| < volnuke | Russ Allbery > Software | krb5-strength > |
In fact, now that I come to think of it, you can't really get a leopard to appreciate the notion that it *has* spots. You can explain it carefully to the leopard, but it will just sit there looking at you, knowing that you are made of meat. After a while it will perhaps kill you.
— Geoffrey K. Pullum
kadmin-remctl provides a remctl backend that implements basic Kerberos account administration functions (create, delete, enable, disable, reset password, examine) plus user password changes and a call to strength-check a given password. It can also provide similar management of instances and creation, deletion, and management of accounts in Heimdal, MIT Kerberos, Active Directory, and an AFS kaserver where appropriate. Also included is a client for privileged users to use for password resets and a simple client for password changes via the Kerberos password change protocol (mostly useful with Active Directory).
At Stanford, we are currently running two Kerberos realms: an MIT Kerberos v5 realm and an Active Directory realm. We previously also had an AFS kaserver Kerberos v4 realm. We also have middleware and web applications that support changing or resetting passwords, creating new accounts, examining principals, and enabling or disabling accounts based on affiliation changes. Rather than give all of these systems kadmin access (and force them to use kadmin clients, which is difficult since many are written in Java), and rather than forcing them to do realm synchronization themselves, we export an interface via remctl and use the Java remctl client to talk to that interface.
The remctl backend was originally developed by Roland Schemers in conjunction with a locally-patched Kerberos v4 kadmin client. Booker Bense wrote the code to talk to a Kerberos v5 kadmin client via Expect. I've since substantially rewritten it to merge those features and add additional code to propagate instance creation to Active Directory. Jon Robertson ported the MIT Kerberos code to Heimdal using Heimdal::Kadm5.
The AFS kaserver support is frozen and no longer tested since Stanford no longer runs an AFS kaserver realm. It may be removed in a future release if the code is significantly restructured.
The kadmin backend is written in Perl and requires the Perl Expect module. For MIT kerberos, it calls the Kerberos v5 kadmin and kpasswd programs and therefore requires that they be available. For Heimdal, it still uses kpasswd but uses the Heimdal::Kadm5 Perl module for kadmin operations, which can be found on CPAN. For integration with the AFS kaserver Kerberos v4 realm, it can also use kasetkey (only available in old releases of wallet). The Kerberos v4 synchronization is disabled by default.
The kadmin backend can propagate instance creation and deletion to an Active Directory. To use this support, you will need the Perl Encode, MIME::Base64, and Text::Template modules. (Encode and MIME::Base64 come with Perl 5.8 and later.) You will also need k5start and the OpenLDAP binaries ldapadd, ldapdelete, and ldapmodify.
The passwd_change C client requires the C libremctl library be available to build (plus, obviously, a C compiler). It and ksetpass also requires a Kerberos library; either MIT Kerberos or Heimdal should be sufficiant (although currently the client will produce much better error messages using MIT Kerberos).
Finally, the backend is intended to be run under remctld and use remctl to handle authentication, privacy, and integrity.
To bootstrap from a Git checkout, or if you change the Automake files and need to regenerate Makefile.in, you will need Automake 1.11 or later. For bootstrap or if you change configure.ac or any of the m4 files it includes and need to regenerate configure or config.h.in, you will need Autoconf 2.64 or later. Perl is also required to generate the manual pages from a fresh Git checkout.
The distribution:
| kadmin-remctl 3.2 | 2011-06-09 | Download | PGP signature |
An archive of older releases is also available.
A Debian package is available from my personal repository.
kadmin-remctl is maintained using the Git version control system. To check out the current development tree, clone:
git://git.eyrie.org/kerberos/kadmin-remctl.git
You can also browse the current development source.
User documentation:
Developer documentation:
The kadmin-remctl package as a whole is released under the following license:
Copyright 1997, 2003, 2007, 2008, 2009, 2010, 2011 The Board of Trustees of the Leland Stanford Junior University.
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
Some individual source files are covered by other, compatible licenses. For complete copyright and license information, see the file LICENSE in the kadmin-remctl source distribution.
| < volnuke | Russ Allbery > Software | krb5-strength > |