Organizing Kerberos-based infrastructure
SSO ( Single Sign-On ) is a good method for organizing enterprise-level IT infrastructure. It can reduce TCO ( Total cost of ownership ) of user management, allowing to create/modify/delete user accounts in one place without changing configurations of servers and client workstations. Let's consider Kerberos as a basis for SSO in an enterprise infrastructure in details: Log in to a workstation. Most UNIX-based OS provide authorization mechanism for logging into a workstation using Kerberos PAM modules. Windows OS-based workstations can login only to domain controller, and doesn't support standard Kerberos servers by default due to Kerberos extensions by Microsoft. But there is a bypass way - use Samba PDC with Kerberos and OpenLDAP integration ( Article in Russian , I'll translate and publish it in the blog after setting up such infrastructure on my servers). Servers. Firewall: NuFW (see corresponding article ). Email: postfix, sendmail. IM: openfire. Web: apache....