Kerberos Module for Apache Introduction Mod_auth_kerb is an Apache module designed to provide Kerberos authentication to the Apache web server. Using the Basic Auth mechanism, it retrieves a username/password pair from the browser and checks them against a Kerberos server as set up by your particular organization. The module also supports the Negotiate authentication method, which performs full Kerberos authentication based on ticket exchanges, and does not require users to insert their passwords to the browser. In order to use the Negotiate method you need a browser supporting it (currently standard IE6.0 or Mozilla with the ). The module supports both kerberos4 and kerberos5 protocols for password verification. The Negotiate mechanism can be only used with Kerberos v5. The module supports both 1.x and 2.x versions of Apache.

If you are using the Basic Auth mechanism, the module does not do any special encryption of any sort. The passing of the username and password is done with the same Base64 encoding that Basic Auth uses. This can easily be converted to plain text. To counter this, I would suggest also using mod_ssl or Apache-SSL. The use of SSL encryption is also recommended if you are using the Negotiate method.

Windows BSD Linux. Zarubezhnie pevici s nizkim hriplim golosom. Mod_auth_kerb is a module that provides Kerberos user authentication to the Apache web server. It allows to retrieve the username/password pair, and also supports full Kerberos authentication (also known as Negotiate or SPNEGO based authentication). We will use ktpass from the Windows 2003 Support Kit to create a keytab file the linux server will need. Sudo apt-get install libapache2-mod-auth-kerb.

What is this? Mod_spnego enables the usage of Kerberos to authenticate users of a website running on the Apache HTTP Server (httpd) on Windows.

The authenticated user is then available in the server variable AUTH_USER. Installation Just copy the binary mod_spnego.so to the modules directory of the Apache installtion and add it to the modules list in httpd.conf: LoadModule spnego_module modules/mod _spnego.so To enable it on a site or directory, add the following directives to it: AuthName 'Windows Authentication' Require valid-user AuthType SPNEGO Krb5ServiceName HTTP Krb5RemoveDomain 1 You might need to install the Visual C++ Runtime Libraries if they're not already there. Binary download Is available at Parameters • Krb5ServiceName: the Kerberos service name(s), separated with a single whitespace • Krb5RemoveDomain: 0 to NOT strip the domain name from the user's login, any other number to strip it. • Krb5AuthEachReq: 0 for shared authentication, any other number to authenticate each request • Krb5AuthorizeFlag: checks if user matches list given in httpd.conf The last two are untested. Use at your own risk. Build The project was created using Visual Studio 2012 and you'll also need Apache 2.2 installed. The project assumes C: Program Files (x86) Apache Software Foundation Apache2.2 as the installation directory.

Limitations The version available here has some limitations compared to the original version: • Windows only • Apache 2.2 only (it does NOT work on 2.4!) Contrary to the original it works reliable under high load conditions, but no warranty whatsoever is made that it is fit for any purpose. Use it at your own risk!