RE: Solaris 9 authentication and access control into Active Directory

• Previous message: Reg Quinton: "Re: Solaris 9 authentication and access control into Active Directory"
• Maybe in reply to: Ron Ogle: "Solaris 9 authentication and access control into Active Directory"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Mon, 20 Sep 2004 08:14:24 -0700
To: "Reg Quinton" <reggers@ist.uwaterloo.ca>, focus-sun@securityfocus.com

The trick to changing passwords with the Kerberos on Solaris is to add this token to the krb5.conf in the [realms] section (inside of the definition for the realm):

        kpasswd_protocol = SET_CHANGE

For example:

        [realms]
                AD.EXAMPLE.COM = {
                        kdc = ...:88
                        admin_server = ...:464
                        [...]
                        kpasswd_protocol = SET_CHANGE
                }

After that, kpasswd works just fine.

Cheers,
 - Mike Myers, Mike.Myers <at> nwdc.net

-----Original Message-----
From: Reg Quinton [mailto:reggers@ist.uwaterloo.ca]
Sent: Wednesday, September 15, 2004 6:22 AM
To: focus-sun@securityfocus.com
Cc: "Ron Ogle"
Subject: Re: Solaris 9 authentication and access control into Active
Directory

From: "Ron Ogle" <ogler@tce.com>
> 1. Use Kerberos on Solaris 9 via PAM to authenticate to AD using the
> Windows username/password.

I've done that with vendor's implementation -- no code imported to system.
There's a good Microsoft paper at

http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp

It's an awkward configuration and not much fun to set up. The trick is to
implement a user within your Active Directory for the machine, set his
password, then import that information to Unix. It works but I never got
the password change figured out. I have some very rough notes here that I
can share:

http://ist.uwaterloo.ca/security/howto/drafts/2002-08-23/

• Previous message: Reg Quinton: "Re: Solaris 9 authentication and access control into Active Directory"
• Maybe in reply to: Ron Ogle: "Solaris 9 authentication and access control into Active Directory"
• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]