1

I've inherited a Fedora Linux system running Kerberos, and I'm trying to create a new user. I've been able to bring up the kadmin prompt, and I'm trying to create the user NewUser, so I tried issuing the command:

ank -policy users NewUser

but I get the error message:

add_principal: Policy does not exist while creating "NewUser@mydomain.com".

I then tried:

addprinc NewUser

and this seemed to succeed, but when I try logging into the other machines on our Kerberos domain using this new account, I get a permission denied error. What else do I have to do to create a new Kerberos user?

Cerin
  • 3,497
  • 17
  • 57
  • 72

1 Answers1

1

Kerberos is an authentication system; it verifies that a user is who they say they are. It is not, however an authorization system; it does not get much say in who is allowed to do what (including log in).

In particular, to log in to a Linux system, you need all the passwd entries from NSS (the Name Service Switch). So this user needs a home directory, uid, primary gid, and default shell specified. On a regular Linux system, this information is normally supplied by /etc/passwd. However, NSS lets you use other types of services to provide this information, which is commonly the case in networked environments. This information can come from local files, LDAP, NIS, winbind(samba), or something else. NSS can be configured in /etc/nsswitch.conf. Viewing this file should show where the passwd information comes from. Running the command getent passwd username queries nss to get the information passwd associated with the specified user.

If kerberos is working, kinit username should allow you to get credentials for the user. (User klist to view credentials, kdestroy to delete them)

If NSS is working, getent passwd username should show a valid passwd entry for that user.

If PAM is configured correctly (in /etc/pam.d, probably with the pam_krb5 module), and NSS and kerberos are working, the user should be able to log in.

If log in still fails, it may be worthwhile to test login on a command line instead of a graphical login (if this is not being done already). Incorrect permissions or nonexistent home directory can cause problems for graphical environments, but are less of a problem for shell logins.

ComputerDruid
  • 146
  • 2