1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
|
Template: debian-edu-router-plugin.krb5-connector/krb5-connector-enabled
Type: boolean
Default: false
_Description: Enable Krb5 Connector plugin?
This plugin provides the possibility to let proxy-using users authenticate
themselves via Kerberos5.
Template: debian-edu-router-plugin.krb5-connector/kerberos-server-kdc-host
Type: string
Default: kerberos
_Description: Kerberos KDC host:
Enter the hostname or IP address of your Kerberos Key Distribution Center
(KDC), which handles authentication and ticket issuing.
Template: debian-edu-router-plugin.krb5-connector/kerberos-server-admin-host
Type: string
Default: kerberos
_Description: Kerberos admin server host:
Enter the hostname or IP address of your Kerberos admin server, responsible
for managing and maintaining the Kerberos database.
Template: debian-edu-router-plugin.krb5-connector/kerberos-server-admin-variant
Type: select
Default: MIT
Choices: Heimdall, Microsoft, MIT
_Description: Kerberos admin server variant:
Select the type of your Kerberos admin server. Choose from:
.
- MIT: MIT Kerberos implementation (using kadmin).
.
- Heimdall: Heimdall Kerberos implementation (using kadmin).
.
- Microsoft: Microsoft Active Directory (using msktutil).
Template: debian-edu-router-plugin.krb5-connector/kerberos-realm
Type: string
Default: INTERN
_Description: Kerberos realm:
Enter the name of your Kerberos realm. The realm defines the administrative
domain for Kerberos authentication, including policies and the Kerberos
database. It is typically represented as an uppercase string, e.g., EXAMPLE.COM.
Template: debian-edu-router-plugin.krb5-connector/kerberos-realm-default
Type: string
Default: INTERN
_Description: Kerberos default realm:
Enter the default Kerberos realm for authentication. This realm is used as
the default when one does not specify a realm explicitly.
Template: debian-edu-router-plugin.krb5-connector/kerberos-domain
Type: string
Default: intern
_Description: Kerberos domain:
Enter the domain name associated with your Kerberos realm. This domain
is used to map hostnames to the Kerberos realm for authentication purposes.
Template: debian-edu-router-plugin.krb5-connector/computer-account-create-mode
Type: select
__Choices: Pre-Created, Administrator
_Description: Use pre-created account or specify administrator credentials?
This plugin will create a computer account for this host. This account will
store the SPNs (Service Principal Name), which is needed for this router.
Please select wether you want to
.
Use a pre-created account:
.
To pre-create a computer account, you may use the Active Directory Users and
Computers GUI, select "new computer" from the right click menu, and type the
short DNS name (${ACCOUNT_NAME}), then right click on the newly created object
and select "Reset account" to set the password to the default value.
.
Use an administrator account:
.
You want your computer account to be created automatically by this router.
You'll need an account with administrator privileges, if you want to continue.
.
You can use the builtin 'administrator' account, for example.
.
It is recommended, to pre-create an extra computer account, with less privileges
specifically for this host. It will manage itself automatically and no
administrator credentials need to be saved on this computer.
Template: debian-edu-router-plugin.krb5-connector/computer-account-initial-password
Type: password
_Description: Enter initial password for existing computer account:
Enter the account's initial password you have chosen or leave empty, if you
want msktutil to try the default machine password.
.
This account does not need administrative privileges.
.
The account password will be automatically changed every 30 days. Please
consult the documentation files for further information.
Template: debian-edu-router-plugin.krb5-connector/computer-account-base-ou
Type: string
_Description: Enter base OU for the computer account:
Optionally specify an LDAP base OU for creating the new computer account.
.
Unless the given string ends with the domain's base DN, it is assumed to be a
relative path: For example, specifying 'OU=Unix' for a computer named
SERVER in an Active Directory domain example.com would create a computer
account in the LDAP path: CN=SERVER,OU=Unix,DC=EXAMPLE,DC=COM.
.
If not specified, the default value is read from AD (and the default there,
unless modified by an admin, is CN=Computers for machine accounts).
Template: debian-edu-router-plugin.krb5-connector/kerberos-server-admin-principal
Type: string
Default: root/admin@INTERN
_Description: Kerberos admin user principal:
Enter the principal name of the Kerberos admin user. This user has to have
administrative privileges for managing the Kerberos database.
Template: debian-edu-router-plugin.krb5-connector/kerberos-server-admin-password
Type: password
_Description: Kerberos admin user password:
Enter the password for the Kerberos admin user. This password is used for
authenticating against the Kerberos server for administrative tasks.
|
