1

I have a domain name. Let's call it example.com. There's a server - server A - which is has hosting setup on it, and example.com configured as it's domain name. Meaning, resolving example.com, will get server A's IP.

I have another server - server B - which is a different server. It is configured as sub.example.com.

I want sub.example.com to hold subversion, using LDAP as the user directory.

When configuring LDAP and Kerberos, what parts of the domain do I use in which cases ?
Meaning, what is the realm of kerberos? example.com or sub.example.com ?
What do I configure in the ldap dc parts? Is it dc=example,dc=com or dc=sub,dc=example,dc=com ?

For a bit more explanation about what I'm trying to do in details, see How do I configure an ldap server on ubuntu 11.04 ? (for use with subversion and trac)

Improve this question

2 Answers 2

Reset to default
1

The Kerberos realm you want to use should be example.com in your case. You could even go so far as to create kerb.example.com for your realm and alias example.com to it on the servers you wish to use kerberos on. The sub-domain would contain any Kerberos-related SRV records you might create.

For your hosting server, I would strongly recommend creating another A-record for your hosting server (host1.example.com for example) and configure the server's network services to consider that its primary address. "example.com" would still point to it, but only for web-hosting reasons. Otherwise you'd have to alias ".COM" as a realm of "EXAMPLE.COM" for network services hosted on the hosting server, and that could have bad side-effects.

The reason for this is because of how Kerberos figures out realms. A DNS name is decoded into a realm by taking the first label of the DNS name as the hostname, and any labels after that as the realm. So, "sub.example.com" would belong on the EXAMPLE.COM realm, and "example.com" would belong in the ".COM" realm. By naming the server for Kerberos purposes something with three DNS labels instead of two you can avoid placing large parts of the internet in your Kerberos realm.

Aliases are set in the /etc/krb5.conf file

Improve this answer
1

First off, LDAP != Kerberos. If you want to use Kerberos to communicating with an Active Directory domain, which is what I assume you want to do, the clues are here or by Googling how to configure a Kerberos client to authenticate against AD. LDAP is different, and you really need to give a hell of a lot more detail to know what it is you want configured on what platform. I assume it is Unix or Linux, but a very specific version and what kind of authentication (console, GUI, Squid web proxy) is in order.

Improve this answer
5
  • I know LDAP != Kerberos, I was referring to the steps in this guide: danbishop.org/2011/05/01/…. I don't need AD, I explain my needs in serverfault.com/questions/265756/…
    – Doron
    May 4, 2011 at 9:47
  • Dude, my bad. Since the other post is far more detailed, I did not know you knew what you were doing. Apologies.
    – songei2f
    May 4, 2011 at 10:05
  • No probs! Any chance you could contribute to the other post ? :-)
    – Doron
    May 4, 2011 at 11:23
  • Well, not really sure. You might want to check out the Debian docs since that is pretty close to Ubuntu, EC2 or not. Also, keep in mind you seem to be putting a cart before the horse. You are interested in configuring a client, but I saw no mention of setting up a Kerberos realm or LDAP. There are lots of flexible settings, and how you set up the former to inform how you configure the client, hence my silence.
    – songei2f
    May 4, 2011 at 11:55
  • Ugh, I should have looked at the blog post. I am a huge ass.
    – songei2f
    May 4, 2011 at 11:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .