Skip to main content

Setting up kerberos in Mac OS X

Kerberos in MAC OS X

Kerberos authentication allows the computers in same domain network to authenticate certain services with prompting the user for credentials. MAC OS X comes with Heimdal Kerberos which is an alternate implementation of the kerberos and uses LDAP as identity management database.
Here we are going to learn how to setup a kerberos on MAC OS X which we will configure latter in our application.

Installing Kerberos

In MAC we can use Homebrew for installing any software package. Homebrew makes it very easy to install the kerberos by just executing a simple command as given below.
brew install krb5
Once installation is complete, we need to set the below export commands in user's profile which will make the kerberos utility commands and compiler available to execute from anywhere.
Open user's bash profile:
vi ~/.bash_profile
Add below lines:
    export PATH=/usr/local/opt/krb5/bin:$PATH
    export PATH=/usr/local/opt/krb5/sbin:$PATH
    export LDFLAGS="-L/usr/local/opt/krb5/lib"
    export CPPFLAGS="-I/usr/local/opt/krb5/include"

Creating kerberos configuration

Now we need to create kerberos configuration which will be used during the setup of our installed kerberos. In this configuration we will setup few things like, domain names, KDC setup, logging, default keytab etc. Kerberos authentication looks up for the /etc/krb5.conf file which is default kerberos configuration location in MAC OS and we will create this file if it does not exist. If this file already exists then we can use the existing kerberos also for the modification. Here I am considering the situation when this file is not available and we need to create it.
To create our kerberos configuration, we will use below user and domain.
User: macuser
Domain: myserver.localhost
To configure above domain, we need to add below configuration in /etc/hosts file.
127.0.0.1 myserver.localhost MYSERVER.LOCALHOST

/etc/krb5.conf

Execute below command to create the file.
sudo vi /etc/krb5.conf
Put below code in this file and save it. In below code we also set the default encryption code supported. Also we set whether weak encryption is allowed. We have set the keytab, admin keytab location and KDC database also here. Same database will be created and setup the users & domain also.
[libdefaults]
    default_realm = MYSERVER.LOCALHOST
    default_keytab_name = file:/Users/macuser/krb5/conf/krb5.keytab
    default_tkt_enctypes = aes256-cts-hmac-sha1-96
    default_tgs_enctypes = aes256-cts-hmac-sha1-96
    allow_weak_crypto = true
    forwardable=true
    dns_lookup_realm = false
    dns_lookup_kdc = false

[logging]
    default = FILE:/Users/macuser/krb5/logs/krb5kdc.log
    admin_server = FILE:/Users/macuser/krb5/logs/kadmind.log
    kdc = FILE:/Users/macuser/krb5/logs/krb5kdc.log
[realms]
    MYSERVER.LOCALHOST = {
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
    }
    MYSERVER = {
        kdc = myserver.localhost
        database_name = /Users/macuser/krb5/db/principal
        admin_server = myserver.localhost
        admin_keytab = file:/Users/macuser/krb5/conf/kadm5.keytab
        default_domain = myserver.localhost
    }
[domain_realm]
    .localhost = MYSERVER.LOCALHOST
    myserver.localhost = MYSERVER.LOCALHOST

Create database

To create the database we need to create below directory structure which we have mentioned in our kerberos configuration file.
/Users/macuser/krb5/db/
/Users/macuser/krb5/conf/
/Users/macuser/krb5/logs/
We need to execute below command to create the database.
kdb5_util create -r MYSERVER.LOCALHOST -s
You will see the similar output where you can see the database location which we configured in kerberos configuration file.
Loading random data
Initializing database '/Users/macuser/krb5/db/principal' for realm 'MYSERVER.LOCALHOST',
master key name 'K/M@MYSERVER.LOCALHOST'
You will be prompted for the database Master Password.
It is important that you NOT FORGET this password.
Enter KDC database master key:
Re-enter KDC database master key to verify:

