1. Active Directory® and Apache® Using Kerberos and Apache to Authenticate via Microsoft Active Directory

2. History Team of four system administrators Responsible for 100+ hosts running a variety of operating systems Using Microsoft Access and Excel to store user names, passwords, hostnames, ip addresses, operating systems, etc Needed a better way to store and access information.

3. History cont’d Why not create an sql database with a web-based front-end? How to protect sensitive data in the database?

4. Motivation Need to protect database. Could create new password. Why not allow users to log in with their current credentials which were stored in Active Directory? Enter Kerberos

5. Kerberos Network authentication protocol Strong authentication for client/server applications Uses secret-key cryptography FREE!!

6. Apache Web server Covered extensively in this course. Also FREE!!

7. Solution Host web site on: VMWare Virtual Server VMWare Virtual Server CentOS CentOS MySQL – Database MySQL – Database PHP – Access to the Database PHP – Access to the Database Linux, Apache, MySQL, PHP = LAMP

8. Kerberos Configuration Step 1: Create a keytab file echo HTTP/intranet.domain.name.com@active.dire ctory.server.com > /path/auth_kerb.keytab echo HTTP/intranet.domain.name.com@active.dire ctory.server.com > /path/auth_kerb.keytab chmod ugo+r /path/auth_kerb.keytab chmod ugo+r /path/auth_kerb.keytab

9. Kerberos Configuration Cont’d Step 2: Modify /etc/krb5.conf [logging] default = FILE10000:/var/log/krb5lib.log [libdefaults] ticket_lifetime = 24000 default_realm = FULLY.QUALIFIED.DOMAIN.NAME default_tkt_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 aes256-cts arc four-hmac-md5 default_tgs_enctypes = des3-hmac-sha1 des-cbc-crc des-cbc-md5 aes256-cts arc four-hmac-md5 [realms] FULLY.QUALIFIED.DOMAIN.NAME = { kdc = dc1.fully.qualified.domain.name kdc = dc2.fully.qualified.domain.name admin_server = dc3.fully.qualified.domain.name default_domain = FULLY.QUALIFIED.DOMAIN.NAME } [domain_realm].fully.qualified.domain.name = FULLY.QUALIFIED.DOMAIN.NAME fully.qualified.domain.name = FULLY.QUALIFIED.DOMAIN.NAME Kerberos can be tested by using the kinit command. See the krb5 man page for details.

10. Apache Configuration Modify httpd.conf Add the following inside the you wish to safeguard RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} AuthName "COS Enterprise Labs Organization" AuthType Kerberos Krb5Keytab /var/www/passwd/kerberos/auth_kerb.keytab KrbAuthRealm EXAMPLE.COM KrbMethodNegotiate off KrbSaveCredentials off KrbVerifyKDC off Require user user1@EXAMPLE.COM user2@EXAMPLE.COM... RewriteEngine On RewriteCond %{HTTPS} off RewriteRule (.*) https://%{HTTP_HOST}%{REQUEST_URI} AuthName "COS Enterprise Labs Organization" AuthType Kerberos Krb5Keytab /var/www/passwd/kerberos/auth_kerb.keytab KrbAuthRealm EXAMPLE.COM KrbMethodNegotiate off KrbSaveCredentials off KrbVerifyKDC off Require user user1@EXAMPLE.COM user2@EXAMPLE.COM... Restart the Apache daemon Restart the Apache daemon

11. Questions?