Some Advice about Secure Hosts

Kerberos V5 can protect your host from certain types of break-ins, but it is possible to install Kerberos V5 and still leave your host vulnerable to attack. Obviously an installation guide is not the place to try to include an exhaustive list of countermeasures for every possible attack, but it is worth noting some of the larger holes and how to close them.

As stated earlier in this section, MIT recommends that on a secure host, you disable the standard ftp, login, telnet, shell, and exec services in /etc/inetd.conf. We also recommend that secure hosts have an empty /etc/hosts.equiv file and that there not be a .rhosts file in root's home directory. You can grant Kerberos-authenticated root access to specific Kerberos principals by placing those principals in the file .k5login in root's home directory.

We recommend that backups of secure machines exclude the keytab file (/etc/krb5.keytab). If this is not possible, the backups should at least be done locally, rather than over a network, and the backup tapes should be physically secured.

Finally, the keytab file and any programs run by root, including the Kerberos V5 binaries, should be kept on local disk. The keytab file should be readable only by root.