Deploy the kerberos-connect container on the Network Connector

The kerberos-connect container lets Segura® Platform acquire Kerberos tickets through the Network Connector. Deploy it alongside the Network Connector agent, in the same Docker Compose file, so Segura® can change Windows credential passwords over Kerberos when it reaches the Active Directory domain only through the connector.

This is the prerequisite setup for Change a password over Kerberos through the Network Connector.

Requirements

• Segura® Platform 4.2.0 or later.
• A working Network Connector server and agent. See How to install Network Connector.
• Separate hosts for Segura® Platform, the Network Connector agent (the Docker host), and the domain controller. Segura® reaches the Active Directory only through the Network Connector agent, never directly.
• Root access to the Docker host that runs the Network Connector agent.
• Docker and Docker Compose on that host.
• The Kerberos realm and the KDC hostname for the target Active Directory.

Steps

1. On Segura® Platform, generate the certificate bundle. In the Segura® terminal, run:

   orbit kerberos-connect setup
   

   The command creates the bundle at /tmp/leaf_cert_bundle.tar.gz.

2. Copy the bundle to the Docker host. Replace user@dockerhost with your host:

   scp /tmp/leaf_cert_bundle.tar.gz user@dockerhost:/tmp
   

3. On the Docker host, extract the bundle:

   mkdir -p /etc/kerberos-connect
   tar -xvzf /tmp/leaf_cert_bundle.tar.gz -C /etc/kerberos-connect
   

4. Add the segura-kerberos-connect service to the Network Connector Docker Compose file. Deploy it in the same file as the Network Connector agent:

   services:
     senhasegura-network-connector-agent:
       image: "registry.senhasegura.io/network-connector/agent-v2:latest"
       restart: unless-stopped
       networks:
         - senhasegura-network-connector
       environment:
         SENHASEGURA_FINGERPRINT: "FINGERPRINT_HERE"
         SENHASEGURA_AGENT_PORT: "PORT_HERE"
         SENHASEGURA_ADDRESSES: "SEGURA_IP"
         SENHASEGURA_AGENT_SECONDARY: "false"
   
     segura-kerberos-connect:
       image: registry.senhasegura.io/tools/kerberos-connect/kdc:latest
       environment:
         REALM: "MY.KERBEROS.REALM"
         KDC: "MYKDC.my.kerberos.realm"
         KDC_PORT: "88"           # Optional, defaults to 88
       ports:
         - "51088:51088"
       restart: unless-stopped
       networks:
         - senhasegura-network-connector
       # Root filesystem locked down; only these tmpfs are writable
       read_only: true
       tmpfs:
         - /run:rw,nosuid,nodev,mode=1777
         - /tmp:rw,nosuid,nodev,mode=1777
         - /var/cache/nginx:rw,nosuid,nodev,uid=65532,gid=65532,mode=0750
       # Minimize kernel privileges
       cap_drop:
         - ALL
       security_opt:
         - no-new-privileges:true
       # Contain blast radius
       pids_limit: 100
       mem_limit: 256m
       cpus: "0.50"
       # Avoid interactive shells by default
       stdin_open: false
       tty: false
       # Mount the TLS certificate and key
       volumes:
         - $PATH_TO_CERTIFICATE:/run/secrets/tls.crt:ro
         - $PATH_TO_KEY:/run/secrets/tls.key:ro
   
   networks:
     senhasegura-network-connector:
       driver: bridge
   

   Set the following values for the segura-kerberos-connect service:

   • REALM: your Kerberos realm. Replace the example MY.KERBEROS.REALM.
   • KDC: the KDC hostname. Replace the example MYKDC.my.kerberos.realm.
   • KDC_PORT: the KDC port. Defaults to 88; change it only if your KDC uses another port.
   • $PATH_TO_CERTIFICATE and $PATH_TO_KEY: the paths to the TLS certificate and key you extracted in Step 3.
   • 51088: the port the container exposes. Change it only if it conflicts with another service.
   Info

   The Network Connector agent fields (SENHASEGURA_FINGERPRINT, SENHASEGURA_AGENT_PORT, and SENHASEGURA_ADDRESSES) are covered in How to install Network Connector.

5. On the Docker host, start the services:

   docker compose up -d
   

Verify your results

Confirm that the container is running:

docker compose ps

The segura-kerberos-connect service is listed as running. Segura® Platform can now change Windows credential passwords over Kerberos through the Network Connector. To configure a credential and run the change, see Change a password over Kerberos through the Network Connector.