kerberos_and_ldap课件.pptVIP

Kerberos and LDAP Jason Heiss February 2002 Why is everybody still using NIS? NIS is easy to setup Easy to administer Scales fairly well Widely supported (clients and servers) Goals Replace NIS with something secure Weakly crypted passwords (and everything else) sent over the network in the clear Difficult to firewall No system authentication Provide additional directory services Replace/supplement paper staff directory Other Options Copy local passwd file Error-prone Requires root-level trust between clients and server NIS+ Complicated Limited client support Dead LDAP LDAP is a directory access protocol Up to the implementation to use whatever backend it wants LDAP can be used to store any form of information, but designed for directories Small bits of data Mostly read access Goals Revisited Security Clients authenticate server Encrypt data in transit Simplify firewalling Administration Easy to configure Easy to maintain Scalability Widespread client support LDAP Security Authentication LDAP clients authenticate server by ensuring server has an SSL certificate signed by a CA they trust Encryption SSL Access control ACLs based on Kerberos principal user authenticates with Useful for non-NIS data like home phone number Scalability and Client Support Scalability Similar model to NIS for simple situations Master and replicas Hierarchical relationships possible in larger environments Client support nss_ldap module for any OS which supports Name Service Switch (Solaris or GNU) BIND IRS (NSS work-alike from BIND 8) Why not LDAP? Administration Initial configuration complicated SSL certificate management Schemas Kerberos Ongoing management complicated NIS+ itis No vi; add/change/delete via command line utilities Command line utilities take bewildering array of options Why Kerberos LDAP is designed for public information ACLs can protect userPassword, but… Kerberos supports password security Dictionary checks of new passwords Password expiration Kerberos useful for other s