OSNews

Yes, indeed it does!

-Actually, Netatalk uses its own set of authentication plugins that work independently of the surrounding architecture.

Netatalk kan use Kerberos for authentication with just a singe requirement met: The Kerberos keytab (e.g. /etc/krb5.keytab) needs to contain a service principal key for use with Netatalk. This is usually called afpserver/yourserver.example.org@EXAMPLE.ORG .

Create this service principal key in the following manner:

$ kadmin.local: addprinc --randkey afpserver/yourserver.example.org

(you can omit the realm as it's implied by kadmin.local)

then:

$ kadmin.local: ktadd -k /etc/krb5.keytab afpserver/yourserver.example.org

to add the new key to the existing keytab.

Once you've created this from kadmin.local, you can go on to setup Netatalk to use the newly created key by creating a setup like this:

- -tcp -no ddp -uamlist uams_gss.so -k5service afpserver -k5keytab /etc/krb5.keytab -k5realm EXAMPLE.ORG -fqdn yourserver.example.org:548

Basically, this tells Netatalk to bind to all interfaces, use TCP protocol, use GSSAPI (Kerberos5) for authentication, using the newly created afpserver service principal key from the system's Kerberos keytab and present to others a service of the type afpserver, identifying itself as yourserver.example.org within the realm EXAMPLE.ORG running AFP on port 548

I hope this example helps!