Kerberos on Mac OS X 10.2 & 10.3 Frequently Asked Questions
Keywords: Kerberos, v4, v5, KClient, GSS, GSSAPI, Macintosh, Mac OS, Mac OS X, Jaguar, Panther, tickets, authentication, Kerberos application, Kerberos Library, Support Library, Kerberos Menu, MIT, Kerberos for Macintosh, KfM, security, FAQ, Eudora, CFM, authenticator, NAT

| # Macintosh Development

[Home] [About Us] [People] [MIT Support Library] [MIT Kerberos for Macintosh]
[Applications] [Mac OS X] [Miscellaneous Documentation] [Information Systems]

| Kerberos on Mac OS X 10.2 & 10.3 Frequently Asked Questions

> The following is a list of frequently asked questions about Kerberos on Mac OS X. This information is intended to assist users, support staff and developers who use Kerberos on the Macintosh.

> This web page deals with FAQs for Kerberos on Mac OS X 10.2 and 10.3.

> Please see the Kerberos for Macintosh on Mac OS X 10.1 FAQs page for Mac OS X 10.1 questions.

> Please see the Kerberos for Macintosh on Mac OS 8 & 9 FAQs page for Mac OS 8.x and 9.x questions.

> If you would like to suggest an addition to the FAQ, please send mail to krbdev@mit.edu

> Q: Who should I contact with questions about Kerberos on Mac OS X?
> A: Generally, you should contact Apple Computer for support with Kerberos on Mac OS X if your question is not answered here. See the Kerberos for Macintosh Support & Contact Info page for further information.

> Q: What version of Kerberos should I use with Mac OS X?
> A: Use the Kerberos for Macintosh that ships with the OS. This is the latest version - equivalent to KfM 5.0 in Mac OS X 10.3, and to KfM 4.5 in Mac OS X 10.2. If you need Kerberos CFM support, download the Mac OS X Kerberos Extras.

> Q: What parts of Kerberos are/are not included with Mac OS X?
> A: The Kerberos included with Mac OS X 10.2 and later includes the Kerberos framework, command line tools, the GUI Kerberos management application (although it's hidden away in `/System/Library/CoreServices` ), a Kerberos login authenticator, and support for Kerberos in various applications. The CFM support libraries are not included, but can be obtained by installing the Mac OS X Kerberos Extras, which will also put an alias to the Kerberos application in a more convenient location.

> No Kerberos configuration information is included with Mac OS X (and only a sample configuration file is included with the Kerberos Extras), you must install a configuration for your site if your site does not have Kerberos auto-configuration/DNS setup (see below for more info).

> Q: How do I configure Kerberos on Mac OS X for my site?
> A: If your site does not have a Kerberos auto-configuration/DNS configuration (and in some cases, even if it does), you must copy or create a file called `edu.mit.Kerberos` in your `/Library/Preferences` directory. Your site may have a localized Kerberos installer that provides this configuration file, you should consult with your system administrator(s) before attempting to create your own. The Kerberos configuration information (equivalent to the `krb5.conf` on other platforms) should be in the data fork of this file. We strongly recommend you read the Kerberos Preferences documentation for more information.

> Q: Eudora, Fetch, and other CFM-based applications won't work with the Mac OS X Kerberos. What's wrong?
> A: Mac OS X Kerberos as shipped does not include CFM support. To use the Mac OS X Kerberos with Eudora, Fetch, and other existing CFM-based GUI applications, you should install either the Mac OS X Kerberos Extras.
> If you have just upgraded from an older Mac OS X to a newer version (such as from Mac OS X 10.1 to 10.2, or 10.2 to 10.3), you must install the latest Mac OS X Kerberos Extras even if you had Eudora and/or Fetch working previously.

> Q: I installed the Mac OS X Kerberos Extras and now Eudora 5.1 won't work at all. What's up?
> A: There is an issue with one of the Eudora plug-ins in Eudora 5.1 that causes this. The best way to fix this is to upgrade to Eudora 5.2 or later.
> If you cannot upgrade to Eudora 5.2 or later, do the following to fix this: in the Finder, bring up the Finder contextual menu by control-clicking on the Eudora application icon and select "Show Package Contents". When the window pops up with the Contents folders in it, navigate to the Eudora Stuff folder:

> > `Contents -> MacOS -> Eudora Stuff`

> and remove the `UPPERlower Carbon` plug-in (drag it to the desktop or some other storage place). Close up the Eudora contents window and try again, Eudora should now work. Removing this plug-in removes the ability to change the selected text to all lowercase, all uppercase, etc. from the Edit menu in Eudora. This bug will be fixed in a future release of Eudora.

