README for IBM Network Authentication Service 1.4.0.8 ============================================================================ This Readme contains information about new features and bugs fixed in IBM Network Authentication Service 1.4.0.8, and installation instructions. Table of Contents 1. New Features 1.a) TCP protocol support for KDC (AIX only) 1.b) "ticket_lifetime" configuration relation support in krb5.conf file 1.c) Post Run scripts for kinit and kdestroy commands 1.d) Support for encrypted LDAP bind password 1.e) Circular logging for IBM Network Authentication Service daemons 2. Bugs Fixed 2.a) KDC fails to start on WPAR (AIX only) 2.b) KDC hangs when LDAP server is down (AIX only) 2.c) Installation on Solaris wipes out native Kerberos libraries 2.d) kadmind does not start when "use_ldap_lookup=1" and LDAP server is down 2.e) Old DB2 versions on linux fails to run due to wrong library symlink name 3. Installation instructions for IBM Network Authentication Service 1.4.0.8 on AIX platform 4. Known Issues 1. New Features: ================ IBM Network Authentication Service 1.4.0.8 contains 5 new features as listed below. a) TCP protocol support for KDC (AIX only) b) "ticket_lifetime" configuration relation supported in krb5.conf file c) Post Run scripts for kinit and kdestroy commands. d) Support for encrypted LDAP Bind password. e) Circular logging for IBM Network Authentication Service daemons. 1.a) TCP protocol support for KDC (AIX only) -------------------------------------------- As of IBM Network Authentication Service 1.4.0.7, KDC daemon was listening for incoming requests only on UDP protocol family. With IBM Network Authentication Service 1.4.0.8 KDC has additional support for TCP protocol. Kerberos administrator has to explicitly specify the TCP port(s) in kdc.conf file using relation "kdc_tcp_ports" to enable KDC to listen on TCP protocol. All attributes/properties of "kdc_ports" applies to "kdc_tcp_ports". Administrator will need to restart the KDC to take effect of changed kdc.conf file. The "kdc_tcp_ports" entry can be part of "kdcdefaults" section and/or "realms" section of kdc.conf file as shown below. [kdcdefaults] kdc_tcp_ports = 88 kdc_ports = 88 [realms] NAS.IBM.COM = { ... ... kdc_tcp_ports = ... ... } 1.b) "ticket_lifetime" configuration relation supported in krb5.conf file ------------------------------------------------------------------------- With IBM Network Authentication Service 1.4.0.8, "ticket_lifetime" relation, which can be specified in krb5.conf file, is processed. This will help Kerberos administrators to specify a default ticket lifetime for all users/principals using that particular machine. For example using this relation machine 'A' in a realm can be set to get tickets with lifetime of 8 hrs, whereas machine 'B' in the same realm can be set to get tickets for the same users with lifetime of 14hrs. This relation needs to be specified under the [libdefaults] section of krb5.conf file as shown below. e.g. [libdefaults] ticket_lifetime = 2h Note: While specifying the value of ticket_lifetime in /etc/krb5/krb5.conf specify the time units (d-days, h-hours, m-minutes and s-seconds) with ticket_lifetime value. 1.c) Post Run scripts for kinit and kdestroy commands ----------------------------------------------------- This feature allows administrators to notify the successful execution of kinit and kdestroy commands to other dependent kerberized applications. It facilitates the administrator to execute the desired post kinit and post kdestroy commands. This feature will typically be used when administrators or other kerberized products want to get notified of change in the state of Kerberos credentials when exercised using the kinit and kdestroy command shipped with IBM Network Authentication Service 1.4.0.8 release. Two new file called post_kinit_script.sh and post_kdestroy_script.sh will be created under /etc/krb5 directory either after configuration or in case of upgradation where IBM Network Authentication Service is already configured. These files can be edited to include commands or programs that the administrator wants to execute after successful execution of kinit and kdestroy command. These post script files will be executed only when kinit and kdestroy operations were successful and will not be executed if these commands encountered any errors. 