![]() |
![]() |
![]() |
Cockpit Guide | ![]() |
---|
To authenticate users, the server that Cockpit is running on must be
joined to a domain. This can usually be accomplished using the
realm join example.com
command.
The domain must be resolveable by DNS. For instance, the SRV records of the kerberos server should be resolveable:
$ host -t SRV _kerberos._udp.example.com _kerberos._udp.example.com has SRV record 0 100 88 dc.example.com
The server running Cockpit should have a fully qualified name that ends with the domain name.
There must be a valid Kerberos host key for the server in the /etc/krb5.keytab
file. It may be necessary to create a kerberos service principal and update the keytab if it
is not present. Depending on your domain type different service names are required:
Active Directory |
|
IPA and MIT |
|
The following command can be used to list the /etc/krb5.keytab
:
$ sudo klist -k
Lastly accounts from the domain must be resolveable to unix accounts on the server running Cockpit. For example:
$ getent passwd user@example.com user@example.com:*:381001109:381000513:User Name:/home/user:/bin/sh