Setting up kerberos in Mac OS X

Kerberos in MAC OS X

Kerberos authentication allows the computers in same domain network to authenticate certain services with prompting the user for credentials. MAC OS X comes with Heimdal Kerberos which is an alternate implementation of the kerberos and uses LDAP as identity management database.
Here we are going to learn how to setup a kerberos on MAC OS X which we will configure latter in our application.

Installing Kerberos

In MAC we can use Homebrew for installing any software package. Homebrew makes it very easy to install the kerberos by just executing a simple command as given below.

brew install krb5

Once installation is complete, we need to set the below export commands in user's profile which will make the kerberos utility commands and compiler available to execute from anywhere.
Open user's bash profile:

vi ~/.bash_profile

Add below lines:

    export PATH=/usr/local/opt/krb5/bin:$PATH
    export PATH=/usr/local/opt/krb5/sbin:$PATH
    export LDFLAGS="-L/usr/local/opt/krb5/lib"
    export CPPFLAGS="-I/usr/local/opt/krb5/include"

Creating kerberos configuration

Now we need to create kerberos configuration which will be used during the setup of our installed kerberos. In this configuration we will setup few things like, domain names, KDC setup, logging, default keytab etc. Kerberos authentication looks up for the /etc/krb5.conf file which is default kerberos configuration location in MAC OS and we will create this file if it does not exist. If this file already exists then we can use the existing kerberos also for the modification. Here I am considering the situation when this file is not available and we need to create it.
To create our kerberos configuration, we will use below user and domain.

User: macuser
Domain: myserver.localhost

To configure above domain, we need to add below configuration in /etc/hosts file.

127.0.0.1 myserver.localhost MYSERVER.LOCALHOST

/etc/krb5.conf

Execute below command to create the file.

sudo vi /etc/krb5.conf

Put below code in this file and save it. In below code we also set the default encryption code supported. Also we set whether weak encryption is allowed. We have set the keytab, admin keytab location and KDC database also here. Same database will be created and setup the users & domain also.

[libdefaults]
    default_realm = MYSERVER.LOCALHOST
    default_keytab_name = file:/Users/macuser/krb5/conf/krb5.keytab
    default_tkt_enctypes = aes256-cts-hmac-sha1-96
    default_tgs_enctypes = aes256-cts-hmac-sha1-96
    allow_weak_crypto = true
    forwardable=true
    dns_lookup_realm = false
    dns_lookup_kdc = false

[logging]
    default = FILE:/Users/macuser/krb5/logs/krb5kdc.log
    admin_server = FILE:/Users/macuser/krb5/logs/kadmind.log
    kdc = FILE:/Users/macuser/krb5/logs/krb5kdc.log
[realms]
    MYSERVER.LOCALHOST = {
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
    }
    MYSERVER = {
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
        default_domain = myserver.localhost
    }
[domain_realm]
    .localhost = MYSERVER.LOCALHOST
    myserver.localhost = MYSERVER.LOCALHOST

Create database

To create the database we need to create below directory structure which we have mentioned in our kerberos configuration file.

/Users/macuser/krb5/db/
/Users/macuser/krb5/conf/
/Users/macuser/krb5/logs/

We need to execute below command to create the database.

kdb5_util create -r MYSERVER.LOCALHOST -s

You will see the similar output where you can see the database location which we configured in kerberos configuration file.

Loading random data
Initializing database '/Users/macuser/krb5/db/principal' for realm 'MYSERVER.LOCALHOST',
master key name 'K/M@MYSERVER.LOCALHOST'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

Creating principle, policies and keytab file

Execute below command to open the kadmin console in given directory. If you want to use specific encryption type while configuring database and keytab, then open kadmin with same command by specifying "-e" parameter with comma separated encryption types

cd /Users/macuser/krb5/conf/
kadmin.local

Now execute below commands in kadmin console to create policies. Policy creation is not necessary but it is always helpful to manage users using policies.

addpol users
addpol admin
addpol hosts

Execute below commands in kadmin console to create principles.

addprinc -policy users macuser
addprinc -policy admin macuser/admin
addprinc -randkey -policy hosts host/myserver.localhost
addprinc -randkey  HTTP/myserver.localhost

Execute below commands in kadmin console to create keytab files.

ktadd -k krb5.keytab host/myserver.localhost
ktadd -k krb5.keytab HTTP/myserver.localhost
ktadd -k krb5.keytab macuser

ktadd -k kadm5.keytab kadmin/admin kadmin/changepw

Verifying and initializing keytab

Exit the kadmin console by typing "quit" and execute below command to check the keytab entries.

klist -e -k -t krb5.keytab

It will given you below output:

Keytab name: FILE:krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 

Now execute the same command on "kadm5.keytab" to check the admin entries. Below is the output.

Keytab name: FILE:kadm5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 

Now check if you have read permission for other users also on both the keytab files (created above). If not then please update the permission on them. Post that, please execute below commands in given sequence, to start your kerberos.

krb5kdc
kadmind

Finally, execute below command to initialize your keytab with given user.

kinit macuser@MYSERVER.LOCALHOST -kt krb5.keytab

It will ask for the password, we set during principal creation.
Now open  the "Ticket viewer" and you will see similar to below screen for your initialized user.

You can check my another post on implementation of Kerberos authentication using Spring boot and SPNEGO API.
https://www.thetechnojournals.com/2019/12/integratedkerberos-authentication-using.html