Cisco WS-C2950SX-48-SI Configuration Manual page 479

Chapter 30 Configuring Switch Access Using AAA
This example shows how to retrieve an SRVTAB file from the KDC, enter an SRVTAB directly into the
switch, and verify the configuration:
Console> (enable) set kerberos srvtab remote 187.20.32.10 /users/jdoe/krb5/ninerskeytab
Console> (enable)
Console> (enable) set kerberos srvtab entry host/niners.cisco.com@CISCO.COM 0 932423923 1
1 8 03;;5>00>50;0=0=0
Kerberos SRVTAB entry set to
Principal:host/niners.cisco.com@CISCO.COM
Principal Type:0
Timestamp:932423923
Key version number:1
Key type:1
Key length:8
Encrypted key tab:03;;5>00>50;0=0=0
Console> (enable) show kerberos
Kerberos Local Realm:CISCO.COM
Kerberos server entries:
Realm:CISCO.COM,
Realm:CISCO.COM,
Kerberos Domain<->Realm entries:
Domain:cisco.com,
Kerberos Clients NOT Mandatory
Kerberos Credentials Forwarding Enabled
Kerberos Pre Authentication Method set to None
Kerberos config key:
Kerberos SRVTAB Entries
Srvtab Entry 1:host/niners.cisco.com@CISCO.COM 0 932423923 1 1 8 03;;5>00>50;0=0=0
Srvtab Entry 2:host/niners.cisco.edu@CISCO.EDU 0 933974942 1 1 8 00?58:127:223=:;9
Console> (enable)
Deleting an SRVTAB Entry
To delete an SRVTAB entry, perform this task in privileged mode:
Task
Delete the SRVTAB entry for a particular
Kerberos principal.
This example shows how to delete an SRVTAB entry:
Console> (enable) clear kerberos srvtab entry host/niners.cisco.com@CISCO.COM 0
Console> (enable)
Enabling Credentials Forwarding
A user authenticated to a Kerberized switch has a TGT and can use it to authenticate to a host on the
network. However, if forwarding is not enabled and a user tries to list credentials after authenticating to
a host, the output will show that no Kerberos credentials are present.
To enable credentials forwarding, configure the switch to forward user TGTs when they authenticate
from the switch to Kerberized remote hosts on the network using Kerberized Telnet.
78-15486-01
Server:187.0.2.1,
Server:187.20.2.1,
Realm:CISCO.COM
Catalyst 4500 Series, Catalyst 2948G, Catalyst 2980G Switches Software Configuration Guide
Port:750
Port:750
Command
clear kerberos srvtab entry kerberos-principal
principal-type
Configuring Authentication
—
Release 8.1
30-35