5864N/A#!/bin/ksh93 -p
5864N/A#
5864N/A# CDDL HEADER START
5864N/A#
5864N/A# The contents of this file are subject to the terms of the
5864N/A# Common Development and Distribution License (the "License").
5864N/A# You may not use this file except in compliance with the License.
5864N/A#
5864N/A# You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
5864N/A# or http://www.opensolaris.org/os/licensing.
5864N/A# See the License for the specific language governing permissions
5864N/A# and limitations under the License.
5864N/A#
5864N/A# When distributing Covered Code, include this CDDL HEADER in each
5864N/A# file and include the License file at usr/src/OPENSOLARIS.LICENSE.
5864N/A# If applicable, add the following below this CDDL HEADER, with the
5864N/A# fields enclosed by brackets "[]" replaced with your own identifying
5864N/A# information: Portions Copyright [yyyy] [name of copyright owner]
5864N/A#
5864N/A# CDDL HEADER END
5864N/A#
5864N/A
5864N/A#
5864N/A# Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
5864N/A#
5864N/A
5864N/A# have to use longer string because the end of security/kerberos5 matches
5864N/A# 2 packages, old and new.
5864N/APACKAGES_NEEDED="$SASL_PACKAGES_NEEDED \
5864N/A pkg://solaris/security/kerberos-5 \
5864N/A security/kerberos-5/kdc "
5864N/A
5864N/Apkg list $PACKAGES_NEEDED > /dev/null
5864N/Aif (( $? != 0 ))
5864N/Athen
5864N/A pkg install $PACKAGES_NEEDED
5864N/Afi
5864N/A
5864N/Apkg list $PACKAGES_NEEDED > /dev/null
5864N/Aif (( $? != 0 ))
5864N/Athen
5864N/A echo "One or more packages failed to install"
5864N/A exit 1
5864N/Afi
5864N/A
5864N/Apasswd="1234"
5864N/A
5864N/Atrap "echo 'A command failed, aborting.'; exit 1" ERR
5864N/A
5864N/Aif ! $force
5864N/Athen
5864N/A ok_to_proceed "Existing KDC config will be destroyed, okay to proceed?"
5864N/Afi
5864N/A
5864N/Atrap - ERR # in kdcmgr destroy fails, run it again
5864N/Ayes | /usr/sbin/kdcmgr destroy > /dev/null
5864N/Aif (( $? != 0 ))
5864N/Athen
5864N/A yes | /usr/sbin/kdcmgr destroy > /dev/null
5864N/Afi
5864N/Aprint "Existing KDC config destroyed."
5864N/Atrap "echo 'A command failed, aborting.'; exit 1" ERR
5864N/A
5864N/Apasswd_file=$(/usr/bin/mktemp /var/run/setup_kdc_passwd.XXXXXX)
5864N/A
5864N/Aprint $passwd > $passwd_file
5864N/A
5864N/A# create the master KDC
5864N/Aif [[ -n $master_kdc ]]
5864N/Athen
5864N/A /usr/sbin/kdcmgr -a $admin_princ -r $realm -p $passwd_file create -m $master_kdc slave
5864N/Aelse
5864N/A /usr/sbin/kdcmgr -a $admin_princ -r $realm -p $passwd_file create master
5864N/Afi
5864N/A
5864N/Arm -f $passwd_file
5864N/A
5864N/A# Optional stuff follows...
5864N/A
5864N/A# Note, this next section is adding various service principals local to
5864N/A# this system. If you have servers running on other systems, edit this
5864N/A# section to add the services using the FQDN hostnames of those systems
5864N/A# and ouput the keytab to a non-default filename.
5864N/A# You will then either copy the non-default filename created on the
5864N/A# system you ran this script on or login to the other system and do a
5864N/A# kadmin/ktadd to add the service principal to the /etc/krb5/krb5.keytab
5864N/A# located on that server.
5864N/A
5864N/A# addprincs if not in slave mode
5864N/Aif [[ -z $master_kdc ]]
5864N/Athen
5864N/A if [[ -n "$kt_config_file" ]]
5864N/A then
5864N/A if ! $force
5864N/A then
5864N/A ok_to_proceed "Existing keytab files will be modified, okay to proceed?"
