# $Header: /global/src/etc/cl-manage-scripts/patches/RCS/F-nonfs,v 1.25 2025/03/21 15:19:26 mas90 Exp $
# No NFS (so no Lab MUAs), but does have krb5 (LDAP etc should be in F-nokrb5)
@F-nokrb5

# allow GSSAPIAuthentication
P-sshd_config-GSSAPIAuthentication

# default_realm = EXAMPLE.COM -> AD.CL.CAM.AC.UK
P-krb5.conf

#  default_realm = CL.CAM.AC.UK -> AD.CL.CAM.AC.UK
P-krb5.conf-ubuntu

#  default_realm = ATHENA.MIT.EDU -> AD.CL.CAM.AC.UK
P-krb5.conf-rawU8.10

# Ensure that there is a ".cl.cam.ac.uk = AD.CL.CAM.AC.UK"
P-krb5.conf-domain_realm
P-krb5.conf-domain_realm-2

# Set ticket_lifetime to a year, effectively letting the AD set it
P-krb5.conf-ticket_lifetime-1y

# In [libdefaults] Remove: allow_weak_crypto = true
P-krb5.conf-allow_weak_crypto

# next 2 Remove: default_tkt_enctypes = DES-CBC-CRC
P-krb5.conf-COS-kdc
P-krb5.conf-COS-kdc-1

# Convert -  kdc|admin_server = *.ad.cl.cam.ac.uk to use kdc.cl.cam.ac.uk
P-krb5.conf-COS-kdc-2
P-krb5.conf-U-kdc-0

# Add: AD.CL.CAM.AC.UK{kdc=kdc.cl.cam.ac.uk;admin_server=kdc.cl.cam.ac.uk}
P-krb5.conf-add-kdc

# Ubuntu
#  change: ad.cl.cam.ac.uk = AD.CL.CAM.AC.UK to .cl.cam.ac.uk = AD.CL.CAM.AC.UK
# P-krb5.conf-ubuntu-realm-AD

# P-pam-common-auth-ubuntu
# P-pam-common-account-login
# P-pam-common-password
# P-pam-gdm-login
# P-pam-login-login
# Needed? P-pam-sshd-login
