From e1714fffa69f30aacf44ccd3be8bd60c3bc1e8c4 Mon Sep 17 00:00:00 2001 From: Russ Allbery Date: Sun, 17 May 2020 19:01:47 -0700 Subject: Add Heimdal CI testing Set up a Heimdal KDC and add Heimdal to the test matrix. Remove some unnecessary configuration from the MIT Kerberos CI configuration. Ensure the user programs are installed for whatever Kerberos we're using, which will enable more of the Perl test suite. --- ci/files/heimdal/heimdal-kdc | 9 +++++++++ ci/files/heimdal/kadmind.acl | 1 + ci/files/heimdal/kdc.conf | 22 ++++++++++++++++++++++ ci/files/heimdal/krb5.conf | 18 ++++++++++++++++++ ci/files/mit/kdc.conf | 7 ++----- ci/files/mit/krb5.conf | 1 - 6 files changed, 52 insertions(+), 6 deletions(-) create mode 100644 ci/files/heimdal/heimdal-kdc create mode 100644 ci/files/heimdal/kadmind.acl create mode 100644 ci/files/heimdal/kdc.conf create mode 100644 ci/files/heimdal/krb5.conf (limited to 'ci/files') diff --git a/ci/files/heimdal/heimdal-kdc b/ci/files/heimdal/heimdal-kdc new file mode 100644 index 0000000..d781463 --- /dev/null +++ b/ci/files/heimdal/heimdal-kdc @@ -0,0 +1,9 @@ +# Heimdal KDC init script setup. -*- sh -*- + +# KDC configuration. +KDC_ENABLED=yes +KDC_PARAMS='--config-file=/etc/heimdal-kdc/kdc.conf' + +# kpasswdd configuration. +KPASSWDD_ENABLED=yes +KPASSWDD_PARAMS='-r HEIMDAL.TEST' diff --git a/ci/files/heimdal/kadmind.acl b/ci/files/heimdal/kadmind.acl new file mode 100644 index 0000000..2f4a084 --- /dev/null +++ b/ci/files/heimdal/kadmind.acl @@ -0,0 +1 @@ +test/wallet@HEIMDAL.TEST all,get-keys wallet/*@HEIMDAL.TEST diff --git a/ci/files/heimdal/kdc.conf b/ci/files/heimdal/kdc.conf new file mode 100644 index 0000000..bd00dcd --- /dev/null +++ b/ci/files/heimdal/kdc.conf @@ -0,0 +1,22 @@ +# Heimdal KDC configuration. -*- conf -*- + +[kadmin] + default_keys = aes256-cts-hmac-sha1-96:pw-salt + +[kdc] + acl_file = /etc/heimdal-kdc/kadmind.acl + check-ticket-addresses = false + logging = SYSLOG:NOTICE + ports = 88 + +[libdefaults] + default_realm = HEIMDAL.TEST + dns_lookup_kdc = false + dns_lookup_realm = false + +[realms] + HEIMDAL.TEST.EYRIE.ORG = { + kdc = 127.0.0.1 + master_kdc = 127.0.0.1 + admin_server = 127.0.0.1 + } diff --git a/ci/files/heimdal/krb5.conf b/ci/files/heimdal/krb5.conf new file mode 100644 index 0000000..65dc71e --- /dev/null +++ b/ci/files/heimdal/krb5.conf @@ -0,0 +1,18 @@ +[libdefaults] + default_realm = HEIMDAL.TEST + dns_lookup_kdc = false + dns_lookup_realm = false + rdns = false + renew_lifetime = 7d + ticket_lifetime = 25h + +[realms] + HEIMDAL.TEST = { + kdc = 127.0.0.1 + master_kdc = 127.0.0.1 + admin_server = 127.0.0.1 + } + +[logging] + kdc = SYSLOG:NOTICE + default = SYSLOG:NOTICE diff --git a/ci/files/mit/kdc.conf b/ci/files/mit/kdc.conf index 7bf4e6a..09e6795 100644 --- a/ci/files/mit/kdc.conf +++ b/ci/files/mit/kdc.conf @@ -1,7 +1,6 @@ [kdcdefaults] - kdc_ports = 88 - kdc_tcp_ports = 88 - restrict_anonymous_to_tgt = true + kdc_ports = 88 + kdc_tcp_ports = 88 [realms] MIT.TEST = { @@ -14,6 +13,4 @@ master_key_type = aes256-cts supported_enctypes = aes256-cts:normal default_principal_flags = +preauth - pkinit_identity = FILE:/var/lib/krb5kdc/kdc.pem,/var/lib/krb5kdc/kdckey.pem - pkinit_anchors = FILE:/etc/krb5kdc/cacert.pem } diff --git a/ci/files/mit/krb5.conf b/ci/files/mit/krb5.conf index 9b0d5ab..37816a2 100644 --- a/ci/files/mit/krb5.conf +++ b/ci/files/mit/krb5.conf @@ -11,7 +11,6 @@ kdc = 127.0.0.1 master_kdc = 127.0.0.1 admin_server = 127.0.0.1 - pkinit_anchors = FILE:/etc/krb5kdc/cacert.pem } [logging] -- cgit v1.2.3