| Path : /usr/share/YaST2/modules/ |
| Current File : //usr/share/YaST2/modules/Kerberos.ybc |
YaST bytecode 1.4.0 Kerberos ; Kerberos.ycp FileUtils Hostname Label Mode Package Pam Progress Report Service
Stage Summary required_packages
write_only use_pam_krb pam_unix_present
default_realm default_domain dns_default_realm dns_kdc kdc admin_server trusted_servers clockskew pam_modified ssh_modified modified ticket_lifetime renew_lifetime forwardable proxiable retain_after_close ssh_support ! minimum_uid " use_shmem # mappings $ ignore_unknown % ssh_section & packages '
dns_available ( dns_used ) ExpertSettings * OrigExpertSettings + Modified , Import - Export . ReadKrb5ConfValues / ReadKrb5ConfValue 0 ReadFile 1 WriteKrb5ConfValues 2 WriteKrb5ConfValuesAsString 3 WriteKrb5ConfValue 4 WriteFile 5 Read 6 Write 7 Summary 8 ShortSummary 9 AutoPackages : ValidateTimeEntries + "
$ ' - . 0 1 4 8 : < = > A B C D F G ! ! H " " K # # L $ $ O & & U ' ' X ( ( [ ) ) ` + + i , , t settings - - . .
path_to_value def_value / /
path_to_value def_value 0 0
path_to_value def_value 1 1
path_to_value values 2 2
path_to_value values 3 3
path_to_value value 4 4
path_to_value value 5 5 6 6 7 7 8 8 9 9 : : key val < 3 SCR Read Write Dir Execute UnmountAgent 0 kerberos3 FileUtils Exists 3 Hostname CurrentHostname
CurrentDomain 3 Label 3 Mode test 3 Package DoInstallAndRemove Available Installed 3 Pam Remove Enabled Query Add 3 Progress New NextStage 3 Report Error 3 Service 3 Stage cont 3 Summary
NotConfigured AddHeader AddLine $" pam_krb5 krb5 krb5-client$$
$' $* $- $. $0 $1 $4 $5 $8 $: 300$< $= $> $A 1d$B 1d$C true$D false$F false$G $H ! 1$K " sshd$L # $O $ $R % *$U & $X ' $[ ( $` )
$c *
%i + ,j
y2debug
modified=%1 -k || || %t , client &u
pam_login use_kerberos $v
kerberos_client
&x default_domain &y
default_realm &z
kdc_server &{ clockskew &| ssh_support &} $ ignore_unknown $ &~ ticket_lifetime 1d & renew_lifetime 1d & ! minimum_uid ! & forwardable true false& proxiable true false& " use_shmem " & # mappings & trusted_servers & ) ExpertSettings
( && ! haskey ) use_shmem haskey use_shmem' ) use_shmem " & & & - % -
export_map $
pam_login use_kerberos kerberos_client default_domain
default_realm
kdc_server clockskew ssh_support ignore_unknown $ ticket_lifetime renew_lifetime minimum_uid ! forwardable true proxiable true ExpertSettings ) ( # '
kerberos_client mappings # ( '
kerberos_client trusted_servers -
% . value $ SCR::Read
( &
- % / vals $ .
-
% 0 ,
y2warning
; This function is deprecated, use ReadKrb5ConfValue instead.- /
% 1 ( ||
-
SCR::Write
-
SCR::Write
% 2 - 1
filter val splitstring
% 3 ( ||
-
SCR::Write
- 1
% 4 ,
y2warning
< This function is deprecated, use WriteKrb5ConfValue instead.- 3
% 5 pam_query hostname $
krb5& size
( & $ contains
account ignore_unknown_principals ( /etc/krb5.conf4 pam_p ,
y2debug
krb5.conf sections: %1 SCR::Dir .etc.krb5_conf.s& / * .etc.krb5_conf.v.libdefaults.default_realm & / & .etc.krb5_conf.v.libdefaults.clockskew 300( size 4 realm $ add .etc.krb5_conf.v & mergestring . add kdc & mergestring . add admin_server & / add default_domain (" &# $% .etc.krb5_conf.v.pam&& / add ticket_lifetime 1d&' / add renew_lifetime 1d&( / add forwardable true&) / add proxiable false&* ! / add minimum_uid 1,, foreach key keytab
ccache_dir ccname_template mappings existing_ticket external validate use_shmem addressless debug debug_sensitive initial_prompt subsequent_prompt banner val $1 / add (2 '3 ) (5 ! haskey ) use_shmem'6 ) use_shmem sshd &7 " ) use_shmem sshd (8 ! haskey ) external'9 ) external sshd &; * ) &= / ' .etc.krb5_conf.v.pkinit.trusted_servers ,@ SCR::Execute .target.bash
sformat
/usr/bin/touch /etc/krb5.conf(C 4D &E (G && 4H out $I SCR::Execute .target.bash_output
domainname(J exit &K deletechars stdout
(P && && /usr/bin/dig ! 4R out $S SCR::Execute .target.bash_output
sformat
dig TXT _kerberos.%1 +short &T deletechars stdout
"(U 4V split &W SCR::Execute .target.bash_output
sformat
dig SRV _kerberos._udp.%1 +short $X splitstring deletechars stdout
&Y (Z && substring - size .&\ substring - size (] &^ ' (a && || ! contains SCR::Dir .etc.krb5_conf.s domain_realm SCR::Dir .etc.krb5_conf.v.domain_realm 4d &e ( &f &g ,h
y2milestone
! kdc by DNS %1, default_domain: %2 ,j
y2milestone
DNS is used for Kerberos data (o && || || MY.REALM EXAMPLE.COM 4r &s toupper (u && || || MY.COMPUTER kerberos.example.com /usr/bin/ypwhich4w out $x SCR::Execute .target.bash_output /usr/bin/ypwhich&y deletechars stdout
({ && || || MY.COMPUTER kerberos.example.com
/usr/bin/host4} proposed m $~ + kdc. $ SCR::Execute .target.bash_output
sformat
+ LANG=C /usr/bin/host %1 | /bin/grep address ( exit & ,
y2milestone
no kdc defined, proposing: %1 ,
y2debug
ssh_config sections: %1 SCR::Dir .etc.ssh.ssh_config.s$
& , foreach sec SCR::Dir .etc.ssh.ssh_config.s cont ( - $ SCR::Dir add .etc.ssh.ssh_config.v ,
y2debug
section %1 contains: %2 ( && || *
&& contains GSSAPIAuthentication contains GSSAPIDelegateCredentials4 & && SCR::Read add add .etc.ssh.ssh_config.v GSSAPIAuthentication yes SCR::Read add add .etc.ssh.ssh_config.v GSSAPIDelegateCredentials yes& % ( & - % 6
pam_installed ret caption no_stages stages steps $
$
$
$ Saving Kerberos Client Configuration kerberos$
$
Write PAM settings kerberos Write Kerberos client settings kerberos Write OpenSSH settings kerberos$
Writing PAM settings... kerberos# Writing Kerberos client settings... kerberos Writing OpenSSH settings... kerberos Finished kerberos( & 4 &
prepend
Install required packages kerberos&
prepend
Installing required packages... kerberos&
+
,
( & 4
to_install ,
y2debug
packages to install: %1 & , $ , foreach p & ( & add , & & , ( ||
4 ( 4 , krb5( ldap, ldap-account_only ( $ , krb5-ignore_unknown_principals, krb5-ignore_unknown_principals4 ( ldap-account_only, ldap , krb5 , ( && ! ( 4 , 3 * .etc.krb5_conf.v.libdefaults.default_realm ( 4 domain $ ( findfirstof . & + . , 3 add .etc.krb5_conf.v.domain_realm , 3 & .etc.krb5_conf.v.libdefaults.clockskew (
contains SCR::Dir .etc.krb5_conf.s 4 , 2 add add .etc.krb5_conf.v kdc ( && , 3 add add .etc.krb5_conf.v default_domain ( , 2 add add .etc.krb5_conf.v admin_server ( 4 ,
SCR::Write add .etc.krb5_conf.st.realms , 2 add add .etc.krb5_conf.v.realms kdc ( && ,! 3 add add .etc.krb5_conf.v.realms default_domain (# ,$ 2 add add .etc.krb5_conf.v.realms admin_server (( 4) pam_sect (0 ( 41 ,2
y2milestone
3 DNS set to use: removing domain info from krb5.conf,3 3 .etc.krb5_conf.s.domain_realm,4 3 add .etc.krb5_conf.s ,6 3 * .etc.krb5_conf.v.libdefaults.default_realm $; .etc.krb5_conf.v.pam(< ! contains SCR::Dir .etc.krb5_conf.s pam4= ,?
SCR::Write ! .etc.krb5_conf.st.appdefaults.pam &@ .etc.krb5_conf.v.appdefaults.pam ,C 3 add ticket_lifetime ,D 3 add renew_lifetime ,E 3 add forwardable ,F 3 add proxiable ,G 3 add minimum_uid ! ,I foreach key value ) pth $J add (K 4L ,M 3 true false-N (Q ,R 3 (T * ,U 3 (X && krb5-plugin-preauth-pkinit-nss4Z pkinit_sect $[ .etc.krb5_conf.v.pkinit(\ ! contains SCR::Dir .etc.krb5_conf.s pkinit4] ,^
SCR::Write $ .etc.krb5_conf.st.appdefaults.pkinit &_ # .etc.krb5_conf.v.appdefaults.pkinit ,a 3 add trusted_servers (c /etc/pam_pkcs11/pam_pkcs11.conf4d ,e
SCR::Write add add ! .etc.pam_pkcs11_conf.v.pam_pkcs11 mapper ms
domainname ,f
SCR::Write add add ! .etc.pam_pkcs11_conf.v.pam_pkcs11 mapper ms domainnickname ,g
SCR::Write .etc.pam_pkcs11_conf ,l
SCR::Write .etc.krb5_conf,p SCR::UnmountAgent .etc.krb5_conf ,t (v 4w write $x yes no,y
SCR::Write add add .etc.ssh.ssh_config.v % GSSAPIAuthentication ,{
SCR::Write add add .etc.ssh.ssh_config.v % GSSAPIDelegateCredentials ,}
SCR::Write .etc.ssh.ssh_config,~
y2milestone
/etc/ssh/ssh_config modified , -
% 7 summary nc
$
$
&
PAM Login kerberos&
Use Kerberos kerberos Do Not Use Kerberos kerberos&
Default Realm kerberos&
&
Default Domain kerberos&
&
KDC Server Address kerberos&
&
Clock Skew kerberos&
-
% 8 summary nc $
$
&
+ + +
sformat
<b>KDC Server</b>: %1<br> kerberos
sformat
<b>Default Domain</b>: %1<br> kerberos
sformat
<b>Default Realm</b>: %1<br> kerberos
sformat
* <b>Kerberos Authentication Enabled</b>: %1 kerberos Yes kerberos No kerberos( ( &
+ +
<br> Configuration Acquired via DNS kerberos -
% 9 - install remove % : ( && ! regexpmatch
^([0-9]+)[dmh]$ ! regexpmatch
^([0-9]+)$4 (
clockskew, " Clock skew is invalid.
Try again.
kerberos, Lifetime is invalid.
Try again. kerberos- -