|
 SULinux Faq-O-Matic : General Information :
 How do I enable Kerberos authenticated remote logins and shells? |
If you are managing a cluster of computers for a research group or a department teaching lab, you may need to allow users to remotely log in or run jobs. Also, certain cluster programming tools, such as the Parallel Virtual Machine (PVM) or Message Passing Interface (MPI) libraries require remote shells to work. The safest way to authenticate these remote users is to use the Kerberos authentication protocol. To enable the remote login and remote shell daemons, use
|
# chkconfig eklogin on
# chkconfig kshell on |
You will also need to generate a Kerberos 5 keytab file and a Kerberos 4 srvtab file per the Leland Systems Kerberos instructions. Don't worry about installing the whole Kerberos package, as SULinux comes with a Kerberos kit. Just follow the instructions on requesting authorization to create a srvtab file at the following URL:
http://www.stanford.edu/services/kerberos/sysadmin/incoming.html
This involves emailing certain information to srvtab-request@stanford.edu. Once you are authorized to create srvtab and keytab files for your machine, you will have to run the leland_srvtab command. The command is
|
# /etc/leland/leland_srvtab -f /etc/leland/srvtab \
-k /etc/leland/krb5.keytab -u <yourLelandID> rcmd.<yourhostname> |
You will be prompted for your SUNet password. If all goes well, you should be greeted by the response
|
/etc/leland/srvtab successfully created.
/etc/leland/krb5.keytab successfully created. |
If you get error messages, conuslt the help page:
http://www.stanford.edu/services/kerberos/sysadmin/help/lsrvtab.html
As a final step, reload xinetd as follows
|
# /etc/rc.d/init.d/xinetd reload |
If all has gone well, you should be able to rsh, klogin, and ktelnet to your machine from any kerberized host on campus provided you have created .klogin and .k5login files per the instructions on
http://www.stanford.edu/services/kerberos/userguide/klogins.html
|
| [Append to This Answer] |
