Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a domain name. Let's call it There's a server - server A - which is has hosting setup on it, and configured as it's domain name. Meaning, resolving, will get server A's IP.

I have another server - server B - which is a different server. It is configured as

I want to hold subversion, using LDAP as the user directory.

When configuring LDAP and Kerberos, what parts of the domain do I use in which cases ?
Meaning, what is the realm of kerberos? or ?
What do I configure in the ldap dc parts? Is it dc=example,dc=com or dc=sub,dc=example,dc=com ?

For a bit more explanation about what I'm trying to do in details, see How do I configure an ldap server on ubuntu 11.04 ? (for use with subversion and trac)

share|improve this question
up vote 1 down vote accepted

The Kerberos realm you want to use should be in your case. You could even go so far as to create for your realm and alias to it on the servers you wish to use kerberos on. The sub-domain would contain any Kerberos-related SRV records you might create.

For your hosting server, I would strongly recommend creating another A-record for your hosting server ( for example) and configure the server's network services to consider that its primary address. "" would still point to it, but only for web-hosting reasons. Otherwise you'd have to alias ".COM" as a realm of "EXAMPLE.COM" for network services hosted on the hosting server, and that could have bad side-effects.

The reason for this is because of how Kerberos figures out realms. A DNS name is decoded into a realm by taking the first label of the DNS name as the hostname, and any labels after that as the realm. So, "" would belong on the EXAMPLE.COM realm, and "" would belong in the ".COM" realm. By naming the server for Kerberos purposes something with three DNS labels instead of two you can avoid placing large parts of the internet in your Kerberos realm.

Aliases are set in the /etc/krb5.conf file

share|improve this answer

First off, LDAP != Kerberos. If you want to use Kerberos to communicating with an Active Directory domain, which is what I assume you want to do, the clues are here or by Googling how to configure a Kerberos client to authenticate against AD. LDAP is different, and you really need to give a hell of a lot more detail to know what it is you want configured on what platform. I assume it is Unix or Linux, but a very specific version and what kind of authentication (console, GUI, Squid web proxy) is in order.

share|improve this answer
I know LDAP != Kerberos, I was referring to the steps in this guide:…. I don't need AD, I explain my needs in… – Doron May 4 '11 at 9:47
Dude, my bad. Since the other post is far more detailed, I did not know you knew what you were doing. Apologies. – ajstein May 4 '11 at 10:05
No probs! Any chance you could contribute to the other post ? :-) – Doron May 4 '11 at 11:23
Well, not really sure. You might want to check out the Debian docs since that is pretty close to Ubuntu, EC2 or not. Also, keep in mind you seem to be putting a cart before the horse. You are interested in configuring a client, but I saw no mention of setting up a Kerberos realm or LDAP. There are lots of flexible settings, and how you set up the former to inform how you configure the client, hence my silence. – ajstein May 4 '11 at 11:55
Ugh, I should have looked at the blog post. I am a huge ass. – ajstein May 4 '11 at 11:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.