In /etc/krb5.conf
, given the folowing default_realm
, should [realms].default_domain
point at the default_realm
or a Domain Controller (DC) or Key Distribution Denter (KDC)?
ada and adb are Windows Server DCs & KDCs. The domain members are systems running supported Ubuntu Server releases, joined as domain members through Samba and Winbind.
The DCs provide authentication for logging in through ssh and accessing SMB shares that reside on the Ubuntu servers. This is used to control what domain users and groups can or can access on various Ubuntu servers.
Ex 1:
[libdefaults]
ticket_lifetime = 24h
default_realm = DEPT.EXMAMPLE.COM
default_tgs_entypes = rc4-hmac des-cbc-md5
default_tkt__enctypes = rc4-hmac des-cbc-md5
permitted_enctypes = rc4-hmac des-cbc-md5
dns_lookup_realm = false
dns_lookup_kdc = true
dns_fallback = yes
[realms]
DEPT.EXMAMPLE.COM = {
kdc = ada.dept.example.com
kdc = adb.dept.example.com
admin_server = ada.dept.example.com
master_kdc = ada.dept.example.com
default_domain = dept.example.com
}
[domain_realm]
.dept.example.com = DEPT.EXMAMPLE.COM
dept.example.com = DEPT.EXMAMPLE.COM
Ex2
[libdefaults]
ticket_lifetime = 24h
default_realm = DEPT.EXMAMPLE.COM
default_tgs_entypes = rc4-hmac des-cbc-md5
default_tkt__enctypes = rc4-hmac des-cbc-md5
permitted_enctypes = rc4-hmac des-cbc-md5
dns_lookup_realm = false
dns_lookup_kdc = true
dns_fallback = yes
[realms]
DEPT.EXMAMPLE.COM = {
kdc = ada.dept.example.com
kdc = adb.dept.example.com
admin_server = ada.dept.example.com
master_kdc = ada.dept.example.com
default_domain = dept.example.com
}
[domain_realm]
.dept.example.com = ADA.DEPT.EXMAMPLE.COM
dept.example.com = ADA.DEPT.EXMAMPLE.COM
Both configurations seem to work on a number of Ubuntu Servers, but I don't understand why, or which is correct.