问题描述
我试图按照Ubuntu Wiki上的指南安装和设置Kerberos。我正在运行64位Ubuntu 14.04(LTS)。我已经设置了avahi-daemon以提供.local DNS名称。然后我跑了：
sudo apt-get install krb5-kdc krb5-admin-server
该对话框要求我输入服务器的域以及服务器的主机名。但是，这似乎出错了：
krb5kdc: cannot initialize realm myrealm - see log file for details
...fail!
唯一的问题-没有日志文件。似乎默认的/etc/krb5.conf实际上没有启用日志记录。无论如何，我添加以下内容：
[logging]
default = FILE:/var/log/krb5.log
然后尝试运行：
sudo dpkg-reconfigure krb5-kdc
它仍然会出错，但是这次在/var/log/krb5.log中，我看到了：
krb5kdc: No such file or directory - while initializing database for realm myrealm
但是，它实际上并不能告诉我缺少了什么文件或目录。
这是我的krb5.conf
[libdefaults]
default_realm = myrealm
# The following krb5.conf variables are only for MIT Kerberos.
krb4_config = /etc/krb.conf
krb4_realms = /etc/krb.realms
kdc_timesync = 1
ccache_type = 4
forwardable = true
proxiable = true
# The following encryption type specification will be used by MIT Kerberos
# if uncommented. In general, the defaults in the MIT Kerberos code are
# correct and overriding these specifications only serves to disable new
# encryption types as they are added, creating interoperability problems.
#
# Thie only time when you might need to uncomment these lines and change
# the enctypes is if you have local software that will break on ticket
# caches containing ticket encryption types it doesn't know about (such as
# old versions of Sun Java).
# default_tgs_enctypes = des3-hmac-sha1
# default_tkt_enctypes = des3-hmac-sha1
# permitted_enctypes = des3-hmac-sha1
# The following libdefaults parameters are only for Heimdal Kerberos.
v4_instance_resolve = false
v4_name_convert = {
host = {
rcmd = host
ftp = ftp
}
plain = {
something = something-else
}
}
fcc-mit-ticketflags = true
[logging]
default = FILE:/var/log/krb5.log
[realms]
myrealm = {
kdc = kerberos-myname-syd.local
admin_server = kerberos-myname-syd.local
}
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu:88
kdc = kerberos-1.mit.edu:88
kdc = kerberos-2.mit.edu:88
admin_server = kerberos.mit.edu
default_domain = mit.edu
<cut>
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.media.mit.edu = MEDIA-LAB.MIT.EDU
media.mit.edu = MEDIA-LAB.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
.whoi.edu = ATHENA.MIT.EDU
whoi.edu = ATHENA.MIT.EDU
.stanford.edu = stanford.edu
.slac.stanford.edu = SLAC.STANFORD.EDU
.toronto.edu = UTORONTO.CA
.utoronto.ca = UTORONTO.CA
[login]
krb4_convert = true
krb4_get_tickets = false
~
~
这是我的/etc/krb5/kdc.conf文件：
[kdcdefaults]
kdc_ports = 750,88
[realms]
myrealm = {
database_name = /var/lib/krb5kdc/principal
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
acl_file = /etc/krb5kdc/kadm5.acl
key_stash_file = /etc/krb5kdc/stash
kdc_ports = 750,88
max_life = 10h 0m 0s
max_renewable_life = 7d 0h 0m 0s
master_key_type = des3-hmac-sha1
supported_enctypes = aes256-cts:normal arcfour-hmac:normal des3-hmac-sha1:normal des-cbc-crc:normal des:normal des:v4 des:norealm des:onlyrealm des:afs3
default_principal_flags = +preauth
}
有什么想法吗？
最佳解决思路
您需要首先创建一个数据库：
kdb5_util create -s -r myrealm