Cisco WS-X6K-SUP1A-PFC= Software Guide - Page 441

Chapter 21 Configuring Switch Access Using AAA Configuring Authentication Configuring Kerberos Authentication These sections describe how to configure Kerberos authentication on the switch. • Configuring a Kerberos Server, page 21-31 • Enabling Kerberos, page 21-32 • Defining the Kerberos Local Realm, page 21-33 • Specifying a Kerberos Server, page 21-33 • Mapping a Kerberos Realm to a Host Name or DNS Domain, page 21-34 • Copying SRVTAB Files, page 21-34 • Deleting an SRVTAB Entry, page 21-35 • Enabling Credentials Forwarding, page 21-36 • Disabling Credentials Forwarding, page 21-37 • Defining and Clearing a Private DES Key, page 21-38 • Encrypting a Telnet Session, page 21-38 • Displaying and Clearing Kerberos Configurations, page 21-39 Configuring a Kerberos Server Before you can use Kerberos as an authentication method on the switch, you need to configure the Kerberos server. You will need to create a database for the KDC and add the switch to the database. Note Kerberos authentication requires that NTP is enabled. Additionally, we recommend that you enable DNS. To configure the Kerberos server, perform this procedure: Step 1 Step 2 Step 3 Step 4 Step 5 Step 6 Before you can enter the switch in the Kerberos server's key table, you must create the database the KDC will use. In the following example, a database called CISCO.EDU is created: /usr/local/sbin/kdb5_util create -r CISCO.EDU -s Add the switch to the database. The following example adds a switch called Cat6509 to the CISCO.EDU database: ank host/[email protected] Add the username as follows: ank [email protected] Add the administrative principals as follows: ank user1/[email protected] Using the admin.local ktadd command, create the database entry for the switch as follows: ktadd host/[email protected] Move the keytab file to a place where the switch can reach it. 78-13315-02 Catalyst 6000 Family Software Configuration Guide-Releases 6.3 and 6.4 21-31