Kerberos support is already part of the base OS X system. However, you do need to use a custom configuration file. Create the following file:
/Library/Preferences/edu.mit.Kerberos.
At CSAIL we use the following content for that file. Cut and paste it in.
[domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
.csail.mit.edu = CSAIL.MIT.EDU
csail.mit.edu = CSAIL.MIT.EDU
[libdefaults]
default_realm = CSAIL.MIT.EDU
noaddresses = TRUE
[realms]
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu.:88
kdc = kerberos-1.mit.edu.:88
kdc = kerberos-2.mit.edu.:88
admin_server = kerberos.mit.edu.
default_domain = mit.edu
}
CSAIL.MIT.EDU = {
kdc = kerberos-1.csail.mit.edu
kdc = kerberos-2.csail.mit.edu
kdc = krb524.csail.mit.edu
admin_server = kerberos.csail.mit.edu.
default_domain = csail.mit.edu
}
[v4 realms]
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu.
kdc = kerberos-1.mit.edu.
kdc = kerberos-2.mit.edu.
admin_server = kerberos.mit.edu.
default_domain = mit.edu
string_to_key_type = mit_string_to_key
}
[v4 domain_realm]
.mit.edu = ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU
You will also probably want to make a shortcut on your Dock for the Kerberos credential manager, which for reasons unknown is located at
/System/Library/CoreServices/Kerberos.app. As long as you leave this application running, it will continuously renew your Kerberos credentials until the end of their maximum renew-time.
Using Kerberos with SSH
If you expect to use
ssh or
sftp to connect to CSAIL Debian machines, we also recommend configuring ssh to connect to those machines using your Kerberos credentials. To do so, place the following in your
~/.ssh/config file:[1]
# Kerberos options
# Ticket forwarding is enabled by default for csail machines
# It's not enabled globally because forwarding tickets to an
# untrusted system can be very bad.
# Enable for systems you trust.
Host *.csail.mit.edu
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
GSSAPIDelegateCredentials yes
ForwardX11 yes
Note: the above configuration requires you to connect to hosts using their fully qualified domain names (eg,
ssh login.csail.mit.edu) for Kerberos authentication to occur.
Allowing bare hostnames (like ssh login) can be risky (if the machine ever connects to a non-CSAIL local network), but is possible by appending the below lines to
~/.ssh/config.
# exclude anything that looks fully-qualified but not CSAIL
Host *.*
GSSAPIDelegateCredentials no
ForwardX11 no
ForwardAgent no
# if not matched above, allow Kerberos and X11 as a CSAIL-local host
Host *
GSSAPIDelegateCredentials yes
GSSAPIAuthentication yes
GSSAPIKeyExchange yes
ForwardX11 yes
[1] to affect all accounts on the machine, add the above lines to /etc/ssh_config instead of ~/.ssh/config. sudo access required.