AIX and Linux Interoperability - IBM Redbooks

3.8 Migrating users to Kerberos
In Chapter 2, “Centralized user management” on page 15, we describe how to
move users from local map files to the LDAP directory. The effort needed to
migrate a few tens of users is close to that for a few thousands of users. That is
not the case with Kerberos.
Kerberos passwords are stored in a decryptable format. One simply cannot
convert crypt or md5 hashes into the Kerberos format. In order to generate a
user principal, the administrator has to have the corresponding password in clear
text. On the other hand, the password hashes on UNIX cannot be decrypted. If
the number of your users is small, you may invite all of them to stop by and
negotiate new passwords. If there are many users, then this is probably not an
option.
One possibility may be to harvest user passwords during the migration phase. To
do this, you probably have to modify an existing authentication module or write
another for this purpose. We are not aware of any such module at the moment,
though rumor has it that there is a PAM module available for this purpose. It may
also be possible to use strategically located network sniffers, but your security
policy may prohibit that. The security policy may prohibit collecting user
passwords as well, so you should discuss the matter with management. For
example, if the new authentication module is named XPF, which simply appends
the user name and the password to a file, and the authentication currently in use
is LDAP, we can set up the following SYSTEM grammar:
SYSTEM = LDAP AND XPF
It is possible to run the kadmin program in batch mode. If there is a file with one
user name and a password per line separated by white space, the following shell
script may be used to create principals:
R=WEEORG.COM
CACHE=my.cache
ADM=admin/admin
kinit -c $CACHE -S kadmin/admin $ADM
while read user pass; do
if kadmin -c $CACHE -p $ADM -q "getprinc $user@$R" 2>/dev/null |
grep -qws $user@$R
then
echo "WARNING: principal $user@$R already exists"
else
kadmin -c $CACHE -p $ADM -q "addprinc -pw $pass $user@$R”
fi
done < userpwd.txt
This is a very sensitive business and the file containing user data must be
scrutinized before running the script.
Chapter 3. Single sign-on 81