> Q: Where is the Kerberos GUI management application?
> A: Mac OS X 10.2 and later do actually include the Kerberos management application, it's in `/System/Library/CoreServices` . You can either make an alias in a more convenient location, or use the Mac OS X Kerberos Extras which will make an alias to it in `/Applications/Utilities` .

> Q: Is a Kerberized telnet and/or SSH client available for Mac OS X?
> A: The Telnet that ships with Mac OS X 10.2 and later has Kerberos support. The SSH that ships with Mac OS X 10.3 and later has Kerberos support (we know of no Kerberized SSH solutions for Mac OS X 10.2).

> Q: Is there a Kerberized ftp client available for Mac OS X?
> A: Yes, Fetch from FetchSoftworks supports both GSS and KClient (v4) connections on Mac OS X when the CFM support libraries are installed. This is the only Kerberized ftp client we are aware of at this time.

> Q: Does Kerberos for Macintosh work with Windows Active Directory?
> A: Yes, KfM will successfully authenticate against Windows Active Directory acting as a KDC.

> Q: I don't see the realm I need in the Kerberos Login dialog. How do I add new realms?
> A: If the desired realm is not present in the Realms popup list, you can try typing it into the Realm field. However, this will only work if you have a Kerberos configuration file (edu.mit.Kerberos) that already includes the realm, or your site is set up for auto-configuration/DNS resolution of Kerberos realms. If typing it in directly does not work, try the Edit Favorite Realms dialog in the Kerberos management application. If it's not there, see the next question.

> Q: I don't see the realm I need in the Edit Favorite Realms dialog in Kerberos management application. How do I add new realms?
> A: Your site may be configured for auto-configuration (DNS resolution of Kerberos realms. If this is the case, you can just type your realm into the "Add realm that has auto configuration" field of the Edit Favorite Realms dialog. If this does not work, you need to edit the `edu.mit.Kerberos` preferences file. See the Kerberos Preferences Documentation for information on how to do this. You should consult your site administrator or help desk before doing this.

> Q: Can I use Kerberos for Macintosh behind a NAT (Network Address Translation)?
> A: In some cases, yes. Kerberos 4 does not support addressless tickets, so no Kerberos 4 or KClient-using application can be made to work behind a NAT. However, Kerberos 5 can be told to use addressless tickets, which will allow Kerberos 5-using applications to work behind a NAT. However, applications that use the GSSAPI and require channel bindings, such as FTP, may still not work.
> Mac OS X 10.3 gets addressless tickets by default, although you can change this setting by setting the "Get tickets without IP addresses" checkbox in the Kerberos login dialog (click on the "Show Options" button to see this checkbox).
> In Mac OS X 10.2, can enable addressless tickets by adding the following line to the `libdefaults` section of the `edu.mit.Kerberos` file:

> > `noaddresses = true`

> There is no GUI way to enable this feature in Mac OS X 10.2.

> Q: Will there be a Kerberos system menu and floating window for Mac OS X?
> A: Kerberos for Macintosh for Mac OS X includes features similar to these. The dock icon of the Kerberos management application has a key that changes to show your ticket's status, can display the time remaining of the current active user's tickets, and has a pop-up menu for commonly used Kerberos functions.

> Q: Can I get a newer release of Kerberos for Mac OS X from MIT?
> A: No, any updates to Kerberos for Mac OS X will come from Apple.

> Q: How do I enable and use the Kerberos login authenticator in Mac OS X 10.2 and later?
> A: See Apple's web page, Mac OS X 10.2: How to Enable Kerberos Authentication for Login Window. Apple wrote the authenticator, and MIT does not provide documentation or support for it. Please send any questions to Apple - see the Kerberos for Macintosh Support & Contact Info page.

> Q: How can I uninstall/remove Kerberos for Macintosh?
> A: On Mac OS X 10.2 and later, since Kerberos is an integral part of the OS, you should not attempt to remove it.

> Q: Is source code for the Kerberos included with Mac OS X available?
> A: Yes, source code is available for review from the Apple Darwin Kerberos page.

> Q: Is source code for the Kerberos login authenticator available?
> A: Please contact Apple with this request. Since Apple wrote the authenticator, MIT does not have control over the source code.

> Kerberos for Macintosh on Mac OS X 10.1 FAQs
> Kerberos for Macintosh on Mac OS 8 & 9 FAQs

Questions or comments? Send mail to macdev@mit.edu
Last updated on $Date: 2003/09/29 20:25:27 $
Last modified by $Author: smcguire $