Planning Kerberos Realms
A realm is logical network, similar to a domain, that defines a group
of systems that are under the same master KDC. As with establishing a
DNS domain name, issues such as the realm name, the number and size
of each realm, and the relationship of a realm to other realms
for cross-realm authentication should be resolved before you configure the Kerberos service.
Realm Names
Realm names can consist of any ASCII string. Usually, the realm name is
the same as your DNS domain name, except that the realm name
is in uppercase. This convention helps differentiate problems with the Kerberos service from problems
with the DNS namespace, while using a name that is familiar. If
you do not use DNS or you choose to use a different string,
then you can use any string. However, the configuration process requires more work.
The use of realm names that follow the standard Internet naming structure is
wise.
Number of Realms
The number of realms that your installation requires depends on several factors:
The number of clients to be supported. Too many clients in one realm makes administration more difficult and eventually requires that you split the realm. The primary factors that determine the number of clients that can be supported are as follows:
Because each installation will have different limitations, no rule exists for determining the maximum number of clients.
How far apart the clients are. Setting up several small realms might make sense if the clients are in different geographic regions.
The number of hosts that are available to be installed as KDCs. Each realm should have at least two KDC servers, one master server and one slave server.
Alignment of Kerberos realms with administrative domains is recommended. Note that a
Kerberos V realm can span multiple sub-domains of the DNS domain to which
the realm corresponds.
Realm Hierarchy
When you are configuring multiple realms for cross-realm authentication, you need to decide
how to tie the realms together. You can establish a hierarchical relationship among
the realms, which provides automatic paths to the related domains. Of course, all
realms in the hierarchical chain must be configured properly. The automatic paths can
ease the administration burden. However, if there are many levels of domains, you
might not want to use the default path because it requires too many
transactions.
You can also choose to establish the trust relationship directly. A direct trust
relationship is most useful when too many levels exist between two hierarchical realms
or when no hierarchal relationship exists. The connection must be defined in the
/etc/krb5/krb5.conf file on all hosts that use the connection. So, some additional work
is required. The direct trust relationship is also referred to as a transitive
relationship. For an introduction, see Kerberos Realms. For the configuration procedures for multiple realms, see
Configuring Cross-Realm Authentication.
