puppet-mit_krb5

Table of Contents

1. Overview
2. Dependencies
3. Examples
4. Classes and Resources
   • mit_krb5
   • mit_krb5::install
   • mit_krb5::realm
   • mit_krb5::logging
   • mit_krb5::domain_realm
5. Limitations
6. License
7. Development

Overview

This Puppet module is designed to facilitate the installation and configuration of MIT Kerberos. The primary scope includes installing the user utilities (kinit, etc) on the system and populating krb5.conf with the appropriate sections.

Other tasks such as setting up KDC services are not covered.

Dependencies

• puppetlabs/stdlib
• puppetlabs/concat

Examples

class { 'mit_krb5':
  default_realm      => 'INSECURE.LOCAL',
  permitted_enctypes => ['des-cbc-crc', 'des-cbc-md5'],
  allow_weak_crypto  => true
}
class { 'mit_krb5::logging':
  default => ['FILE:/var/log/krb5libs.log', 'SYSLOG']
}
mit_krb5::realm { 'INSECURE.LOCAL':
  kdc          => ['kdc1.insecure.local', 'kdc2.insecure.local'],
  admin_server => 'kpasswd.insecure.local',
}
mit_krb5::domain_realm { 'INSECURE.LOCAL':
  domains => ['insecure.local', '.insecure.local']
}

Yields the following krb5.conf:

[logging]
    default = FILE:/var/log/krb5libs.log
    default = SYSLOG

[libdefaults]
    default_realm = INSECURE.LOCAL
    permitted_enctypes = des-cbc-crc des-cbc-md5
    allow_weak_crypto = true

[realms]
    INSECURE.LOCAL = {
        kdc = kdc1.insecure.local
        kdc = kdc2.insecure.local
        admin_server = kpasswd.insecure.local
    }

[domain_realm]
    insecure.local = INSECURE.LOCAL
    .insecure.local = INSECURE.LOCAL

Code such as this would mimic the example file shipped with CentOS/RHEL:

class { 'mit_krb5::install': }
class { 'mit_krb5':
  default_realm    => 'EXAMPLE.COM',
  dns_lookup_realm => false,
  dns_lookup_kdc   => false,
  ticket_lifetime  => '24h',
  renew_lifetime   => '7d',
  forwardable      => true,
}
class { 'mit_krb5::logging':
  default      => 'FILE:/var/log/krb5libs.log',
  kdc          => 'FILE:/var/log/krb5kdc.log',
  admin_server => 'FILE:/var/log/kadmind.log'
}
mit_krb5::realm { 'EXAMPLE.COM':
  kdc          => 'kerberos.example.com',
  admin_server => 'kerberos.example.com'
}
mit_krb5::domain_realm { 'EXAMPLE.COM':
  domains => ['.example.com', 'example.com']
}

Classes and Resources

The module was structured into resources/classes that resemble the sections of krb5.conf.

mit_krb5

Top-level class that installs MIT Kerberos and controls krb5.conf file. Class parameters are used to define contents of [libdefaults] section.

Parameters from libdefaults section

• default_realm - Must be set to non-empty
• default_keytab_name
• default_tgs_enctypes
• default_tkt_enctypes
• default_ccache_name
• permitted_enctypes
• allow_weak_crypto
• clockskew
• ignore_acceptor_hostname
• k5login_authoritative
• k5login_directory
• kdc_timesync
• kdc_req_checksum_type
• ap_req_checksum_type
• safe_checksum_type
• preferred_preauth_types
• ccache_type
• dns_lookup_kdc
• dns_lookup_realm
• dns_fallback
• realm_try_domains
• extra_addresses
• udp_preference_limit
• verify_ap_req_nofail
• ticket_lifetime
• renew_lifetime
• noaddresses
• forwardable
• proxiable
• rdns
• plugin_base_dir

File parameters

• krb5_conf_path - Path to krb5.conf (default: /etc/krb5.conf)
• krb5_conf_owner - Owner of krb5.conf (default: root)
• krb5_conf_group - Group of krb5.conf (default: root)
• krb5_conf_mode - Mode of krb5.conf (default: 0444)

mit_krb5::install

Class to install Kerberos client package(s). This class is included from mit_krb5. If you wish to set the packages parameter, do so before declaring/including mit_krb5 or use hiera.

Parameters

• packages - Override facter-derived defaults for Kerberos packages (default: undef)

mit_krb5::realm

Resource to add entries to the [realms] section.

Realm name is specified by resource title

Parameters from realm section

• kdc - (arrays allowed)
• admin_server - (arrays allowed)
• database_module
• default_domain
• v4_instance_convert
• v4_realm
• auth_to_local_names
• auth_to_local
• pkinit_anchors

mit_krb5::logging

Class to configure [logging] section

Parameters from logging section

• default - (arrays allowed)
• defaults - Replaces 'default' parameter (for use in Puppet 2.7)
• admin_server - (arrays allowed)
• kdc - (arrays allowed)

mit_krb5::domain_realm

Resource to add entries to [domain_realm] section.

Parameters

• domains - Domains to be mapped into realm - (arrays allowed)
• realm - Realm to map into - (default: resource title)

Limitations

Configuration sections other than those listed above are not yet supported. This includes:

• appdefaults
• capaths
• dbdefaults
• dbmodules
• login
• plugins

Stub classes for those sections exist but will throw an error.

License

Apache License, Version 2.0

Development

Please report issues or submit a pull request.