Enabling Kerberos registration on WAPT server (ubuntu arm)

[b.ald]

Hello,

I just updated my server on Oracle Cloud (Ubuntu 24.04 arm64 to version 2.6.1.17834) and at the same time, I wanted to set up the prerequisites to enable Kerberos registration before restarting the postconf.

My problem is that the "libnginx-mod-http-auth-spnego" package is apparently not available in the official Ubuntu repositories nor in the WAPT repository (https://wapt.tranquil.it/Ubuntu/wapt-2.6/).
I browsed "https://wapt.tranquil.it/Ubuntu" a bit but I only found packages for Arch amd64 and, if I remember correctly, for Nginx 1.18 (but it's version 1.24 that is distributed by the official Ubuntu repositories). There are indeed arm64 versions of the package in "https://wapt.tranquil.it/Debian" but only up to nginx 1.18 there as well.

Am I therefore "stuck" and is Kerberos registration not possible for an amr64 server under Ubuntu 24.04 (nginx 1.24)? Or is there a package available for amr64 architecture (perhaps a third-party repository I'm unaware of)? Or some other workaround?

Regards,
Bastien

[sfonteneau]

Hello,

I just added it for Ubuntu 24 (for Ubuntu 26 it's already in the Ubuntu repositories themselves).

Simon

[b.ald]

Hello Simon,

Thank you for adding the package! I read somewhere on the forum I think that the package was available at Tranquil IT but not yet on the production repo. But I wasn't sure anymore...
I'd found out that the package was indeed available on the official repositories for Ubuntu 26, but Oracle only offers images up to 24.04 for now (and in the free tier, you can't upload a custom image...).

I didn't remember that the postconf required several pieces of information to generate a keytab when the council servers were set up...
Since I haven't yet set up the cd on my end (which won't be writable anyway), to enable Kerberos registration and avoid being blocked during the postconf execution, I simply created a blank keytab manually, which allowed me to bypass it and complete the postconf execution without an error message.
It seems to be working. When registering a new machine, I correctly fall back to the authenticated login/password, and the machine registers properly. I'll replace the keytab file afterward, once the domain controller is in place.

Thanks again, Simon!

Best regards,
Bastien

[dcardon]

Hi Bastien,

regarding Kerberos authentication, it's important to know that the Active Directory doesn't need to be visible to the WAPT server. The WAPT client simply needs to be able to communicate with the AD. So, if you have an internal AD, you can create a keytab and place it on your WAPT server.

A little tip: in the latest versions of OpenRSAT, you can create a keytab directly from the Active Directory User and Computer interface.

Best regards,

Denis

[b.ald]

Hi Denis,

So, I haven't set up the Samba domain controller on my end yet, but yes, that's what I was planning to do:
- create a machine account for the WAPT server (with its hostname)
- associate an SPN with it (HTTP/fqdn_wapt@DOMAIN.AD)from a Windows machine using the `spn` command
- then generate the keytab file with ktpass
- and then export the file to the WAPT server to set it up.

I haven't had much time to look into OpenRSAT yet, but yes, it might be a good opportunity to try generating the keytab with it.

We actually had a brief phone conversation about the migration/centralization of the CD82 schools regarding the concatenation of the keytabs (18 in total) with msktutil, which took a very long time for the last few schools during the WAPT implementation.
I finally identified the cause of the "problem," and indeed, concatenating the 19 keytabs (there's an extra domain) now only takes a few seconds.

Regards,
Bastien