RE: Solaris 9 authentication and access control into Active Directory

The trick to changing passwords with the Kerberos on Solaris is to add this token to the krb5.conf in the [realms] section (inside of the definition for the realm):

	kpasswd_protocol = SET_CHANGE

For example:

	[realms]
		AD.EXAMPLE.COM = {
			kdc = ...:88
			admin_server = ...:464
			[...]
			kpasswd_protocol = SET_CHANGE
		}

After that, kpasswd works just fine.

Cheers,
 - Mike Myers, Mike.Myers <at> nwdc.net


-----Original Message-----
From: Reg Quinton [mailto:[email protected]]
Sent: Wednesday, September 15, 2004 6:22 AM
To: [email protected]
Cc: "Ron Ogle"
Subject: Re: Solaris 9 authentication and access control into Active
Directory


From: "Ron Ogle" <[email protected]>
> 1. Use Kerberos on Solaris 9 via PAM to authenticate to AD using the 
> Windows username/password.

I've done that with vendor's implementation -- no code imported to system. 
There's a good Microsoft paper at

http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp

It's an awkward configuration and not much fun to set up. The trick is to 
implement a user within your Active Directory for the machine, set his 
password, then import that information to Unix. It works but I never got 
the password change figured out. I have some very rough notes here that I 
can share:

http://ist.uwaterloo.ca/security/howto/drafts/2002-08-23/