278N/AInstructions on testing the negotiateauth

278N/Amozilla extension with Apache.

278N/A

278N/AIntroduction

278N/A-----------------

278N/Amod_auth_gss (originally from http://modauthkerb.sourceforge.net/) is an

278N/AApache module designed to provide GSSAPI authentication to the Apache

278N/Aweb server. Using the "Negotiate" Auth mechanism, which performs full

278N/AKerberos authentication based on ticket exchanges and does not require

278N/Ausers to insert their passwords to the browser. In order to use the

278N/ANegotiate method you need a browser supporting it (currently standard IE6.0 or

278N/AMozilla with the negotiateauth extension).

278N/A

278N/AThe Negotiate mechanism can be only used with Kerberos v5. The module supports

278N/Aboth 1.x and 2.x versions of Apache.

278N/A

278N/AThe use of SSL encryption is also recommended (but not required) if you are

278N/Ausing the Negotiate method.

278N/A

278N/AInstalling mod_auth_gss

278N/A------------------------

278N/A

278N/APrerequisites

278N/A* Apache server installed.

278N/A Both 1.x and 2.x series of Apache are supported (make sure the apache

278N/A installation contains the apxs command)

278N/A In Solaris - the necessary Apache 2.X libraries and headers are

278N/A usually found in /usr/apache2.

278N/A* Working C compiler.

278N/A* GSSAPI library (Solaris - /usr/lib/libgss.so.1)

278N/A

278N/A1. Building the Apache module is simple.

278N/A Find the directory with the source code and Makefile for

278N/A mod_auth_gss.so.

278N/A $ make

278N/A

278N/A2. Installing the Apache module requires 'root' privilege.

278N/A # cp mod_auth_gss.so /usr/apache2/libexec

278N/A

278N/A3. Configure apache to use the new module.

278N/A Add following line to /etc/apache2/httpd.conf:

278N/A LoadModule auth_gss_module libexec/mod_auth_gss.so

278N/A

278N/A4. Set permissions on the newly created keytab file so that only the

278N/A apache owner can read the file. For example, if the apache server

278N/A is configured to run as user "nobody":

278N/A

278N/A $ chown nobody /var/apache2/http.keytab

278N/A $ chmod 400 /var/apache2/http.keytab

278N/A

278N/A5. Create a directory in the apache 'htdocs' tree that will be used

278N/A to test the GSSAPI/KerberosV5 authentication.

278N/A $ mkdir /var/apache2/htdocs/krb5

278N/A

278N/A6. Create a ".htaccess" file for the Kerberos directory (step 4),

278N/A it should contain the following entries:

278N/A AuthType GSSAPI

278N/A AuthGSSServiceName HTTP

278N/A AuthGSSKeytabFile /var/apache2/http.keytab

278N/A AuthGssDebug 1

278N/A

278N/A * AuthGssDebug is only needed for testing purposes, it causes extra

278N/A DEBUG level messages to be displayed in the Apache error_log file

278N/A (/var/apache2/logs/error_log).

278N/A

278N/A7. Put some content in the Kerberos web directory so the tester can

278N/A verify that they accessed the page correctly.

278N/A

278N/A8. Set the "AllowOverride" parameter in /etc/apache2/httpd.conf

278N/A to "All" for the Kerberos directory created in step 5.

278N/AEx:

278N/A<Location "/var/apache2/htdocs/krb5">

278N/A Options Indexes FollowSymLinks MultiViews

278N/A AllowOverride All

278N/A Require valid-user

278N/A</Location>

278N/A

278N/AConfigurating Kerberos

278N/A-----------------------

278N/A

278N/A1. Set up Kerberos Server (if you don't already have one).

278N/A Follow basic instructions given at docs.sun.com. Search for

278N/A "Configuring Kerberos" in the

278N/A "Solaris Administration Guide: Security Services" book.

278N/A

278N/A - The KDC should be a protected, standalone system. But for

278N/A internal testing purposes it may be hosted on the same system

278N/A as the Apache web server.

278N/A

278N/A2. Create a Kerberos service key for the Apache server to use for

278N/A authenticating the clients. Also create a user principal testing

278N/A the browser later.

278N/A The "Negotiate" method used by IIS and IE is "HTTP/<hostname>@REALM".

278N/A To create this principal for use with the Apache module do the following:

278N/A [ As 'root', on the Apache server ]

278N/A a. /usr/sbin/kadmin

278N/A - this assumes the KDC setup procedure was followed (step 1).

278N/A b. kadmin: addprinc -randkey HTTP/<fully_qualified_host_name>

278N/A c. kadmin: ktadd -k /var/apache2/http.keytab HTTP/<fully_qualified_host_name>

278N/A d. kadmin: addprinc tester

278N/A e. kadmin: quit

278N/A

278N/ATesting the 'Negotiate' plugin with mozilla:

278N/A--------------------------------------------

278N/A

278N/A1. The client system must be configured to use Kerberos.

278N/A Setup /etc/krb5/krb5.conf to use the KDC created earlier

278N/A

278N/A2. 'kinit' to get a TGT as the "tester" principal created

278N/A above in step 2d.

278N/A $ kinit tester

278N/A ( enter password )

278N/A

278N/A3. Use mozilla (with 'negotiateauth' extension installed)

278N/A to access the Kerberos protected page (created above

278N/A in steps 4-6).

278N/A

278N/A If the pages do not show up, its probably due to

278N/A a misconfigured Kerberos configuration on the client

278N/A or the server (or both). There is very little that

278N/A needs to be done for Mozilla or apache.

278N/A