In Red Hat Enterprise Linux, how do I authenticate to ADS.IU.EDU using Kerberos?

Note:
Indiana University has a site license covering the use of Red Hat Enterprise Linux (RHEL) by students, faculty, and staff at IU. For details, see IU's software agreement with Red Hat.

You can configure your Red Hat Enterprise Linux workstation to authenticate to the Kerberos realm by using the Pluggable Authentication Modules (PAM). The module that allows you to authenticate to the Active Directory realm is pam_krb5.so.

You must have the pam_krb5 and krb5-workstation packages installed to configure your workstation to authenticate to the Kerberos realm. To determine if you have these packages installed, open a terminal window and enter:

 rpm -qa | grep pam_krb5

and

 rpm -qa | grep krb5-workstation

If your system returns pam_krb5-x.xx-x and krb5-workstation-x.xx-x, where x is the version of the package, they are installed. If your system does not return anything, you will need to install the packages depending upon your version of Red Hat Enterprise Linux. Red Hat Enterprise Linux 5.x and 6.x can use:

 yum install pam_krb5 yum install krb5-workstation

After you install needed packages:

  1. Open a terminal window and log in as root. Enter /usr/sbin/authconfig-tui for using Red Hat 5.x or 6.x.
  2. Continue with the prompts using the Tab key and Spacebar until you are asked for authentication.
  3. Press Tab until you are at the "Use Kerberos" field (Kerberos 5, if prompted). Press the Spacebar to select it.
  4. Press Next until you are at the "Kerberos Settings" field. Enter the following information, being aware of case sensitivity:
    • Realm: ADS.IU.EDU
    • KDC: ads.iu.edu:88
    • Admin Server: ads.iu.edu:749

The authconfig utility will modify two files: /etc/krb5.conf and /etc/pam.d/system-auth. The /etc/krb5.conf file configures the Kerberos (ADS.IU.EDU) realm to use the Kerberos 5 libraries and the /etc/pam.d/system-auth file inserts the pam_krb5.so module into your authentication sequence.

If your workstation is at a regional campus (including IUPUI), or if you need access to services on a campus other than your own, replace your existing /etc/krb5.conf file by saving the text below into a new file named krb5.conf:

  [domain_realm]
	.ads.iu.edu = ADS.IU.EDU
	.indiana.edu = ADS.IU.EDU
	.iu.edu = ADS.IU.EDU
	.iub.edu = ADS.IU.EDU
	.iue.edu = ADS.IU.EDU
	.iuk.edu = ADS.IU.EDU
	.iun.edu = ADS.IU.EDU
	.iupui.edu = ADS.IU.EDU
	.ius.edu = ADS.IU.EDU
	.iusb.edu = ADS.IU.EDU
	indiana.edu = ADS.IU.EDU
	iu.edu = ADS.IU.EDU
	iub.edu = ADS.IU.EDU
	iue.edu = ADS.IU.EDU
	iuk.edu = ADS.IU.EDU
	iun.edu = ADS.IU.EDU
	iupui.edu = ADS.IU.EDU
	ius.edu = ADS.IU.EDU
	iusb.edu = ADS.IU.EDU

  [libdefaults]
	default_realm = ADS.IU.EDU

  [realms]
	ADS.IU.EDU = {
		kdc = ads.iu.edu:88
	}

When you attempt to authenticate, PAM will first check the local /etc/passwd file for the correct password. If this check fails, PAM will then perform a check against one of the Active Directory servers. If the Kerberos check is successful, you are allowed to log in.

To log into your workstation, a user must have an existing local account.

For additional information, contact your campus Support Center.

At Indiana University, for personal or departmental Linux or Unix systems support, see At IU, how do I get support for Linux or Unix?

This is document akoo in the Knowledge Base.
Last modified on 2017-05-16 11:50:59.

  • Fill out this form to submit your issue to the UITS Support Center.
  • Please note that you must be affiliated with Indiana University to receive support.
  • All fields are required.

Please provide your IU email address. If you currently have a problem receiving email at your IU account, enter an alternate email address.

  • Fill out this form to submit your comment to the IU Knowledge Base.
  • If you are affiliated with Indiana University and need help with a computing problem, please use the I need help with a computing problem section above, or contact your campus Support Center.

Please provide your IU email address. If you currently have a problem receiving email at your IU account, enter an alternate email address.