The main config file for kerberos is /etc/krb5.conf  [On the Mac there is also a /opt/local/etc/krb5.conf. The contents of the two files are merged, with /etc/krb5.conf coming first. Check both to make sure that you don’t have contradictory values.]

[libdefaults]
default_realm = CS.RUTGERS.EDU
noaddresses = true
forwardable = true
renew_lifetime = 365d
default_ccache_name = /tmp/krb5cc_%{uid}

[realms]
CS.RUTGERS.EDU = {
kdc = https://services.cs.rutgers.edu/KdcProxy
http_anchors = FILE:/opt/local/etc/letsencrypt.pem
}

[libdefaults] 
  default_realm = CS.RUTGERS.EDU 
  noaddresses = true 
  forwardable = true 
  renew_lifetime = 365d 
  default_ccache_name = /tmp/krb5cc_%{uid} 
# following only for Macs in the office
  default_cc_name = /tmp/krb5cc_%{uid} 
[realms]
  CS.RUTGERS.EDU = {     
    kdc = krb1.cs.rutgers.edu:88     
    kdc = krb2.cs.rutgers.edu:88     
    kdc = krb4.cs.rutgers.edu:88 
}

Make sure the following lines are present and not commented in /etc/ssh/ssh_config.  (On the Mac, using Macports version of openssh +kerberos5, this will be in /opt/local/etc/ssh/ssh_config)  If the lines don’t exist, add them.

GSSAPIAuthentication yes
GSSAPIDelegateCredentials yes

Once this is set up you can use kerberos commands:

• • kinit netid
Sets up your Kerberos credentials. If your username at home is the same as your Rutgers netid, you can omit the netid
  • skinit netid
if you have 2FA enabled on your account. skinit is a special script you need to create. Here are the skinit scripts.

     

    [Linux Version]

    #!/bin/bash
    export PATH=/usr/bin:/bin
    ANONCC=/tmp/anoncc$
    curl -o $ANONCC https://services.cs.rutgers.edu/cgi-bin/anonticket.pl >/dev/null 2>&1
    trap 'kdestroy -c "$ANONCC"' 2
    kinit -T "$ANONCC" "$@"
    STAT=$?
    kdestroy -c "$ANONCC"
    exit $STAT

#!/bin/bash
export PATH=/opt/local/bin:/usr/bin:/bin
ANONCC=/tmp/anoncc$ 
curl -o $ANONCC https://services.cs.rutgers.edu/cgi-bin/anonticket.pl >/dev/null 2>&1
trap 'kdestroy -c "$ANONCC"' 2 
kinit -T "$ANONCC" "$@"
STAT=$?
kdestroy -c "$ANONCC"
exit $STAT

• • klist
Shows you your credentials. They will last for 24 hours. After that you need to do kinit again. Or you can do kinit -R before they expire to renew them for another day.
  • ssh hostname
should work without asking you for a password as long as the host is in the computer science department. Note to Mac users: You have to use the Macports version of both the Kerberos utilities and openssh +kerberos5.
  • If you asked staff to authorize you to mount directories for machine on CS Network, do the following command to tell MacOS  about our Kerberos domain. This only needs to be done once.

    sudo dscl . -create Config/NFSv4Domain RealName cs.rutgers.edu

    You can then mount the file systems you’re authorized for, e.g.

    sudo mount koko.lcsr.rutgers.edu:/vol/vol12/common/users /mnt