Creating principle, policies and keytab file

Execute below command to open the kadmin console in given directory. If you want to use specific encryption type while configuring database and keytab, then open kadmin with same command by specifying "-e" parameter with comma separated encryption types
cd /Users/macuser/krb5/conf/
kadmin.local
Now execute below commands in kadmin console to create policies. Policy creation is not necessary but it is always helpful to manage users using policies.
addpol users
addpol admin
addpol hosts
Execute below commands in kadmin console to create principles.
addprinc -policy users macuser
addprinc -policy admin macuser/admin
addprinc -randkey -policy hosts host/myserver.localhost
addprinc -randkey  HTTP/myserver.localhost
Execute below commands in kadmin console to create keytab files.
ktadd -k krb5.keytab host/myserver.localhost
ktadd -k krb5.keytab HTTP/myserver.localhost
ktadd -k krb5.keytab macuser

ktadd -k kadm5.keytab kadmin/admin kadmin/changepw

Verifying and initializing keytab

Exit the kadmin console by typing "quit" and execute below command to check the keytab entries.
klist -e -k -t krb5.keytab
It will given you below output:
Keytab name: FILE:krb5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:17 host/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:32 HTTP/myserver.localhost@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:43 macuser@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
Now execute the same command on "kadm5.keytab" to check the admin entries. Below is the output.
Keytab name: FILE:kadm5.keytab
KVNO Timestamp         Principal
---- ----------------- --------------------------------------------------------
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/admin@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes256-cts-hmac-sha1-96) 
   2 12/29/19 20:40:55 kadmin/changepw@MYSERVER.LOCALHOST (aes128-cts-hmac-sha1-96) 
Now check if you have read permission for other users also on both the keytab files (created above). If not then please update the permission on them. Post that, please execute below commands in given sequence, to start your kerberos.
krb5kdc
kadmind
Finally, execute below command to initialize your keytab with given user.
kinit macuser@MYSERVER.LOCALHOST -kt krb5.keytab
It will ask for the password, we set during principal creation.
Now open  the "Ticket viewer" and you will see similar to below screen for your initialized user.
ticket viewer
You can check my another post on implementation of Kerberos authentication using Spring boot and SPNEGO API.
https://www.thetechnojournals.com/2019/12/integratedkerberos-authentication-using.html

Comments

  1. I am trying to follow the instruction to set up my Kerberos server on mac OX, I have faced two issues:

    1) ```kdb5_util create -r MYSERVER.LOCALHOST -s```, after you input the password, I will get error
    ```kdb5_util: Can not fetch master key (error: No such file or directory). while initializing the Kerberos admin interface```

    2) ```cd /Users/macuser/krb5/conf/
    kadmin.local
    ```
    I will have the problem that kadmin.local is trying to open the database `/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/principal`, and this will get a result No such file or directory while initializing kadmin.local interface

    Is there anything wrong? Any suggestion will be appreciated

    ReplyDelete
    Replies
    1. You getting these issues as your database couldn't created and then latter it failed during initialization due to same issue.
      Seems, you have not defined below database setting in your "/etc/krb5.conf" file which specifies the desired location for database.
      database_name = /Users/macuser/krb5/db/principal
      If you don't want to use above setting and want to use default location for database then please make sure that you have below folder hierarchy, if not then please create the folders. Folder hierarchy for database must be present with both custom and default database location.
      /usr/local/Cellar/krb5/1.17.1/var/krb5kdc/
      Then try to create database using kdb5_util.

      Delete
    2. Hey i read your blog and find it very helpful for me because i was looking for these type of content online.

      Reasons Why To Hire A Bodyguard in London, UK:| Spetsnaz Security International Fidel Matola

      https://www.spetsnazsecurityinternational.co.uk/reasons-to-hire-a-london-bodyguard.html

      Delete
  2. Thanks for your reply.

    I have define the database setting in the config file, however, it seems like kadmin.local cannot find the default real I config in the krb5.conf, I have to use `sudo kadmin -r MYSERVER.LOCALHOST` to let it know where is the path of the database.

    For the first issue, I just simply add "sudo" in front of the command to execute, then the issue is gone.

    ReplyDelete
  3. Hi,

    i've follow all the steps you provided, but when i run the `kdb5_util create -r MYSERVER.LOCALHOST -s` command, after typing the master key password i got the following error:

    kdb5_util: Key table file '/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/.k5.MYSERVER.LOCALHOST_tmp' not found while storing key
    Warning: couldn't stash master key.
    kdb5_util: Can not fetch master key (error: No such file or directory). while initializing the Kerberos admin interface

    What am i doing wrong? Do you please have any suggestion?

