What steps are involved in joining a Mac OS X Server to an existing Open Directory master?
2.
Why are the keytab files sensitive?
3.
Describe identification strategies that can be pursued in the context of kerberized authentication.
Answers
1.
First create a computer record on the master, and then join the server to the Open Directory master.
2.
The keytabs contain the secret shared between the KDC and the kerberized service. It is the basis of their cryptographic trust. A keytab file in the hands of a malicious user could compromise the security of your service.
3.
An integrated user directory, such as Open Directory or Active Directory. A separate user directory that matches the Kerberos user principals. The separate user directory can still be a network directory, or a user in a local database.
