65 lines
1.5 KiB
Bash
Executable File
65 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
|
|
set -e
|
|
|
|
REALM="${KRB5_REALM:-EXAMPLE.ORG}"
|
|
DOMAIN="${KRB5_DOMAIN:-example.org}"
|
|
KDC_HOST="${KRB5_KDC_HOST:-localhost}"
|
|
MASTER_PASSWORD="${KRB5_MASTER_PASSWORD:-changeit}"
|
|
ADMIN_PRINCIPAL="${KRB5_ADMIN_PRINCIPAL:-admin}"
|
|
ADMIN_PASSWORD="${KRB5_ADMIN_PASSWORD:-changeit}"
|
|
|
|
cat > /etc/krb5.conf <<EOF
|
|
[libdefaults]
|
|
default_realm = ${REALM}
|
|
dns_lookup_realm = false
|
|
dns_lookup_kdc = false
|
|
|
|
[realms]
|
|
${REALM} = {
|
|
kdc = ${KDC_HOST}
|
|
admin_server = ${KDC_HOST}
|
|
}
|
|
|
|
[domain_realm]
|
|
.${DOMAIN} = ${REALM}
|
|
${DOMAIN} = ${REALM}
|
|
EOF
|
|
|
|
cat > /etc/krb5kdc/kdc.conf <<EOF
|
|
[kdcdefaults]
|
|
kdc_ports = 88
|
|
|
|
[realms]
|
|
${REALM} = {
|
|
database_name = /var/lib/krb5kdc/principal
|
|
admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
|
|
acl_file = /etc/krb5kdc/kadm5.acl
|
|
key_stash_file = /etc/krb5kdc/.k5.${REALM}
|
|
kdc_ports = 88
|
|
max_life = 10h 0m 0s
|
|
max_renewable_life = 7d 0h 0m 0s
|
|
master_key_type = aes256-cts
|
|
supported_enctypes = aes256-cts:normal aes128-cts:normal
|
|
}
|
|
EOF
|
|
|
|
cat > /etc/krb5kdc/kadm5.acl <<EOF
|
|
${ADMIN_PRINCIPAL}/admin@${REALM} *
|
|
EOF
|
|
|
|
if [ ! -f /var/lib/krb5kdc/principal ]; then
|
|
echo "Initializing Kerberos realm ${REALM}..."
|
|
kdb5_util create -s -P "${MASTER_PASSWORD}" -r "${REALM}"
|
|
kadmin.local -q "addprinc -pw ${ADMIN_PASSWORD} ${ADMIN_PRINCIPAL}/admin@${REALM}"
|
|
echo "Realm initialized."
|
|
fi
|
|
|
|
krb5kdc -n &
|
|
KDC_PID=$!
|
|
|
|
kadmind -nofork &
|
|
KADMIND_PID=$!
|
|
|
|
wait -n $KDC_PID $KADMIND_PID
|