Administrator's Guide - Kerio Software Archive

Chapter 24 Kerberos AuthenticationCOMPANY.CZ = {kdc = server.company.com. :88admin_server = server.company.com.}Using the kinit utility, it is possible to test whether Kerio MailServer is able to authenticateagainst Kerberos. Simply open the prompt line and use the following command:kinit -S host/KMS_hostname@KERBEROS_REALM username@REALMfor example:kinit -S host/od.company.com@COMPANY.COM thenry@COMPANY.COMIf the query was processed correctly, you will be asked to enter password for the particularuser. Otherwise, an error will be reported.Now, simply change configuration in Kerio MailServer:• In the Domains section in the Kerio MailServer’s administration console, specify parameterson the Directory Service and the Advanced tabs (the Apple Open Directory realm must bespecified in the Kerberos 5 entry)Warning: Kerberos realm specified on the Advanced tab must be identical with the nameof the Kerberos realm specified in the /Library/Preferences/edu.mit.Kerberos file. Inparticular, it must match the default_realm value in this file. By result, the line may befor example default_realm = COMPANY.COM• In theKerio MailServer’s administration console, the Apple Open Directory authenticationtype must be set for user accountsAuthentication against a stand-alone Kerberos server (KDC)To use authentication against a stand-alone Kerberos server (Key Distribution Center), it isnecessary to maintain the username and password database both in Key Distribution Centerand in Kerio MailServer.Before setting Kerberos user authentication at Kerio MailServer, it is recommended to checkthat authentication against the Kerberos area functions correctly (check this by logging inthe system using an account defined in the Key Distribution Center at the host where KerioMailServer will be installed). If the attempt fails, check out the following issues:1. Kerio MailServer is a member of the Kerberos area to be authenticated against:• the Kerberos client must be installed on the computer,• usernames and passwords of all users created in Kerio MailServer must be defined inthe Key Distribution Center (required for authentication in Kerberos).2. the DNS service must be set correctly at Kerio MailServer’s host (Key Distribution Centeruses DNS queries).3. Time of Kerio MailServer and Key Distribution Center (all hosts included in the Kerberosarea) must be synchronized.280