Increasing Security on Kerberos Servers

Follow these steps to increase security on Kerberos application servers and on KDC servers.

Table 21-4 Increasing Security on Kerberos Servers (Task Map)

How to Restrict Access to KDC Servers

Both master KDC servers and slave KDC servers have copies of the KDC database stored locally. Restricting access to these servers so that the databases are secure is important to the overall security of the Kerberos installation.

Before You Begin

You must assume the root role. For more information, see How to Use Your Assigned Administrative Rights.

1. Restrict access to the hardware that supports the KDC.

   To restrict physical access, make sure that the KDC server and its monitor are located in a secure facility. Users should not be able to access this server in any way.

2. Store KDC database backups on local disks or on the KDC slaves.

   Make tape backups of your KDC only if the tapes are stored securely. Follow the same practice for copies of keytab files. It would be best to store these files on a local file system that is not shared with other systems. The storage file system can be on either the master KDC server or any of the slave KDCs.

How to Use a Dictionary File to Increase Password Security

A dictionary file can be used by the Kerberos service to prevent words in the dictionary from being used as passwords when creating new credentials. Preventing the use of dictionary terms as passwords makes it harder for someone else to guess any password. By default the /var/krb5/kadm5.dict file is used, but it is empty.

Before You Begin

You must assume the root role. For more information, see How to Use Your Assigned Administrative Rights.

1. Edit the KDC configuration file (kdc.conf).

   You need add a line to instruct the service to use a dictionary file. In this example, the dictionary that is included with the spell utility is used. See the kdc.conf(4) man page for a full description of the configuration file.

   kdc1 # cat /etc/krb5/kdc.conf
   [kdcdefaults]
           kdc_ports = 88,750
   
   [realms]
           EXAMPLE.COM = {
                   profile = /etc/krb5/krb5.conf
                   database_name = /var/krb5/principal
                   acl_file = /etc/krb5/kadm5.acl
                   kadmind_port = 749
                   max_life = 8h 0m 0s
                   max_renewable_life = 7d 0h 0m 0s
                   sunw_dbprop_enable = true
                   sunw_dbprop_master_ulogsize = 1000
                   dict_file = /usr/share/lib/dict/words
                   }

2. Restart the Kerberos daemons.

   kdc1 # svcadm restart -r network/security/krb5kdc
   kdc1 # svcadm restart -r network/security/kadmin