RE: Solaris 9 authentication and access control into Active Directory

The trick to changing passwords with the Kerberos on Solaris is to add this 
token to the krb5.conf in the [realms] section (inside of the definition for 
the realm):

        kpasswd_protocol = SET_CHANGE

For example:

        [realms]
                AD.EXAMPLE.COM = {
                        kdc = ...:88
                        admin_server = ...:464
                        [...]
                        kpasswd_protocol = SET_CHANGE
                }

After that, kpasswd works just fine.

Cheers,
 - Mike Myers, Mike.Myers <at> nwdc.net


-----Original Message-----
From: Reg Quinton [mailto:reggers@ist.uwaterloo.ca]
Sent: Wednesday, September 15, 2004 6:22 AM
To: focus-sun@securityfocus.com
Cc: "Ron Ogle"
Subject: Re: Solaris 9 authentication and access control into Active
Directory


From: "Ron Ogle" <ogler@tce.com>
> 1. Use Kerberos on Solaris 9 via PAM to authenticate to AD using the 
> Windows username/password.

I've done that with vendor's implementation -- no code imported to system. 
There's a good Microsoft paper at

http://www.microsoft.com/windows2000/techinfo/planning/security/kerbsteps.asp

It's an awkward configuration and not much fun to set up. The trick is to 
implement a user within your Active Directory for the machine, set his 
password, then import that information to Unix. It works but I never got 
the password change figured out. I have some very rough notes here that I 
can share:

http://ist.uwaterloo.ca/security/howto/drafts/2002-08-23/