To configure a Data ONTAP 10.0 system to use a Kerberos realm, use the services kerberos-realm new command. When you create a Kerberos-realm configuration, you specify the name of the configuration, the Kerberos realm (which must already exist), the permitted clock skew, the encryption type, and details about the Kerberos Distribution Center (KDC) server used. Kerberos realms must be specified in upper case.
The following example creates a Kerberos-realm configuration that uses a Microsoft Active Directory server as the KDC server. The Kerberos configuration is named AUTH. The Kerberos realm is AUTH.EXAMPLE.COM. The Active Directory server is named ad-1 and its IP address is 10.10.8.14. The permitted clock skew is 300 seconds (the default). The IP address of the KDC server is 10.10.8.14, and its port number is 88 (the default). The encryption type is Data Encryption Standard (DES). The comment is "Microsoft Kerberos config".
node::>services kerberos-realm new -configname AUTH -realm AUTH.EXAMPLE.COM -adserver-name ad-1 -adserver-ip 10.10.8.14 -clock-skew 300 -kdc-ip 10.10.8.14 -kdc-port 88 -kdc-vendor Microsoft -encryption-type DES -comment "Microsoft Kerberos config"
The following example creates a Kerberos-realm configuration that uses a UNIX server as the KDC server. The Kerberos configuration is named SECURE. The Kerberos realm is SECURITY.EXAMPLE.COM. The permitted clock skew is 15 seconds. The IP address of the KDC server is 10.10.9.1, and its port number is 88. The KDC vendor is Other to indicate a UNIX vendor. The IP address of the administrative server is 10.10.9.1, and its port number is 749 (the default). The IP address of the password server is 10.10.9.1, and its port number is 464 (the default). The encryption type is DES. The comment is "UNIX Kerberos config".
node::>services kerberos-realm new -configname SECURE -realm SECURITY.EXAMPLE.COM. -clock-skew 15 -kdc-ip 10.10.9.1 -kdc-port 88 -kdc-vendor Other -adminserver-ip 10.10.9.1 -adminserver-port 749 -passwordserver-ip 10.10.9.1 -passwordserver-port 464 -encryption-type DES -comment "UNIX Kerberos config"
The services kerberos-realm show command displays the following information about Kerberos-realm configurations:
Configuration name
Kerberos realm name
Active Directory server name, if applicable
KDC vendor
KDC IP address
Other information is displayed in a detailed view and if other parameters are specified. See the reference page for the command for details.
The following example displays information about all Kerberos-realm configurations.
node::>services kerberos-realm showConfiguration Kerberos Active Directory KDC KDC Name Realm Server Vendor IP Address AUTH AUTH ad-1 Microsoft 10.10.8.14 SECURE SECURITY Other 10.10.9.1
To modify the attributes of a Kerberos-realm configuration, use the services kerberos-realm modify command. The following example modifies the Kerberos-realm configuration named SECURE to have a permitted clock skew of 180 seconds.
node::>services kerberos-realm modify -configname SECURE -clock-skew 180
The services kerberos-realm delete command deletes a Kerberos-realm configuration. The command does not delete the Kerberos realm itself, just its configuration with the Data ONTAP 10.0 system.
The following example deletes a Kerberos-realm configuration named AUTH.
node::>services kerberos-realm delete -configname AUTH