Administrator's Guide - Kerio Software Archive

Chapter 24 Kerberos AuthenticationAuthentication against Open DirectoryBefore setting Kerberos user authentication at Linux, it is recommended to check that authenticationagainst the domain functions correctly (check this by logging in the system using anaccount defined in the Open Directory). If the attempt fails, check out the following issues:1. Kerio MailServer must belong to the Kerberos area (Open Directory domain) against whichit authenticates. If Kerio MailServer is not the area member, the Kerberos system willnot be working and the users will have to use a local password, i.e. different from thepassword for the domain.2. the DNS service must be set correctly on the Kerio MailServer’s host.3. time of the Kerio MailServer host and the Open Directory must be synchronized.For proper authentication, define the /etc/krb5.conf file.Example of krb5.conf file’s configuration:[logging]default = FILE:/var/log/krb5libs.logkdc = FILE:/var/log/krb5kdc.logadmin_server = FILE:/var/log/kadmind.log[libdefaults]ticket_lifetime = 24000default_realm = COMPANY.COMdns_lookup_realm = falsedns_lookup_kdc = yes[realms]COMPANY.CZ = {kdc = server.company.comadmin_server = server.company.comdefault_domain = company.com}[domain_realm].company.com = COMPANY.COMcompany.com = COMPANY.COM[kdc]profile = /var/kerberos/krb5kdc/kdc.conf[appdefaults]pam = {270