    Thanks in advance

    ReplyDelete
    Replies
    1. I tried your previously suggestion: create `/usr/local/Cellar/krb5/1.17.1/var/krb5kdc/` path. This solved my issue. Now i have another one. When i run `kadmin.local` i got the following error:

      kadmin.local: unsupported command

      Any suggestion?

      Thanks in advance

      Delete
    2. Seems your krb5 sbin is not set on environment's path and not able to find this command. You can set it by exporting location "/usr/local/opt/krb5/sbin" in PATH variable. If this location is not available then you can export location "/usr/local/Cellar/krb5/1.17.1/sbin" in PATH variable. Other way is to execute the command by prepending it with actual location, for example "/usr/local/opt/krb5/sbin/kadmin.local".

      Delete
    3. First of all, thanks for you support!

      My krb5 sbin path is already setup as environment variable.
      However using kadmin.local inside "/usr/local/Cellar/krb5/1.17.1/sbin" folder everything works fine.

      Thanks again!

      Delete
  4. while running "sudo kadmind" , I get the below error : kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting

    ReplyDelete
  5. Hello, I am facing the same problem mentioned in the before comment, I did all the steps and everything worked fine until there, after run sudo kadmin the next error is displayed: kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting
    Can you please give me an idea on how to solve this?

    ReplyDelete
    Replies
    1. Please try to create below folder hierarchy.
      /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/

      Delete
  6. Please try to create below folder hierarchy.
    /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/

    ReplyDelete
  7. I have the same problem when i try to start kadmind I am getting the same error sudo kadmind
    kadmind: Cannot open /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl: No such file or directory while initializing ACL file, aborting . However the directory exists, it is just that there is no acl file in there. Any ideas?

    ReplyDelete
    Replies
    1. Never mind, it expects a predefined acl file. A simple touch /usr/local/Cellar/krb5/1.18.2/var/krb5kdc/kadm5.acl suffices to get the server started. Apparently this is a plain text file with some access control lists, the user has to define himself!

      https://web.mit.edu/kerberos/krb5-1.12/doc/admin/conf_files/kadm5_acl.html

      Delete
    2. Another problem now... kinit myuser@MYSERVER.LOCALHOST -kt krb5.keytab results in an error kinit: Client 'werpu@MYSERVER.LOCALHOST' not found in Kerberos database while getting initial credentials. The db exists the keytab file has the user and the user exists on macos, i am somewhat puzzled why this happens.

      Delete
  8. Hi there and thanks a lot for your tutorial.

    I followed each of the steps you recommended but when i enter :

    kdb5_util create -r MYSERVER.LOCALHOST -s

    I get :

    zsh: command not found: kdb5_util

    I looked up on the internet and didn't find anything besides checking the $PATH
    So my $PATH is as this :

    /usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin:/Library/Apple/usr/bin

    If you mind helping me out I would be so gratefull !

    Cheers :)


    ReplyDelete
    Replies
    1. Aprajita Shailie25 January 2021 at 11:04

      First go inside the folder (cd /Users/macuser/krb5/db/) and then execute kdb5_util create -r MYSERVER.LOCALHOST -s

      It worked for me. Hope it might help you.

      Delete
  9. Thanks for a very helpful tutorial, it worked for me like a charm. The only missing detail I found is you never mention where to place the keytab files and looking at the krb5.conf they should be placed in the file:/Users/macuser/krb5/conf/ folder. The other items which caused problem for me was missing kadm5_acl.html file. Initially I added it as an empty file but later I found out it really needs to be setup correctly so one can use kadmin. Adding a short section explaining that detail would be very helpful for beginners like myself.

    ReplyDelete
  10. Great article. I followed the instructions on Mac Big Sur and it complaint about pkinit authentication with the following message from the krb5kdc log "preauth pkinit failed to initialize: PKINIT initialization failed: No pkinit_identity supplied for realm MYSERVER.LOCALHOST". After trying to set up pkinit the following the official mit documentation it still complaints about the first line that tries to access the MYSERVER.LOCALHOST in the extensions.kdc I've defined. Any help would be highly appreciated!

    ReplyDelete
  11. If you're frantically seeking straight hair, a flat iron feels like the apparent device to grab besides, a good one can aid make your hair smooth, glossy as well as pin-straight. That claimed, if you've found that the process of detangling your hair prior to having to area off your strands and make several passes with a straightener to be a time suck, there's a much easier method to accomplish a flawlessly straight 'do.Visit us for honest review.yourwisepick.com

    ReplyDelete
  12. Google announced 'Instant Apps' for Android in Google I/O last year. This year, the search giant updated 'Instant Apps' and made it available for developers with gloud games svip mod apk --- so that they can start making them.

