[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#1002018: debian-edu-config: provide means to deploy a proper krb5.keytab to diskless workstations

Hi all, hi esp. Wolfgang,

On  Mo 20 Dez 2021 15:22:26 CET, Mike Gabriel wrote:


Package: debian-edu-config
Severity: wishlist
Version: 2.12.14
On a Debian Edu 11 network, NFS home mounts are only allowed via NFSv4 + sec=krb5i. For this, the user and the host need to acquire valid Kerberos ticket.
While the user can acquire their ticket via login (pam_krb5.so), the host needs to obtain two tickets (a host and a service ticket) elsewhere. This is normally done via two key entries in /etc/krb5.keytab.
Those host / service key entries are tied to the hostname of the machine, which is problematic on diskless machines (because the same system (chroot / squashfs image) can be used on several hosts on the network, with different hostnames.
The idea here is to deploy a specific (optional) hack on the Debian Edu network that will allow us to boot diskless workstations with support for NFSv4 and krb5i. 

The idea outline for this is this:

  * add a "diskless-workstation-hosts" NIS netgroup to LDAP
  * let the admins put all their DLW hosts into that NIS netgroup
  * on host modification, gosa-modify-host will update a file e.g.
    /var/lib/debian/krb5.keytab_dlw; this file contains all
    host/<client> and nfs/<client> principal keys for all known
    diskless workstations
  * on DLW boot, root@DLW will be able to SSH into tjener (as
    unprivileged user with access to /var/lib/debian/krb5.keytab_dlw
    and copy that file onto the DLW as /etc/krb5.keytab at runtime).
  * on the DLW some more permission adjustments are required root:root:0600
    for /etc/krb5.keytab)
  * with this, NFS krb5i should work on DLWs just fine and we don't
    expose any information to non-root users on the network

light+love
Mike


I have the above approach up and running and it works like charme.

Finally, we (Debian Edu, my customers) have krb5i based NFS homes for DLWs!!!

Mike
--

DAS-NETZWERKTEAM
c\o Technik- und Ökologiezentrum Eckernförde
Mike Gabriel, Marienthaler Str. 17, 24340 Eckernförde
mobile: +49 (1520) 1976 148
landline: +49 (4351) 850 8940

GnuPG Fingerprint: 9BFB AEE8 6C0A A5FF BF22  0782 9AF4 6B30 2577 1B31
mail: mike.gabriel@das-netzwerkteam.de, http://das-netzwerkteam.de

Attachment: pgpVcL2PB1DhH.pgp
Description: Digitale PGP-Signatur

Reply to: