Configuration Overview¶

This section provides comprehensive documentation on configuring ZeroTrustKerberosLink for your environment, with a focus on security best practices and integration with existing infrastructure.

Configuration Structure¶

ZeroTrustKerberosLink uses a YAML-based configuration file structure:

# Example configuration structure
server:
  # Server configuration

kerberos:
  # Kerberos configuration

aws:
  # AWS configuration

security:
  # Security configuration

logging:
  # Logging configuration

monitoring:
  # Monitoring configuration

Configuration Methods¶

ZeroTrustKerberosLink supports multiple configuration methods:

Configuration File¶

The primary configuration method is a YAML file:

zerotrustkerberos --config /etc/zerotrustkerberos/config.yaml

Environment Variables¶

Configuration can be overridden with environment variables:

ZEROTRUSTKERBEROS_SERVER_PORT=8443 zerotrustkerberos

Command-Line Arguments¶

Configuration can also be specified via command-line arguments:

zerotrustkerberos --server.port=8443 --kerberos.realm=EXAMPLE.COM

Key Configuration Sections¶

Authentication Configuration¶

Authentication configuration controls how users are authenticated:

Authentication Configuration

Session Management¶

Session management configuration controls how user sessions are handled:

Session Configuration

Caching Configuration¶

Caching configuration controls how data is cached for performance:

Caching Configuration

Audit Logging¶

Audit logging configuration controls how security events are logged:

Audit Logging Configuration

Security Considerations¶

When configuring ZeroTrustKerberosLink, follow these security best practices:

Secure Configuration Storage

Store configuration files securely with appropriate file permissions (0600) and restrict access to the service account only.

Sensitive Data Handling

Use environment variables or secure storage for sensitive configuration values like passwords and keys.

Configuration Validation

Validate configuration before deployment to ensure security settings are properly applied.

Configuration Auditing

Implement configuration auditing to track changes to security-relevant settings.

Least Privilege

Configure services with the minimum permissions necessary for operation.

Configuration Validation¶

ZeroTrustKerberosLink provides tools to validate configuration:

# Validate configuration file
zerotrustkerberos validate-config --config /etc/zerotrustkerberos/config.yaml

# Check configuration security
zerotrustkerberos security check-config --config /etc/zerotrustkerberos/config.yaml

Configuration Examples¶

Basic Configuration¶

server:
  host: "0.0.0.0"
  port: 8443
  tls:
    enabled: true
    cert_file: "/etc/zerotrustkerberos/certs/server.pem"
    key_file: "/etc/zerotrustkerberos/certs/server-key.pem"

kerberos:
  enabled: true
  service_principal: "HTTP/zerotrustkerberos.example.com@EXAMPLE.COM"
  keytab_file: "/etc/zerotrustkerberos/keytab/service.keytab"
  realm: "EXAMPLE.COM"

aws:
  region: "us-west-2"
  role_mappings:
    - kerberos_principal: "user@EXAMPLE.COM"
      aws_role: "arn:aws:iam::123456789012:role/UserRole"

Production Configuration¶

server:
  host: "0.0.0.0"
  port: 8443
  tls:
    enabled: true
    cert_file: "/etc/zerotrustkerberos/certs/server.pem"
    key_file: "/etc/zerotrustkerberos/certs/server-key.pem"
    ca_file: "/etc/zerotrustkerberos/certs/ca.pem"
    min_version: "TLS1.2"

kerberos:
  enabled: true
  service_principal: "HTTP/zerotrustkerberos.example.com@EXAMPLE.COM"
  keytab_file: "/etc/zerotrustkerberos/keytab/service.keytab"
  realm: "EXAMPLE.COM"
  encryption_types:
    - "aes256-cts-hmac-sha1-96"

aws:
  region: "us-west-2"
  role_mappings:
    - kerberos_principal: "admin@EXAMPLE.COM"
      aws_role: "arn:aws:iam::123456789012:role/AdminRole"
      conditions:
        ip_ranges: ["10.0.0.0/8"]
        time_window: ["08:00-18:00"]

    - kerberos_principal: "developer@EXAMPLE.COM"
      aws_role: "arn:aws:iam::123456789012:role/DeveloperRole"

security:
  headers:
    enabled: true
    content_security_policy: "default-src 'self'"
  rate_limiting:
    enabled: true
    default_limit: 60

logging:
  level: "info"
  format: "json"
  output:
    - type: "file"
      path: "/var/log/zerotrustkerberos/server.log"
    - type: "syslog"
      facility: "local6"

audit:
  enabled: true
  format: "json"
  output:
    - type: "file"
      path: "/var/log/zerotrustkerberos/audit.log"