5864N/A fi
5864N/A while read host services
5864N/A do
5864N/A if [[ "$host" == "#*" ]]
5864N/A then
5864N/A # skip comments
5864N/A continue
5864N/A fi
5864N/A if [[ "$host" != "localhost" ]]
5864N/A then
5864N/A hostkeytab="/var/run/${host}.keytab"
5864N/A rm -f $hostkeytab
5864N/A kt_transfer_command[num_keytabs]="scp $hostkeytab ${host}:/etc/krb5/krb5.keytab"
5864N/A fi
5864N/A for service in $services
5864N/A do
5864N/A if [[ "$host" == "localhost" ]]
5864N/A then
5864N/A # add service to KDC's keytab
5864N/A kadmin.local -q "addprinc -randkey $service/$fqdn"
5864N/A kadmin.local -q "ktadd $service/$fqdn"
5864N/A print "Added $service/$fqdn to /etc/krb5/krb5.keytab"
5864N/A else
5864N/A # add service to $host's keytab
5864N/A kadmin.local -q "addprinc -randkey $service/$host"
5864N/A kadmin.local -q "ktadd -k $hostkeytab $service/$host"
5864N/A print "\nAdded $service/$host to $hostkeytab"
5864N/A fi
5864N/A done
5864N/A ((num_keytabs = num_keytabs + 1))
5864N/A done < $kt_config_file
5864N/A fi
5864N/A
5864N/A if [[ -n "$crossrealm" ]]
5864N/A then
5864N/A # Setup Cross-realm auth.
5864N/A kadmin.local -q "addprinc -pw $passwd krbtgt/$realm@$crossrealm"
5864N/A kadmin.local -q "addprinc -pw $passwd krbtgt/$crossrealm@$realm"
5864N/A print "\n\nNote, /etc/krb5/krb5.conf will need to be modified to support crossrealm."
5864N/A fi
5864N/A
5864N/A # Optional, Add service principals on KDC
5864N/A for srv in nfs ldap smtp imap cifs
5864N/A do
5864N/A # randomizes the key anyway so use the -randkey option for addprinc).
5864N/A kadmin.local -q "addprinc -randkey $srv/$fqdn"
5864N/A kadmin.local -q "ktadd $srv/$fqdn"
5864N/A done
5864N/A
5864N/A
5864N/A # "tester" needed for setup
5864N/A kadmin.local -q "addprinc -pw $passwd tester"
5864N/A
5864N/A # "ken" needed for test
5864N/A echo "$passwd" | saslpasswd2 -c -p -f ./sasldb ken
5864N/A kadmin.local -q "addprinc -pw $passwd ken"
5864N/A
5864N/Afi # addprincs if not in slave mode
5864N/A
5864N/A# turn off err trap because svcadm below may return an unimportant error
5864N/Atrap "" ERR
5864N/A
5864N/Aif ! egrep '^[ ]*krb5[ ]+390003' /etc/nfssec.conf > /dev/null
5864N/Athen
5864N/A tmpnfssec=$(/usr/bin/mktemp /tmp/nfssec.conf_XXXXX)
5864N/A [[ -n $tmpnfssec ]] || exit 1
5864N/A sed -e 's/^ *# *krb5/krb5/g' /etc/nfssec.conf > $tmpnfssec
5864N/A mv -f $tmpnfssec /etc/nfssec.conf
5864N/A print 'Enabled krb5 sec in /etc/nfssec.conf.'
5864N/A print 'Copy /etc/nfssec.conf to all systems doing NFS sec=krb5*.'
5864N/A print
5864N/Afi
5864N/A
5864N/A# get time and DNS running
5864N/A
5864N/Aif [[ ! -f /etc/inet/ntp.conf && -f /etc/inet/ntp.client ]]
5864N/Athen
5864N/A cp /etc/inet/ntp.client /etc/inet/ntp.conf
5864N/Afi
5864N/Aif [[ -f /etc/inet/ntp.conf ]]
5864N/Athen
5864N/A svcadm enable -s svc:/network/ntp:default
5864N/Afi
5864N/A
5864N/Asvcadm enable -s svc:/network/security/ktkt_warn:default
5864N/A
5864N/Aif ! svcadm enable -s svc:/network/rpc/gss:default
5864N/Athen
5864N/A svcs -x svc:/network/rpc/gss:default
5864N/A cat <<-EOF
5864N/A
5864N/AError, the gss service did not start. You will not be able to do nfssec with sec=krb5*
5864N/A
5864N/AEOF
5864N/A exit 1
5864N/Afi
5864N/A
5864N/Atmpccache=$(/usr/bin/mktemp /tmp/ccache_XXXXXX)
5864N/A[[ -n $tmpccache ]] || exit 1
5864N/Aif ! print "$passwd" | kinit -c $tmpccache tester
5864N/Athen
5864N/A print -u2 "Warning, kinit for tester princ failed, kdc setup is not working!"
5864N/A exit 1
5864N/Afi
5864N/A
5864N/Ainteger i=0
5864N/Awhile ((i < num_keytabs))
5864N/Ado
5864N/A if ((i == 0))
5864N/A then
5864N/A print "\nRun the following commands to transfer generated keytabs:"
5864N/A fi
5864N/A print ${kt_transfer_command[i]}
5864N/A ((i = i + 1))
5864N/Adone
5864N/A