167
edits
Enroll Mac in Kerberos: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
No edit summary |
||
| Line 4: | Line 4: | ||
# Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE"; | # Create a keytab on an enrolled host: TMPFILE="$(mktemp -u)"; ipa-getkeytab -s ipa.delftsolutions.nl -p host/<hostname> -k "$TMPFILE"; base64 -w0 "$TMPFILE" && echo; rm -f "$TMPFILE"; | ||
# On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022 | # On the mac as root, create the keytab: umask 026; base64 -D >/etc/krb5.keytab <<<"<key>"; umask 022 | ||
# Ensure /etc/krb5.conf file has the correct contents. | # Ensure /etc/krb5.conf file has the correct contents. | ||
# Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt | # Download the ca.crt from the debian-delftsolutions-auth repository and place it in /etc/ipa/ca.crt | ||
# As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA | # As your normal user, create the certificates folder: mkdir ~/Library/IPA; chmod 700 ~/Library/IPA | ||
| Line 15: | Line 15: | ||
# Request the certificate | # Request the certificate | ||
# Store the resulting certificate in ~/Library/IPA/laptop.crt | # Store the resulting certificate in ~/Library/IPA/laptop.crt | ||
# Add the following lines to your ~/.bash_profile. Make sure to replace <mac_username> with your Mac username and <ipa_username> with your IPA username! | |||
## alias ds_pkinit="kinit -C FILE:/Users/<mac_username>/Library/IPA/laptop.crt,/Users/<mac_username>/Library/IPA/laptop.key --keychain <ipa_username>" | |||
## ds_pkinit & disown | |||
== krb5.conf == | == krb5.conf == | ||