From 33a9b234e7087f573ef08cd7318c6497ba08b439 Mon Sep 17 00:00:00 2001 From: Cy Schubert Date: Fri, 7 Jul 2017 17:03:42 +0000 Subject: Import MIT KRB5 1.15.1, which will gracefully replace KTH Heimdal. The tarball used in this import is the same tarball used in ports/krb5-115 r435378. Obtained from: http://web.mit.edu/kerberos/dist/ Thanks to: pfg (for all your tireless behind-the-scenes effort) --- doc/html/admin/https.html | 200 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 200 insertions(+) create mode 100644 doc/html/admin/https.html (limited to 'doc/html/admin/https.html') diff --git a/doc/html/admin/https.html b/doc/html/admin/https.html new file mode 100644 index 000000000000..4dcdc1b25d44 --- /dev/null +++ b/doc/html/admin/https.html @@ -0,0 +1,200 @@ + + + + + + + + HTTPS proxy configuration — MIT Kerberos Documentation + + + + + + + + + + + + + + + + + +
+
+ + +

MIT Kerberos Documentation

+ +
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ +
+
+
+ +
+
+
+ +
+

HTTPS proxy configuration

+

In addition to being able to use UDP or TCP to communicate directly +with a KDC as is outlined in RFC4120, and with kpasswd services in a +similar fashion, the client libraries can attempt to use an HTTPS +proxy server to communicate with a KDC or kpasswd service, using the +protocol outlined in [MS-KKDCP].

+

Communicating with a KDC through an HTTPS proxy allows clients to +contact servers when network firewalls might otherwise prevent them +from doing so. The use of TLS also encrypts all traffic between the +clients and the KDC, preventing observers from conducting password +dictionary attacks or from observing the client and server principals +being authenticated, at additional computational cost to both clients +and servers.

+

An HTTPS proxy server is provided as a feature in some versions of +Microsoft Windows Server, and a WSGI implementation named kdcproxy +is available in the python package index.

+
+

Configuring the clients

+

To use an HTTPS proxy, a client host must trust the CA which issued +that proxy’s SSL certificate. If that CA’s certificate is not in the +system-wide default set of trusted certificates, configure the +following relation in the client host’s krb5.conf file in +the appropriate [realms] subsection:

+
http_anchors = FILE:/etc/krb5/cacert.pem
+
+
+

Adjust the pathname to match the path of the file which contains a +copy of the CA’s certificate. The http_anchors option is documented +more fully in krb5.conf.

+

Configure the client to access the KDC and kpasswd service by +specifying their locations in its krb5.conf file in the form +of HTTPS URLs for the proxy server:

+
kdc = https://server.fqdn/KdcProxy
+kpasswd_server = https://server.fqdn/KdcProxy
+
+
+

If the proxy and client are properly configured, client commands such +as kinit, kvno, and kpasswd should all function normally.

+
+
+ + +
+
+
+
+
+

On this page

+ + +
+

Table of contents

+ + +
+

Full Table of Contents

+

Search

+
+ + + + +
+
+
+
+
+ +
+
+
Release: 1.15.1
+ © Copyright 1985-2017, MIT. +
+
+ + Contents | + previous | + next | + index | + Search | + feedback +
+
+
+ + + \ No newline at end of file -- cgit v1.3