new a c tiv e d ir e c to r y a s a f s Õ k d...
TRANSCRIPT
![Page 1: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/1.jpg)
Active Directory as AFS’ KDC
Derrick BrashearJune 14, 2006
![Page 2: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/2.jpg)
Step 1: Active Directory
• Become an admin in your Active Directory domain.
• Manage users.
![Page 3: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/3.jpg)
![Page 4: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/4.jpg)
![Page 5: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/5.jpg)
![Page 6: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/6.jpg)
![Page 7: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/7.jpg)
Make users
• Here, I created myself.
![Page 8: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/8.jpg)
![Page 9: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/9.jpg)
![Page 10: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/10.jpg)
And services
• Now, create AFS.
• You will be remapping to a principal later, so don’t worry about the name you use here.
![Page 11: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/11.jpg)
![Page 12: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/12.jpg)
![Page 13: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/13.jpg)
Bind and Export
• Bind a Kerberos principal name
• Export a keytab
• ktpass is in the Support Tools directory on your Windows 2003 media.
![Page 14: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/14.jpg)
![Page 15: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/15.jpg)
Try It
• Make sure your new realm is in krb5.conf on client(s).
• kinit as a client and see what happens.
![Page 16: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/16.jpg)
![Page 17: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/17.jpg)
![Page 18: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/18.jpg)
Add to Keyfile
• Copy the keytab you got with ktpass to the AFS server.
• Use asetkey to add the key.
![Page 19: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/19.jpg)
![Page 20: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/20.jpg)
Ready to go!
• At this point, tokens you get with aklog are all you need.
![Page 21: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/21.jpg)
![Page 22: New A c tiv e D ir e c to r y a s A F S Õ K D Cworkshop.openafs.org/afsbpw06/talks/shadow-AD.pdf · 2006. 6. 14. · Successfully mapped afs/adtest . dementia.org to afs—adtest](https://reader035.vdocument.in/reader035/viewer/2022071219/6057c79126a9d76762704a42/html5/thumbnails/22.jpg)
Consider disabling PACs
• http://support.microsoft.com/kb/832572/en-us