Kerberos V5 can protect your host from certain types of break-ins, but it is possible to install Kerberos V5 and still leave your host vulnerable to attack. Obviously an installation guide is not the place to try to include an exhaustive list of countermeasures for every possible attack, but it is worth noting some of the larger holes and how to close them.
As stated earlier in this section, MIT recommends that on a
secure host, you disable the standard
exec services in
/etc/inetd.conf. We also recommend that secure hosts have an empty
/etc/hosts.equiv file and that there not be a
root's home directory. You can grant Kerberos-authenticated
root access to specific Kerberos principals by placing those principals
in the file
.k5login in root's home directory.
We recommend that backups of secure machines exclude the keytab file
/etc/krb5.keytab). If this is not possible, the backups should
at least be done locally, rather than over a network, and the backup
tapes should be physically secured.
Finally, the keytab file and any programs run by root, including the Kerberos V5 binaries, should be kept on local disk. The keytab file should be readable only by root.