LPRng Kerberos 5 authentication is based on the Kerberos5-1.1.1 release as of December 28, 1999. This was obtained from MIT from the http://web.mit.edu/kerberos/www/ Website.
The following sections briefly describes how to set up and test the Kerberos software and then how to configure LPRng to use Kerberos.
By default, LPRng will search for the krb5.h file and the krb5 libraries. If it finds these, then Kerberos authentication will be included. If it also finds the krb.h file then MIT Kerberos 4 compatibility will also be enabled.
Get the Kerberos 5 distribution.
Compile and install the distribution.
Create the /etc/krb5.conf and /usr/local/var/krb5kdc/kdc.conf, files using templates from the files in the Kerberos distribution's src/config-files directory. See the Installation notes and the System Administrators Guide for details.
Start up the KDC and KADMIN servers - you might want to put the following in your rc.local or equivalent system startup files:
if [ -f /etc/krb5.conf -a -f /usr/local/var/krb5kdc/kdc.conf ]; then echo -n ' krb5kdc '; /usr/local/sbin/krb5kdc; echo -n ' kadmind '; /usr/local/sbin/kadmind; fi
Use kadmin (or kadmin.local) to create principals for your users.
Use kadmin (or kadmin.local) to create principals for the lpd servers. I have been using lpr/hostname.REALM as a template- i.e. lpr/astart1.private@ASTART.COM for an example. You should use fully qualified domain names for the principals. Since it will never be used by an individual, you do not have to give it a password.
Example: kadmin ... addprinc -randkey lpr/wayoff.private@ASTART.COM
Extract the keytab for each server:
kadmin ... ktadd -k keytab lpr/hostname.REALM Example: ktadd -k /tmp/lpr.wayoff.private lpr/wayoff.private@ASTART.COM
The keytab file contains the keytab information, which is the equivalent information for the server.
Copy each keytab file to the appropriate server (you might want to encrypt or use a secure transfer for this). Put it in the /etc/lpd.keytab file on the server. This file should have 0400 permissions and owned by daemon or the user that lpd will run as.
#> ls -l /etc/lpd.keytab -rw------- 1 daemon wheel 128 Jan 16 11:06 /etc/lpd.keytab
If you want to have MIT Kerberos4 printing compatibility, then you will need to set up Kerberos 4 servertabs instead of Kerberos 5 keytabs. Assuming that you have put the Kerberos 5 keytab in /etc/lpd.keytab, then you extract the Kerberos 4 srvtab version of the Kerberos 5 keytab using the following commands. You must put the key in the /etc/srvtab file in order to be compatible with the Kerberos 4 support.
h4: {331} # ktuil rkt /etc/lpd.keytab wst /etc/srvtab
The LPRng software needs to be configured so that it can find the Kerberos libraries and include files. By default, the include files are installed in /usr/local/include and the libraries in /usr/local/lib. Use the following steps to configure LPRng so that it uses these directories during configuration and installation:
cd .../LPRng rm -f config.cache CPPFLAGS="-I/usr/local/include -I/usr/include/kerberosIV" \ LDFLAGS="-L/usr/local/lib -L/usr/lib/kerberosIV" \ ./configure make clean all su make install
Options used:
auth=kerberos5=use Kerberos5 authentication
kerberos_id=destination server key used by clients
kerberos_server_principal=alias for kerberos_id
kerberos_forward_id=destination server used by server
kerberos_forward_principal=alias for kerberos_forward_id
kerberos_keytab=location of the lpd server keytab file
kerberos_service=service to be used
kerberos_life=lpd server ticket lifetime
kerberos_renew=lpd server ticket renew
Example printcap entry:
pr: :lp=pr@wayoff :auth=kerberos5 :kerberos_id=lpr/wayoff.private@ASTART.COM pr:server :lp=pr@faroff.private :auth_forward=kerberos5 :kerberos_id=lpr@wayoff.private@ASTART.COM :kerberos_forward_id=lpr/faroff.private@ASTART.COM OR If you want to use Kerberos 4 authentication to the server pr: :lp=pr@wayoff :auth=kerberos4 :kerberos_id=lpr/wayoff.private@ASTART.COM # support both Kerberos 4 and 5 on server pr:server :lp=pr@faroff.private :auth_forward=kerberos5 :kerberos_id=lpr@wayoff.private@ASTART.COM :kerberos_forward_id=lpr/faroff.private@ASTART.COM :kerberos_keytab=/etc/lpd.keytab
The printcap configuration for Kerberos authentication is very simple.
The kerberos_id is the principal name of the lpd server that clients will connect to. For backwards compatibility, kerberos_server_principal can also be used. This values is used to obtain a ticket for the lpd server, and is the only entry required for client to server authentication.
The other entries are used by the lpd server. kerberos_keytab entry is the location of the keytab file to be used by the server. This contains the passphrase used by the server to authenticate itself and get a ticket from the ticket server.
The kerberos_id value is also used by the server during the authentication process to make sure that the correct principal name was used by the request originator. This check has saved many hours of pain in trying to determine why authentication is failing.
The kerberos_life and kerberos_renew set the lifetime and renewability of the lpd server Kerberos tickets. These values should not be modified unless you are familiar with the Kerberos system. There are extensive notes in the LPRng source code concerning these values. The kerberos_service value supplies the name of the service to be used when generating a ticket. It is stronly recommended that the kerberos_id entry be used instead.
In order to use kerberos authentication, the user will need to obtain a ticket from the Kerberos ticket server. This is done using kinit.
No other actions are required by the user.