMPLE.SH.CN

3.导出key到/etc/krb5.keytab
先运行kadmin，然后执行下面的子命令
ktadd -k /etc/krb5.keytab -e des-cbc-crc:normal nfs/krbclient.lab.example.sh.cn

存储端配置

1.从KDC复制krb5.conf
可以将存储的/vol/vol0目录mount到krbserver，然后进行复制

2.添加相关principals
在krbserver，先运行kadmin，然后执行下面的子命令
addprinc -randkey -e des-cbc-crc:normal nfs/fas3020b.lab.example.sh.cn@LAB.EXAMPLE.SH.CN

3.导出key到/tmp/UNIX_krb5.keytab，并复制到存储
在krbserver，先运行kadmin，然后执行下面的子命令
ktadd -k /tmp/UNIX_krb5.keytab -e des-cbc-crc:normal nfs/fas3020b.lab.example.sh.cn

4.存储端NFS设置
fas3020b*> nfs setup
Enable Kerberos for NFS? y
The filer supports these types of Kerberos Key Distribution Centers (KDCs):

        1 - UNIX KDC
        2 - Microsoft Active Directory KDC

Enter the type of your KDC (1-2):  1
Enter the Kerberos realm name: LAB.EXAMPLE.SH.CN
Enter the host instance of the NFS server principal name [default: fas3020b.lab.example.sh.cn]:
NFS setup complete.

确认以下的nfs options
fas3020b*> options nfs.kerberos
nfs.kerberos.enable          on
nfs.kerberos.file_keytab.enable on
nfs.kerberos.principal       fas3020b.lab.example.sh.cn
nfs.kerberos.realm           LAB.EXAMPLE.SH.CN

fas3020b*> options nfs.v4
nfs.v4.acl.enable            off        (value might be overwritten in takeover)
nfs.v4.enable                on         (value might be overwritten in takeover)
nfs.v4.id.domain             localdomain
nfs.v4.read_delegation       off        (value might be overwritten in takeover)
nfs.v4.write_delegation      off        (value might be overwritten in takeover)

5.配置export的卷，使用kerberos
/vol/cjeff      -sec=krb5:krb5i:krb5p,rw,root=10.128.13.0/24

NFS客户端配置
krbclient同时为NFS的客户端。

1.修改/etc/sysconfig/nfs
将
#SECURE_NFS="yes"
修改为
SECURE_NFS="yes"

2. 启动rpc.gssd服务
service rpcgssd start

3. 配置相应的passwd和group文件
/etc/passwd文件内容为：
cjeff:x:501:502::/home/cjeff:/bin/bash
jeff:x:502:522::/home/jeff:/bin/bash
jfcai:x:503:523::/home/jfcai:/bin/bash

/etc/group文件内容为：
test1:x:502:cjeff
test2:x:503:cjeff
test3:x:504:cjeff
test4:x:505:cjeff
test5:x:506:cjeff
test6:x:507:cjeff
test7:x:508:cjeff
test8:x:509:cjeff
test9:x:510:cjeff
test10:x:511:cjeff
test11:x:512:cjeff
test12:x:513:cjeff
test13:x:514:cjeff
test14:x:515:cjeff
test15:x:516:cjeff
test16:x:517:cjeff
test16:x:517:cjeff
test17:x:518:cjeff
test18:x:519:cjeff
test19:x:520:cjeff
test20:x:521:cjeff
test21:x:522:cjeff,jeff
jfcai:x:523:

4.增加用户的principals
[root@krbclient ~]# kadmin
Authenticating as principal root/admin@LAB.EXAMPLE.SH.CN with password.
Password for root/admin@LAB.EXAMPLE.SH.CN:
kadmin:  addprinc cjeff@LAB.EXAMPLE.SH.CN
WARNING: no policy specified for cjeff@LAB.EXAMPLE.SH.CN; defaulting to no policy
Enter password for principal "cjeff@LAB.EXAMPLE.SH.CN":
Re-enter password for principal "cjeff@LAB.EXAMPLE.SH.CN":
Principal "cjeff@LAB.EXAMPLE.SH.CN" created.

5.访问相应目录
[root@krbclient ~]# su - cjeff
-bash-3.2$ kinit
Password for cjeff@LAB.EXAMPLE.SH.CN:
-bash-3.2$ ls -l /home
total 12
drwxr-xr-x 2 cjeff test1  4096 Jan 17 17:19 cjeff
drwx------ 3 jfcai jfcai  4096 Jan 17 17:13 jfcai
drwxrwx--- 4 jeff  test21 4096 Jan  5 14:28 test
-bash-3.2$ cd /home/test
-bash-3.2$ ls -l
total 4
drwxrwx--- 2 jeff test21 4096 Jan  5 14:28 1

说明：需要手工将用户添加到KDC，并且在访问目录前需要手工运行kinit，并输入将用户添加到KDC时输入的口令。

补充：
通过System->Administration->Authentication，可以设置使用Kerberos进行Authentication，这样就不需要
手工运行kinit了。
http://s11/middle/716c1cc8gb6b88208c63a&690