1@c Id 2@c $NetBSD: misc.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $ 3 4@node Things in search for a better place, Kerberos 4 issues, Applications, Top 5@chapter Things in search for a better place 6 7@section Making things work on Ciscos 8 9Modern versions of Cisco IOS has some support for authenticating via 10Kerberos 5. This can be used both by having the router get a ticket when 11you login (boring), and by using Kerberos authenticated telnet to access 12your router (less boring). The following has been tested on IOS 1311.2(12), things might be different with other versions. Old versions 14are known to have bugs. 15 16To make this work, you will first have to configure your router to use 17Kerberos (this is explained in the documentation). A sample 18configuration looks like the following: 19 20@example 21aaa new-model 22aaa authentication login default krb5-telnet krb5 enable 23aaa authorization exec krb5-instance 24kerberos local-realm FOO.SE 25kerberos srvtab entry host/router.foo.se 0 891725446 4 1 8 012345678901234567 26kerberos server FOO.SE 10.0.0.1 27kerberos instance map admin 15 28@end example 29 30This tells you (among other things) that when logging in, the router 31should try to authenticate with kerberised telnet, and if that fails try 32to verify a plain text password via a Kerberos ticket exchange (as 33opposed to a local database, RADIUS or something similar), and if that 34fails try the local enable password. If you're not careful when you 35specify the `login default' authentication mechanism, you might not be 36able to login at all. The `instance map' and `authorization exec' lines 37says that people with `admin' instances should be given `enabled' shells 38when logging in. 39 40The numbers after the principal on the `srvtab' line are principal type, 41time stamp (in seconds since 1970), key version number (4), keytype (1 == 42des), key length (always 8 with des), and then the key. 43 44To make the Heimdal KDC produce tickets that the Cisco can decode you 45might have to turn on the @samp{encode_as_rep_as_tgs_rep} flag in the 46KDC. You will also have to specify that the router can't handle anything 47but @samp{des-cbc-crc}. This can be done with the @samp{del_enctype} 48command of @samp{kadmin}. 49 50This all fine and so, but unless you have an IOS version with encryption 51(available only in the U.S) it doesn't really solve any problems. Sure 52you don't have to send your password over the wire, but since the telnet 53connection isn't protected it's still possible for someone to steal your 54session. This won't be fixed until someone adds integrity to the telnet 55protocol. 56 57A working solution would be to hook up a machine with a real operating 58system to the console of the Cisco and then use it as a backwards 59terminal server. 60