1

I have Linux servers which are members of AD domain, running SSSD demon. SSSD is "Kerberized" and I also do want use Kerberos for Oracle db authentication.

NOTE: this is not purely about Oracle database. This can be applied to any situation where there are two or more Kerberized services running on the same server.

I've come to two possible patterns for configuration.

Linux and Oracle share the same keytab file.

This setup is relatively easy, while joining AD domain I specify additional service name "oracle" and my keytab file will contain SPNs for both Linux server and Oracle database.

host/hostname@DOMAN
oracle/hostname@DOMAIN
...

pros:

  • relatively simple setup
  • easy for automation
  • sssd is able to rotate encryption keys(KNVO number)
  • possibly sssd also provides a plugin for AD site ID, so the closest Kerberos server will be used
  • databases SPN+encryption keys are associated with Computer object in AD.

cons:

  • same keytab file is to be used by Linux and Oracle admins, by default this keytab file is accessible only to "root".

Oracle database has its own keytab

This setup is more complex

  • Additional non-personal account is to be created in AD for each database
  • Databases SPN is associated with this NPA account
  • Keytab is created+exported from Windows server onto Linux machine

pros:

  • role separation between Linux and Oracle admins

cons:

  • hard to automate process, some steps have to be executed on Windows server
  • creation of NPA account, creation of SPN requires excessive privileges in AD
  • KNVO stays the same, encryption keys are not rotated
  • decom process has to destroy both Computer object and NPA form AD

From various HOWTOs I saw on Internet, it seems that 2nd approach is mostly used.

Is there any reason for this? Is there something I am missing? Something that makes this 2nd approach more advisable?

1
  • 1
    If you don't get some help here. the FreeIPA mailing list or IRC may be a good place to start.
    – cutrightjm
    Commented Nov 3, 2023 at 22:15

1 Answer 1

1

I was googling the exact same question and found your post. You have formulated the question so well so I was so bold and copied the entire question and posted it on both Oracle and Red Hat support community site.

On Oracle Support Community I got today an answer from a Senior Principal Product Manager.

"I think your assessment of the pros and cons is great and very accurate.

I would say that the second is more-commonly used because separating the database keytab file from the OS means the DBA team can manage that keytab file and it "isolates" the DB from changes to the OS' keytab file.

A lot of our customers have been asking for Kerberos authentication with Exadata but it still appears that we are maintaining different keytab files. We may not need to though, let me ask internally about this note:

How to configure Kerberos / SSSD in Exadata compute nodes and cells (Doc ID 2948255.1)"

I must say that I was hoping a little bit that someone would say that it is a very good idea to use host-keytab. Because it would make our life so much easier.

4
  • There is one more topic I excluded from mine question. Microsoft extended Kerberos the way that client can lookup kdc server via special DNS lookup query. This was implemented in MIT Kerberos, even Java JDK Kerberos somehow implements this. Then MS extended this principle even more with SITE ID. Special format DNS query will return only those kdc server switch are closest to your subnet (excluding AD server in other locations inaccessible to you). Neither MIT nor Java support this mechanism. RedHat's SSSD provides a plugin for MIT Kerberos.
    – ibre5041
    Commented Jan 4 at 11:52
  • This plugin instructs your MIT Kerb client lib to talk to "closest" kdc server only. In large corporate environments it is a must. Without site id plugin DNS lookups return randomly chosen kdc servers, some of them are accessible some of them are not and the whole thing is totally unpredictable.
    – ibre5041
    Commented Jan 4 at 11:55
  • 3
    Please provide the link to the discussion on the Oracle Support Community
    – schroeder
    Commented Jan 4 at 12:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .