Cisco WS-C4003 Software Guide - Page 384

Configuring Authentication Chapter 27 Configuring Switch Access Using AAA Configuring Kerberos Authentication Before you can use Kerberos as an authentication method on the switch, you need to configure the Kerberos server. You will need to create a database for the KDC and add the switch to the database. To configure the Kerberos server, follow these steps: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Before you can enter the switch in the Kerberos server's key table, you must create the database the KDC will use. In the following example, a database called CISCO.EDU is created: /usr/local/sbin/kdb5_util create -r CISCO.EDU -s Add the switch to the database. The following example adds a switch called Cat4012 to the CISCO.EDU database: ank host/[email protected] Add the user name. ank [email protected] Add the Administrative Principals. ank user1/[email protected] Create the entry for the switch in the database, using the admin.local ktadd command. ktadd host/[email protected] Move the keytab file to a place where the switch can reach it. Start the KDC server. /usr/local/sbin/krb4kdc /usr/local/sbin/kadmind The following sections describe how to configure Kerberos authentication on the switch: • Enabling Kerberos, page 27-31 • Defining the Kerberos Local-Realm, page 27-31 • Specifying a Kerberos Server, page 27-32 • Mapping a Kerberos Realm to a Host Name or DNS Domain, page 27-33 • Copying SRVTAB Files, page 27-33 • Enabling Credentials Forwarding, page 27-35 • Defining a Private DES Key, page 27-37 • Encrypting a Telnet Session, page 27-37 • Monitoring and Maintaining Kerberos, page 27-38 27-30 Software Configuration Guide-Catalyst 4000 Family, Catalyst 2948G, Catalyst 2980G, Releases 6.3 and 6.4 78-12647-02