1.d) Support for encrypted LDAP Bind password --------------------------------------------- IBM Network Authentication Service servers for AIX can be configured to use the LDAP directory plug-in to make use of LDAP to store authentication related data. In such setups the /var/krb5/krb5kdc/.kdc_ldap_data file contains information which the KDC and administration servers use to determine the location of an LDAP server, to bind to an LDAP server, and to obtain the list of the LDAP options that Network Authentication Service supports. Detail information of such a setup is mentioned in IBM Network Authentication Service 1.4 Administrator's and User's Guide. Prior to IBM Network Authentication Service 1.4.0.8 the LDAP bind password stored in the /var/krb5/krb5kdc/.kdc_ldap_data configuration file was unencrypted. From IBM Network Authentication Service 1.4.0.8 onwards when a fresh KDC is configured to use the LDAP directory plug-in using config.krb5 command, the LDAP bind password will be automatically encrypted and stored in /var/krb5/krb5kdc/.kdc_ldap_data file. In addition, the ksetup utility has been enhanced with a "-c" option that allows administrators to generate encrypted strings for LDAP bind passwords which can be used for existing setup. Usage: ksetup -c On success it will output the encrypted string to the standard output. eg: # ksetup -c "Password of Ldap Bind" {DES}202FEBC2 875 C4F69F2B8F8935A76B28678241B6C904AC87BD7278BC0F1D456 Purpose of the new command: I. If the administrators chooses to configure KDC with more than one LDAP then they will need to use the "ksetup -c " command over the LDAP bind password to get the encrypted string. The administrator will have to manually change the bind password stored in the /var/krb5/krb5kdc/.kdc_ldap_data file by the encrypted string. II. For already configured IBM Network Authentication Service server for AIX using the LDAP directory plug-in the administrators need to manually replace the bind password by the corresponding encrypted string after upgrading to IBM Network Authentication Service 1.4.0.8. They should use "ksetup -c " command to obtain the corresponding encrypted format for the LDAP bind password. Sample Example: 1. Existing KDC setup shows the value for bind_dn_pw in /var/krb5/krb5kdc/.kdc_ldap_data file in unencrypted format: # cat /var/krb5/krb5kdc/.kdc_ldap_data .. bind_dn_pw = passw0rd .. 2. Upgrade the server to IBM Network Authentication Service 1.4.0.8. 3. On the server, run "ksetup -c " command to get the encrypted string corresponding to the bind password. #ksetup -c "passw0rd" {DES}E8978A7B58 5684AB4D1 555854BD784AA B 75B2EE1D6B6 4. Replace the bind password in /var/krb5/krb5kdc/.kdc_ldap_data file with the encrypted string obtained above. # cat /var/krb5/krb5kdc/.kdc_ldap_data ... bind_dn_pw = "{DES}E8978A7B58 5684AB4D1 555854BD784AA B 75B2EE1D6B6" ... 5. Restart the IBM Network Authentication Service 1.4.0.8 daemons. 1.e) Circular logging for IBM Network Authentication Service daemons -------------------------------------------------------------------- The IBM Network Authentication Service server daemons (krb5kdc and kdamind ) stores their logs in folder "/var/krb5/log" by default. At times, on a busy KDC, these logs may grow in size to an extent that it can fill the entire /var file system which is not desirable. The circular logging support solves this issue and after a user-specified thresh-hold value, it flushes the log files and uses them again. The feature also facilitates the administrator to preserve specific number of old log files. The threshold value and the number of old log files to be preserved can be specified /etc/krb5/krb5.conf file. New relations in krb5.conf file: The krb5.conf file now supports two new relations in the [logging] section as below. 1. max_log_size = N Here user can specify the max. log file size, where 'N' will be in the units of mega byte (MB). This max. log file size value will govern the limit at which the circular logging will be triggered. This value governs size of all log files (krb5kdc.log, kadmin.log, krb5lib.log). Valid Range: 1 to 4095. Default value is 10. 2. keep_old_logs = X Here user can specify whether to store the old logfiles or not. If this value is ZERO, then IBM Network Authentication Service will not create any old logfile and will overwrite the normal logfile each time the max_log_size limits is reached. Valid Range: 0 to 5. Default value is 1. One has to add these relations in /etc/krb5/krb5.conf file to over ride the default values. IBM NAS daemons (KDC & kadmind) needs to be restarted to take effect of changes made in krb5.conf file. Additional log files: 1. Initial log files From IBM Network Authentication Service 1.4.0.8 onwards the server daemons (krb5kdc & kadmind) will create a new log file to store the important initial log messages on every startup. These initial log files will be stored as 'krb5kdc.initial' and 'kadmind.initial' under "/var/krb5/log" directory. 2. Old log files There is a provision to keep the old log files for the future reference. This is controlled by the relation 'keep_old_logs' in krb5.conf. If its value is more than ZERO (say 'X'), then IBM Network Authentication Service will store upto 'X' old logfiles (each logfile of the size < =max_log_size) by the naming convention .old. , where will start from 1 to 'X'. The latest logs will be always saved in file .old.1. For example, if the 'keep_old_logs' is set to 2, then initially the normal log file 'krb5kdc.log' when reached to the max_log_size, will be saved as 'krb5kdc.log.old.1'. Next time, 'krb5kdc.log.old.1' will be saved as 'krb5kdc.log.old.2' and 'krb5kdc.log' will be saved as 'krb5kdc.log.old.1' successively. While saving the old log files, their timestamp will also be preserved, so that user can track sequence of log files. Note 1: If the default log file is used, where both the daemons are logging in the same logfile (/var/krb5/log/krb5lib.log by default), then only a single old log file will be preserved irrespective of the value of the relation 'keep_old_logs' in krb5.conf. Note 2: The kadmin.local / clobber / kdb5_util utilities will now use the default log file (krb5lib.log) to store the log messages, if any. 2. Bugs Fixed: ============== In IBM Network Authentication Service 1.4.0.8 following major bugs has been fixed. 