puppet-mit_krb5

Table of Contents

1. Overview
2. Dependencies
3. Examples
4. Classes and Resources
   • mit_krb5
   • mit_krb5::install
   • mit_krb5::realm
   • mit_krb5::logging
   • mit_krb5::domain_realm
   • mit_krb5::appdefaults
   • mit_krb5::dbmodules
   • mit_krb5::plugins
5. Limitations
6. License
7. Development

Overview

This Puppet module is designed to facilitate the installation and configuration of MIT Kerberos. The primary scope includes installing the user utilities (kinit, etc) on the system and populating krb5.conf with the appropriate sections.

Other tasks such as setting up KDC services are not covered.

Dependencies

• puppetlabs/stdlib
• puppetlabs/concat

Examples

Simple example

Full puppet code

class { 'mit_krb5':
  default_realm      => 'INSECURE.LOCAL',
  permitted_enctypes => ['des-cbc-crc', 'des-cbc-md5'],
  allow_weak_crypto  => true
}
class { 'mit_krb5::logging':
  default => ['FILE:/var/log/krb5libs.log', 'SYSLOG']
}
mit_krb5::realm { 'INSECURE.LOCAL':
  kdc          => ['kdc1.insecure.local', 'kdc2.insecure.local'],
  admin_server => 'kpasswd.insecure.local',
}
mit_krb5::domain_realm { 'INSECURE.LOCAL':
  domains => ['insecure.local', '.insecure.local']
}

Yields the following krb5.conf:

[logging]
    default = FILE:/var/log/krb5libs.log
    default = SYSLOG

[libdefaults]
    default_realm = INSECURE.LOCAL
    permitted_enctypes = des-cbc-crc des-cbc-md5
    allow_weak_crypto = true

[realms]
    INSECURE.LOCAL = {
        kdc = kdc1.insecure.local
        kdc = kdc2.insecure.local
        admin_server = kpasswd.insecure.local
    }

[domain_realm]
    insecure.local = INSECURE.LOCAL
    .insecure.local = INSECURE.LOCAL

Hiera integration

The previous example can also be written as follows:

include mit_krb5
include mit_krb5::logging

with the following Hiera data:

---
mit_krb5::default_realm: 'INSECURE.LOCAL'
mit_krb5::allow_weak_crypto: true

mit_krb5::permitted_enctypes:
  - 'des-cbc-crc'
  - 'des-cbc-md5'

mit_krb5::logging::default:
  - 'FILE:/var/log/krb5libs.log'
  - 'SYSLOG'

mit_krb5::realms:
  'INSECURE.LOCAL':
    kdc:
      - 'kdc1.insecure.local'
      - 'kdc2.insecure.local'
    admin_server: 'kpasswd.insecure.local'

mit_krb5::domain_realms:
  'INSECURE.LOCAL':
    domains:
      - 'insecure.local'
      - '.insecure.local'

Mimic the example file shipped with CentOS/RHEL

class { 'mit_krb5::install': }
class { 'mit_krb5':
  default_realm    => 'EXAMPLE.COM',
  dns_lookup_realm => false,
  dns_lookup_kdc   => false,
  ticket_lifetime  => '24h',
  renew_lifetime   => '7d',
  forwardable      => true,
}
class { 'mit_krb5::logging':
  default      => 'FILE:/var/log/krb5libs.log',
  kdc          => 'FILE:/var/log/krb5kdc.log',
  admin_server => 'FILE:/var/log/kadmind.log'
}
mit_krb5::realm { 'EXAMPLE.COM':
  kdc          => 'kerberos.example.com',
  admin_server => 'kerberos.example.com'
}
mit_krb5::domain_realm { 'EXAMPLE.COM':
  domains => ['.example.com', 'example.com']
}

Classes and Resources

The module was structured into resources/classes that resemble the sections of krb5.conf.

mit_krb5

Top-level class that installs MIT Kerberos and controls krb5.conf file. Class parameters are used to define top-level directives and contents of [libdefaults] section.

Top-level directives

• include - (arrays allowed)
• includedir - (arrays allowed)
• module - (arrays allowed)

Parameters from libdefaults section

• default_realm - Must be set to non-empty
• default_keytab_name
• default_tgs_enctypes
• default_tkt_enctypes
• default_ccache_name
• permitted_enctypes
• allow_weak_crypto
• clockskew
• ignore_acceptor_hostname
• k5login_authoritative
• k5login_directory
• kdc_timesync
• kdc_req_checksum_type
• ap_req_checksum_type
• safe_checksum_type
• preferred_preauth_types
• ccache_type
• canonicalize (mit_krb5 1.11+ - RHEL6/wheezy only have 1.10)
• dns_canonicalize_hostname
• dns_lookup_kdc
• dns_lookup_realm
• dns_fallback
• realm_try_domains
• extra_addresses
• udp_preference_limit
• verify_ap_req_nofail
• ticket_lifetime
• renew_lifetime
• noaddresses
• forwardable
• proxiable
• rdns
• plugin_base_dir

File parameters

• krb5_conf_path - Path to krb5.conf (default: /etc/krb5.conf)
• krb5_conf_owner - Owner of krb5.conf (default: root)
• krb5_conf_group - Group of krb5.conf (default: root)
• krb5_conf_mode - Mode of krb5.conf (default: 0444)

System parameters

• alter_etc_services - Should kerberos udp and tcp entries be managed in /etc/services (default: false)

mit_krb5::install

Class to install Kerberos client package(s). This class is included from mit_krb5. If you wish to set the packages parameter, do so before declaring/including mit_krb5 or use hiera.

Parameters

• packages - Override facter-derived defaults for Kerberos packages (default: undef)

mit_krb5::realm

Resource to add entries to the [realms] section.

Realm name is specified by resource title

Parameters from realm section

• kdc - (arrays allowed)
• kpasswd_server
• master_kdc
• admin_server - (arrays allowed)
• database_module
• default_domain
• v4_instance_convert
• v4_name converts
• v4_realm
• auth_to_local_names
• auth_to_local
• pkinit_anchors
• pkinit_pool
• rotate_servers - Whether to apply a random rotation to the list of KDCs and admin servers so that the server usage is more evenly distributed. (Default: false)

mit_krb5::logging

Class to configure [logging] section

Parameters from logging section

• default - (arrays allowed)
• defaults - Replaces default parameter (for use in Puppet 2.7)
• admin_server - (arrays allowed)
• kdc - (arrays allowed)

mit_krb5::domain_realm

Resource to add entries to [domain_realm] section.

Parameters

• domains - Domains to be mapped into realm - (arrays allowed)
• realm - Realm to map into - (default: resource title)

mit_krb5::appdefaults

Resource to add entries to [appdefaults] section.

Currently, this module only supports this format of appdefaults:

application = {
    option1 = value
    option2 = value
}

or

realm = {
    option = value
}

Parameters

• debug
• ticket_lifetime
• renew_lifetime
• forwardable
• krb4_convert
• ignore_afs

Example

The following appdefaults section

[appdefaults]
    EXAMPLE.ORG = {
        forwardable = false
    }

could be obtained with

::mit_krb5::appdefaults { 'EXAMPLE.ORG':
    forwardable => false
}

mit_krb5::dbmodules

Class to configure [dbmodules] section

Parameters from dbmodules section

• db_module_dir

Per realm:

• database_name
• db_library
• disable_last_success
• disable_lockout
• ldap_cert_path
• ldap_conns_per_server
• ldap_kadmind_dn
• ldap_kdc_dn
• ldap_kerberos_container_dn
• ldap_servers (arrays allowed)
• ldap_service_password_file

mit_krb5::plugins

Resource to add entries to [plugins] section.

Parameters from plugins section

Allowed subsections:

• ccselect
• pwqual
• kadm5_hook
• clpreauth
• kdcpreauth
• hostrealm
• localauth

Allowed parameters per subsection:

• disable
• enable_only
• module

Example

The following plugins section (used to disable k5identity)

[plugins]
    ccselect = {
        disable = k5identity
    }

could be obtained with

::mit_krb5::plugins { 'ccselect':
    disable => 'k5identity',
}

Limitations

Configuration sections other than those listed above are not yet supported. This includes:

• capaths
• dbdefaults
• login

Stub classes for those sections exist but will throw an error.

License

Apache License, Version 2.0

Contributors

This module was initially created by Patrick Mooney (@pfmooney) and forked by CC-IN2P3 in Oct. 2014.

Development

Please report issues or submit a pull request.

2021-10-29 - Remi Ferrand puppet@cc.in2p3.fr - 1.4.0

New features

• Add support for plugins (See #28)

2021-09-22 - Remi Ferrand puppet@cc.in2p3.fr - 1.3.1

Dependencies

• Relax puppet version requirements (Fixes #27)

2021-09-22 - Remi Ferrand puppet@cc.in2p3.fr - 1.3.0

New features

• Add support for pkinit_anchors and spake_preauth_groups (See #25)
• Add support for http_anchors (See #23)

Dependencies

• Now requires ccin2p3-etc_services module in version 2.x
• This module has been tested with puppetlabs-concat version 7.1.1
• This module has been tested with puppetlabs-stdlib version 8.0.0

2019-06-12 - Remi Ferrand puppet@cc.in2p3.fr - 1.2.1

Fixes

• Add support for Array values in realm auth_to_local param (See #24)

2019-06-11 - Remi Ferrand puppet@cc.in2p3.fr - 1.2.0

New features

• Add support for rotating KDCs using fqdn_rotate function (See #22)

2018-09-21 - Remi Ferrand puppet@cc.in2p3.fr - 1.1.1

Fixes

• Make appdefaults accept boolean values (See #21)

2018-09-20 - Remi Ferrand puppet@cc.in2p3.fr - 1.1.0

New features

• Add support for dns_canonicalize_hostname in libdefaults section (See #19)
• Add support for pkinit_pool in mit_krb5::realm defined type (See #18)
• Add native hiera integration with automatic creations of mit_krb5::domain_realm, mit_krb5::capaths̀, mit_krb5::appdefaults̀, mit_krb5::realm and mit_krb5::dbmodules resource types using hiera (See #20)

2018-09-05 - Remi Ferrand puppet@cc.in2p3.fr - 1.0.0

New features

• Add support for dbmodules section (See #14)
• Add support for include, includedir and module parameters in libdefaults section (See #15)
• Add support for master_kdc in realm section (See #16)

Breaking changes

• Use Puppet v4 native data types
• Upgrade minimum puppetlabs-stdlib required version to 4.13.0
• Upgrade minimum puppetlabs-concat required version to 1.1.0

2018-06-25 - Remi Ferrand puppet@cc.in2p3.fr - 0.4.1

• Migrate to PDK version 1.6.0
• Introduce new dependency on ccin2p3-etc_services

Fixes

• Fixes metadata.json (See #10)

New features

• Add support for options default_ccache_name and pkinit_anchors (See #11)
• Add support for option ̀canonicalize (See #7)

2016-03-31 - Fabien Wernli puppet@cc.in2p3.fr - 0.2.1

• add compatibility with concat 2.x

2014-10-31 - Remi Ferrand puppet@cc.in2p3.fr - 0.1.0

History

This Puppet module was originaly created by Patrick Mooney (https://github.com/pfmooney/puppet-mit_krb5). The module was forked by CC-IN2P3 because P. Mooney couldn't provide active support anylonger.

New features

• Add appdefaults section (https://github.com/pfmooney/puppet-mit_krb5/pull/3)
• Add v4_name_convert and kpasswd_server support in [realm] section (https://github.com/pfmooney/puppet-mit_krb5/pull/3)