Set up a small Kerberos realm for kernel tests that need Kerberos, for example NFS with sec=krb5. One node runs the KDC and kadmind, all nodes use the same krb5.conf and add their own service principals.
All functions accept these optional named arguments. Each one defaults to a fixed test value:
realm - realm name, defaults to KERNEL-QE.TESTadmin - admin principal, defaults to root/adminadmin_pass - password of the admin principal, defaults to Admin_passdb_pass - master password of the KDC database, defaults to DB_phraseenctype - the only encryption type of the realm, defaults to krb5_enctype()A function uses only the settings that it needs. The KDC and all other nodes must use the same values: if a caller overrides a setting on the KDC, it must pass the same value on the other nodes too.
my $enctype = krb5_enctype();Return the encryption type to use for the realm. SLE older than 15-SP6 does not support aes256-cts-hmac-sha384-192 in the kernel GSS code, thus use aes256-cts-hmac-sha1-96 there.
setup_krb5_conf($kdc [, realm => $realm, enctype => $enctype, libdefaults => {$key => $value}, includedir => $dir]);Write krb5.conf for the test realm with kdc as KDC and admin server. kdc can include a port, for example 127.0.0.1:88.
Hostname canonicalization is disabled, thus principals use the host names exactly as the tests use them. The acceptor accepts each key in its keytab, independent of the host name that the client used.
libdefaults adds keys to the [libdefaults] section or replaces the default values. A key with the value undef is removed.
includedir adds an includedir directive in front of the sections. It defaults to /etc/krb5.conf.d if that directory exists, the same as the vendor configuration. Then the system crypto policy, for example FIPS mode, applies to the test realm too. The included files are read first and for a key that occurs more than once, the first value is used. Thus the included files take precedence, for example the permitted_enctypes of the crypto policy. Set includedir to undef to write a configuration that contains only the values of this function.
Write the test configuration to /etc/krb5.conf. This file takes precedence over the vendor configuration in /usr/etc/krb5.conf.
Call it first, after the Kerberos packages are installed: it also makes the MIT Kerberos tools available in the current shell. SLE 15 installs them to /usr/lib/mit/bin and /usr/lib/mit/sbin and adds these to PATH only in new login shells, through /etc/profile.d/krb5.sh. Products without that file have the tools in PATH already.
setup_krb5_kdc([realm => $realm, enctype => $enctype, admin => $admin, admin_pass => $pass, db_pass => $pass]);Create the realm database on this node, add the admin principal and start krb5kdc and kadmind. Call setup_krb5_conf() with the same realm before.
add_principal($name [, keytab => 1, remote => 1, admin => $admin, admin_pass => $pass]);Add the principal name with a random key to the KDC, for example the user principal fsgqa. Give name without realm, the principal is in the default realm of krb5.conf.
Use keytab to also add the key to /etc/krb5.keytab.
Use remote on nodes other than the KDC: then kadmin connects to kadmind as the admin principal, else kadmin.local is used.
The function makes sure that the principal exists, because kadmin -q does not always report a failed query in its exit status.
add_host_principals($service [, remote => 1, admin => $admin, admin_pass => $pass]);Add the principal service/host to the KDC and its key to /etc/krb5.keytab, see add_principal(). host is the short host name and, if different, the fully qualified host name, thus the key matches both names.