2.a) KDC fails to start on WPAR (AIX only) ------------------------------------------ On IBM AIX Version 6.1 system, if WPAR is defined and running, then on global instance of the operating system, KDC fails to start, stating not able to bind to socket on the running WPAR instance. This problem is fixed, and now on global instance, KDC will throw a warning message about binding failure and will continue executing. 2.b) KDC hangs when LDAP server is down --------------------------------------- If IBM Network Authentication Service (1.4.0.4 to 1.4.0.7) is configured with LDAP as back-end (KDC data stored in LDAP), and if due to some reasons LDAP server is down then KDC hangs waiting for that LDAP server to come up. This prevents the KDC to fall back to the slave LDAP configured to handle such scenarios. With this fix, KDC will throw an error saying LDAP is down, OR if the slave LDAP server is specified in the configuration file, KDC will appropriately fall back to the slave LDAP to continue its working. 2.c) Installation of IBM NAS on Solaris wipes out native Kerberos libraries --------------------------------------------------------------------------- On Sun Solaris, if native Kerberos libraries are present, then installation of IBM Network Authentication Service 1.4, was over-writing existing Kerberos libraries. This problem is fixed in IBM Network Authentication Service 1.4.0.8. Now installation on Sun Solaris will prompt and ask whether the administrator wants to over-write existing Kerberos libraries. Depending on the answer further action will be taken. 2.d) kadmind does not start when "use_ldap_lookup=1" and LDAP server is down ---------------------------------------------------------------------------- If IBM Network Authentication Service is configured for KDC and administration server (kadmind) discovery via LDAP (the LDAP look-up feature) and if due to some reasons LDAP server is down, then kadmind fails to start. This problem is fixed and now the kadmind will start normally. 2.e) Old DB2 versions on linux fails to run due to wrong library symlink name ----------------------------------------------------------------------------- On linux, the old DB2 version (DB2 V8) which was linked to IBM Network Authentication Service release before 1.4.0.4, fails to run with IBM Network Authentication Service (1.4.0.4 to 1.4.0.7) due to change in the name of IBM Network Authentication Service library symlink. This problem is fixed. Now, any DB2 version will work seamlessly with IBM Network Authentication Service 1.4.0.8. 3. Installation instructions for IBM NAS 1.4.0.8 on AIX platform: ================================================================= A. Validating the downloaded image: Hash value of NAS_v1.4.0.8.tar.Z image file is 7cde8eca3ebff2e741ad4af0a5cfd691 Hash of the image file was calculated using MD5 algorithm with the following command on AIX Version 5.3 machine. $ csum -h MD5 NAS_v1.4.0.8.tar.Z 7cde8eca3ebff2e741ad4af0a5cfd691 NAS_v1.4.0.8.tar.Z B. Uncompress the downloaded file $ uncompress NAS_v1.4.0.8.tar.Z $ ls NAS_v1.4.0.8.tar C. Untar the tar file $ tar -xvf NAS_v1.4.0.8.tar D. Follow below installtion instructions Installation Steps: 1. Stop the IBM NAS server processes, krb5kdc and kadmind, if configured. 2. Install the images using smitty or command line interface. 3. Restart the server processes, if configured. For example if you already have gold installed : 1. Check if Network Authentication Service1.4 is already installed # lslpp -l | grep krb5 krb5.client.rte 1.4.0.0 COMMITTED Network Authentication Service krb5.client.samples 1.4.0.0 COMMITTED Network Authentication Service ... ... 2. stop.krb5 3. Install the Network Authentication Service1.4 images provided. e.g. smitty install -> install and update software -> update installed software to latest level 4. Check for the installed Network Authentication Service1.4 fix images. $ lslpp -l | grep krb5 krb5.client.rte 1.4.0.8 COMMITTED Network Authentication Service krb5.client.samples 1.4.0.8 COMMITTED Network Authentication Service ... ... 5. start.krb5 4. Known Issues: Using LDAP as backend for KDC data =================================================== It has been found that, if LDAP is used as a backend for KDC database, then migration from existing LDAP level (ITDS 5.2 or ITDS 6.0) to the next level corrupts the KDC database. As of now no workaorund or fix as available for this issue. So advised all customer who are using LDAP as a backend, do not migrate to the next LDAP level. This will result in corrupted data, which is not recoverable. For more information contact the support team.