|
 |
4be148 |
From b52acabf478e8d1aa19f7823aade81eed1553143 Mon Sep 17 00:00:00 2001
|
|
|
4be148 |
From: Nalin Dahyabhai <nalin@dahyabhai.net>
|
|
|
4be148 |
Date: Tue, 22 Apr 2014 16:31:14 -0400
|
|
|
4be148 |
Subject: [PATCH 10/13] Add some longer-form docs for HTTPS
|
|
|
4be148 |
|
|
|
4be148 |
Add some longer-form documentation for the new HTTPS support, walking a
|
|
|
4be148 |
prospective administrator through generating a bare minimal signing
|
|
|
4be148 |
setup, deploying a WSGI-based proxy server onto an Apache httpd server
|
|
|
4be148 |
using mod_ssl and mod_wsgi, and configuring clients to use it.
|
|
|
4be148 |
|
|
|
4be148 |
ticket: 7929
|
|
|
4be148 |
---
|
|
|
4be148 |
doc/admin/https.rst | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
|
|
|
4be148 |
doc/admin/index.rst | 1 +
|
|
|
4be148 |
2 files changed, 49 insertions(+)
|
|
|
4be148 |
create mode 100644 doc/admin/https.rst
|
|
|
4be148 |
|
|
|
4be148 |
diff --git a/doc/admin/https.rst b/doc/admin/https.rst
|
|
|
4be148 |
new file mode 100644
|
|
|
4be148 |
index 0000000..b4e68b2
|
|
|
4be148 |
--- /dev/null
|
|
|
4be148 |
+++ b/doc/admin/https.rst
|
|
|
4be148 |
@@ -0,0 +1,48 @@
|
|
|
4be148 |
+.. _https:
|
|
|
4be148 |
+
|
|
|
4be148 |
+HTTPS proxy configuration
|
|
|
4be148 |
+=========================
|
|
|
4be148 |
+
|
|
|
4be148 |
+In addition to being able to use UDP or TCP to communicate directly
|
|
|
4be148 |
+with a KDC as is outlined in RFC4120, and with kpasswd services in a
|
|
|
4be148 |
+similar fashion, the client libraries can attempt to use an HTTPS
|
|
|
4be148 |
+proxy server to communicate with a KDC or kpasswd service, using the
|
|
|
4be148 |
+protocol outlined in [MS-KKDCP].
|
|
|
4be148 |
+
|
|
|
4be148 |
+Communicating with a KDC through an HTTPS proxy allows clients to
|
|
|
4be148 |
+contact servers when network firewalls might otherwise prevent them
|
|
|
4be148 |
+from doing so. The use of TLS also encrypts all traffic between the
|
|
|
4be148 |
+clients and the KDC, preventing observers from conducting password
|
|
|
4be148 |
+dictionary attacks or from observing the client and server principals
|
|
|
4be148 |
+being authenticated, at additional computational cost to both clients
|
|
|
4be148 |
+and servers.
|
|
|
4be148 |
+
|
|
|
4be148 |
+An HTTPS proxy server is provided as a feature in some versions of
|
|
|
4be148 |
+Microsoft Windows Server, and a WSGI implementation named `kdcproxy`
|
|
|
4be148 |
+is available in the python package index.
|
|
|
4be148 |
+
|
|
|
4be148 |
+
|
|
|
4be148 |
+Configuring the clients
|
|
|
4be148 |
+-----------------------
|
|
|
4be148 |
+
|
|
|
4be148 |
+To use an HTTPS proxy, a client host must trust the CA which issued
|
|
|
4be148 |
+that proxy's SSL certificate. If that CA's certificate is not in the
|
|
|
4be148 |
+system-wide default set of trusted certificates, configure the
|
|
|
4be148 |
+following relation in the client host's :ref:`krb5.conf(5)` file in
|
|
|
4be148 |
+the appropriate :ref:`realms` subsection::
|
|
|
4be148 |
+
|
|
|
4be148 |
+ http_anchors = FILE:/etc/krb5/cacert.pem
|
|
|
4be148 |
+
|
|
|
4be148 |
+Adjust the pathname to match the path of the file which contains a
|
|
|
4be148 |
+copy of the CA's certificate. The `http_anchors` option is documented
|
|
|
4be148 |
+more fully in :ref:`krb5.conf(5)`.
|
|
|
4be148 |
+
|
|
|
4be148 |
+Configure the client to access the KDC and kpasswd service by
|
|
|
4be148 |
+specifying their locations in its :ref:`krb5.conf(5)` file in the form
|
|
|
4be148 |
+of HTTPS URLs for the proxy server::
|
|
|
4be148 |
+
|
|
|
4be148 |
+ kdc = https://server.fqdn/KdcProxy
|
|
|
4be148 |
+ kpasswd_server = https://server.fqdn/KdcProxy
|
|
|
4be148 |
+
|
|
|
4be148 |
+If the proxy and client are properly configured, client commands such
|
|
|
4be148 |
+as ``kinit``, ``kvno``, and ``kpasswd`` should all function normally.
|
|
|
4be148 |
diff --git a/doc/admin/index.rst b/doc/admin/index.rst
|
|
|
4be148 |
index 3406843..3cd57f5 100644
|
|
|
4be148 |
--- a/doc/admin/index.rst
|
|
|
4be148 |
+++ b/doc/admin/index.rst
|
|
|
4be148 |
@@ -17,6 +17,7 @@ For administrators
|
|
|
4be148 |
otp.rst
|
|
|
4be148 |
princ_dns.rst
|
|
|
4be148 |
enctypes.rst
|
|
|
4be148 |
+ https.rst
|
|
|
4be148 |
|
|
|
4be148 |
.. toctree::
|
|
|
4be148 |
:maxdepth: 1
|
|
|
4be148 |
--
|
|
|
4be148 |
2.1.0
|
|
|
4be148 |
|