How to create a Kerberos realm for single sign-on running on NetBSD

You want to organize your users and services into a Kerberos realm to enable single sign-on to your web sites and other services at hostnames under example.com. How do you set it up?

1. Pick a realm name. This is normally the uppercase version of your organization's domain name in the DNS, EXAMPLE.COM.

   Note: Unlike DNS domain names, Kerberos realm names are case-sensitive.

2. Pick a host to run the Kerberos Key Distribution Center, say kdc.example.com.

   Make sure TCP traffic on port 88 to kdc.example.com goes to the host, in case it is behind a NAT or firewall or similar.

3. Optional: Create DNS records in the example.com. zone, to make it easier for users:

   example.com zonefile

   ; name           ttl     class   type    rrdata
   _kerberos        300     IN      TXT     "EXAMPLE.COM"
   _kerberos._tcp   300     IN      SRV     1 0 88 kdc

   For access to services under example.com, clients will consult _kerberos.example.com TXT records to find the realm name—see dns_lookup_realm in krb5.conf(5).

   To find the KDC for the realm EXAMPLE.COM, clients and services will consult _kerberos._tcp.example.com SRV records—see dns_lookup_kdc in krb5.conf(5).

   If you don't set this up, you will need to distribute krb5.conf(5) files to all users with the realm name and domain-to-realm mapping; see the [domain_realm] and [realms] sections in the krb5.conf(5) man page for details.

4. On kdc.example.com, create /etc/krb5.conf with the following content:

   /etc/krb5.conf

   [libdefaults]
           default_realm = EXAMPLE.COM
           name_canon_rules = as-is:
   [kdc]
           # Prevent UDP amplification by not listening on UDP:
           # https://github.com/heimdal/heimdal/issues/1216
           ports = kerberos/tcp

   Check it by running:

   # verify_krb5_conf /etc/krb5.conf

5. Initialize the KDC:

   # kadmin -l init EXAMPLE.COM
   Realm max ticket life [unlimited]:
   Realm max renewable ticket life [unlimited]:

   Hit return when prompted to use the defaults.

   This will create the database at the default location under /var/heimdal.

6. Create a user principal and an admin principal. We'll call the user jruser for J. Random User.

   # kadmin -l add --use-defaults jruser
   jruser@EXAMPLE.COM's Password: 
   Verifying - jruser@EXAMPLE.COM's Password: 
   # kadmin -l add --use-defaults jruser/admin
   jruser/admin@EXAMPLE.COM's Password: 
   Verifying - jruser/admin@EXAMPLE.COM's Password: 

   The admin principal jruser/admin@EXAMPLE.COM is used by kadmin(8) for remote access via kadmind(8). It need not have the same password as jruser@EXAMPLE.COM.

7. Start up kdc, the KDC daemon. Enable it in /etc/rc.conf:

   /etc/rc.conf

   kdc=YES

   Then either reboot or start it explicitly:

   # service kdc start

8. Enable kadmind(8) for remote admin access, and kpasswdd(8) for remote password changes.

   1. Extract keys into the keytab at /etc/krb5.keytab for kadmind(8) and kpasswdd(8):

      # kadmin -l ext kadmin/admin@EXAMPLE.COM
      # kadmin -l ext kadmin/changepw@EXAMPLE.COM

   2. Create an access control list for admins:

      /var/heimdal/kadmind.acl

      jruser/admin@EXAMPLE.COM        all,get-keys

   3. Add entries to /etc/inetd.conf for the services:

      /etc/inetd.conf

      # service       type    proto   wait    user    program                 argv
      kerberos-adm    stream  tcp     nowait  root    /usr/libexec/kadmind    kadmind
      kerberos-adm    stream  tcp6    nowait  root    /usr/libexec/kadmind    kadmind
      kpasswd         dgram   udp     wait    root    /usr/libexec/kpasswdd   kpasswdd
      kpasswd         dgram   udp6    wait    root    /usr/libexec/kpasswdd   kpasswdd

   4. Reboot or tell inetd(8) to reload /etc/inetd.conf:

      # service inetd reload

Now you can do kinit jruser@EXAMPLE.COM for client-side single sign-on, use kpasswd(1) to change your password or kpasswd(8) administer the realm, and set up kerberized services!