    ReplyDelete
  13. Great post keep good posting/. you can als visit Alight motion ios download

    ReplyDelete

  14. topfollow for windows
    is best app to increase instagram follwer. so visit website and increase your real time follwers

    ReplyDelete
  15. Hi,

    kinit myuser@MYSERVER.LOCALHOST -kt krb5.keytab results in an error kinit: Client 'werpu@MYSERVER.LOCALHOST' not found in Kerberos database while getting initial credentials.

    Any ideas how to fix this?

    ReplyDelete
  16. Hi,

    kinit myuser@MYSERVER.LOCALHOST -kt krb5.keytab results in below error

    kinit: Client 'macuser@MYSERVER.LOCALHOST' not found in Kerberos database while getting initial credentials

    Any ideas how to fix this?

    This is the last step to test the flow of kerberos

    ReplyDelete
  17. macOS Monterey may be running it's own KDC, before you run krb5kdc and kadmind - you can disable the built in kdc with: "sudo launchctl unload -w /System/Library/LaunchDaemons/com.apple.Kerberos.kdc.plist"

    ReplyDelete
  18. Soccer Agent Mod Apk has excellent graphics, and an attractive plot, Download Soccer Agent Mod Apk's latest version Free 2022 updated

    ReplyDelete
  19. Modern Age 2 MOD APK is a geopolitical, economic, and military strategy game. download Modern Age 2 MOD APK President Simulator unlimited money download Modern Age 2 MOD APK

    ReplyDelete
  20. This comment has been removed by the author.

    ReplyDelete
  21. Thanks for sharing the useful information about set up Kerberos in Mac OS. If you are looking for the leading and reliable Mobile App Development Company In India, then you can go with Lucid Outsourcing Solutions they have team of expertise who have in-hand experience in various technologies.

    ReplyDelete
  22. Quite an informative blog! I have found interesting details to read and provide immense knowledge Thanks for the wonderful information. If you are looking for tailor made erp software for your business, book a free consultation Custom ERP Solution

    ReplyDelete

Post a Comment

Popular Posts

SpringBoot - @ConditionalOnProperty example for conditional bean initialization

@ConditionalOnProperty annotation is used to check if specified property available in the environment or it matches some specific value so it can control the execution of some part of code like bean creation. It may be useful in many cases for example enable/disable service if specific property is available. Below are the attributes which can be used for property check. havingValue - Provide the value which need to check against specified property otherwise it will check that value should not be false. matchIfMissing - If true it will match the condition and execute the annotated code when property itself is not available in environment. name - Name of the property to be tested. If you want to test single property then you can directly put the property name as string like "property.name" and if you have multiple properties to test then you can put the names like {"prop.name1","prop.name2"} prefix - It can be use when you want to apply some prefix to

Multiple data source with Spring boot, batch and cloud task

Here we will see how we can configure different datasource for application and batch. By default, Spring batch stores the job details and execution details in database. If separate data source is not configured for spring batch then it will use the available data source in your application if configured and create batch related tables there. Which may be the unwanted burden on application database and we would like to configure separate database for spring batch. To overcome this situation we will configure the different datasource for spring batch using in-memory database, since we don't want to store batch job details permanently. Other thing is the configuration of  spring cloud task in case of multiple datasource and it must point to the same data source which is pointed by spring batch. In below sections, we will se how to configure application, batch and cloud task related data sources. Application Data Source Define the data source in application properties or yml con

Entity to DTO conversion in Java using Jackson

It's very common to have the DTO class for a given entity in any application. When persisting data, we use entity objects and when we need to provide the data to end user/application we use DTO class. Due to this we may need to have similar properties on DTO class as we have in our Entity class and to share the data we populate DTO objects using entity objects. To do this we may need to call getter on entity and then setter on DTO for the same data which increases number of code line. Also if number of DTOs are high then we need to write lot of code to just get and set the values or vice-versa. To overcome this problem we are going to use Jackson API and will see how to do it with minimal code only. Maven dependency <dependency> <groupId>com.fasterxml.jackson.core</groupId> <artifactId>jackson-databind</artifactId> <version>2.9.9</version> </dependency> Entity class Below is