1%% Generated by Sphinx. 2\def\sphinxdocclass{report} 3\documentclass[letterpaper,10pt,english]{sphinxmanual} 4\ifdefined\pdfpxdimen 5 \let\sphinxpxdimen\pdfpxdimen\else\newdimen\sphinxpxdimen 6\fi \sphinxpxdimen=.75bp\relax 7\ifdefined\pdfimageresolution 8 \pdfimageresolution= \numexpr \dimexpr1in\relax/\sphinxpxdimen\relax 9\fi 10%% let collapsible pdf bookmarks panel have high depth per default 11\PassOptionsToPackage{bookmarksdepth=5}{hyperref} 12 13\PassOptionsToPackage{warn}{textcomp} 14\usepackage[utf8]{inputenc} 15\ifdefined\DeclareUnicodeCharacter 16% support both utf8 and utf8x syntaxes 17 \ifdefined\DeclareUnicodeCharacterAsOptional 18 \def\sphinxDUC#1{\DeclareUnicodeCharacter{"#1}} 19 \else 20 \let\sphinxDUC\DeclareUnicodeCharacter 21 \fi 22 \sphinxDUC{00A0}{\nobreakspace} 23 \sphinxDUC{2500}{\sphinxunichar{2500}} 24 \sphinxDUC{2502}{\sphinxunichar{2502}} 25 \sphinxDUC{2514}{\sphinxunichar{2514}} 26 \sphinxDUC{251C}{\sphinxunichar{251C}} 27 \sphinxDUC{2572}{\textbackslash} 28\fi 29\usepackage{cmap} 30\usepackage[T1]{fontenc} 31\usepackage{amsmath,amssymb,amstext} 32\usepackage{babel} 33 34 35 36\usepackage{tgtermes} 37\usepackage{tgheros} 38\renewcommand{\ttdefault}{txtt} 39 40 41 42\usepackage[Bjarne]{fncychap} 43\usepackage{sphinx} 44 45\fvset{fontsize=auto} 46\usepackage{geometry} 47 48 49% Include hyperref last. 50\usepackage{hyperref} 51% Fix anchor placement for figures with captions. 52\usepackage{hypcap}% it must be loaded after hyperref. 53% Set up styles of URL: it should be placed after hyperref. 54\urlstyle{same} 55 56 57\usepackage{sphinxmessages} 58\setcounter{tocdepth}{0} 59 60 61 62\title{Kerberos Administration Guide} 63\date{ } 64\release{1.21.3} 65\author{MIT} 66\newcommand{\sphinxlogo}{\vbox{}} 67\renewcommand{\releasename}{Release} 68\makeindex 69\begin{document} 70 71\pagestyle{empty} 72\sphinxmaketitle 73\pagestyle{plain} 74\sphinxtableofcontents 75\pagestyle{normal} 76\phantomsection\label{\detokenize{admin/index::doc}} 77 78 79 80\chapter{Installation guide} 81\label{\detokenize{admin/install:installation-guide}}\label{\detokenize{admin/install::doc}} 82 83\section{Contents} 84\label{\detokenize{admin/install:contents}} 85 86\subsection{Installing KDCs} 87\label{\detokenize{admin/install_kdc:installing-kdcs}}\label{\detokenize{admin/install_kdc::doc}} 88\sphinxAtStartPar 89When setting up Kerberos in a production environment, it is best to 90have multiple replica KDCs alongside with a primary KDC to ensure the 91continued availability of the Kerberized services. Each KDC contains 92a copy of the Kerberos database. The primary KDC contains the 93writable copy of the realm database, which it replicates to the 94replica KDCs at regular intervals. All database changes (such as 95password changes) are made on the primary KDC. Replica KDCs provide 96Kerberos ticket\sphinxhyphen{}granting services, but not database administration, 97when the primary KDC is unavailable. MIT recommends that you install 98all of your KDCs to be able to function as either the primary or one 99of the replicas. This will enable you to easily switch your primary 100KDC with one of the replicas if necessary (see 101{\hyperref[\detokenize{admin/install_kdc:switch-primary-replica}]{\sphinxcrossref{\DUrole{std,std-ref}{Switching primary and replica KDCs}}}}). This installation procedure is based 102on that recommendation. 103 104\begin{sphinxadmonition}{warning}{Warning:}\begin{itemize} 105\item {} 106\sphinxAtStartPar 107The Kerberos system relies on the availability of correct time 108information. Ensure that the primary and all replica KDCs have 109properly synchronized clocks. 110 111\item {} 112\sphinxAtStartPar 113It is best to install and run KDCs on secured and dedicated 114hardware with limited access. If your KDC is also a file 115server, FTP server, Web server, or even just a client machine, 116someone who obtained root access through a security hole in any 117of those areas could potentially gain access to the Kerberos 118database. 119 120\end{itemize} 121\end{sphinxadmonition} 122 123 124\subsubsection{Install and configure the primary KDC} 125\label{\detokenize{admin/install_kdc:install-and-configure-the-primary-kdc}} 126\sphinxAtStartPar 127Install Kerberos either from the OS\sphinxhyphen{}provided packages or from the 128source (See \DUrole{xref,std,std-ref}{do\_build}). 129 130\begin{sphinxadmonition}{note}{Note:} 131\sphinxAtStartPar 132For the purpose of this document we will use the following 133names: 134 135\begin{sphinxVerbatim}[commandchars=\\\{\}] 136\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}} \PYG{n}{primary} \PYG{n}{KDC} 137\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}} \PYG{n}{replica} \PYG{n}{KDC} 138\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}} \PYG{n}{realm} \PYG{n}{name} 139\PYG{o}{.}\PYG{n}{k5}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}} \PYG{n}{stash} \PYG{n}{file} 140\PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin} \PYG{o}{\PYGZhy{}} \PYG{n}{admin} \PYG{n}{principal} 141\end{sphinxVerbatim} 142 143\sphinxAtStartPar 144See {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the default names and locations 145of the relevant to this topic files. Adjust the names and 146paths to your system environment. 147\end{sphinxadmonition} 148 149 150\subsubsection{Edit KDC configuration files} 151\label{\detokenize{admin/install_kdc:edit-kdc-configuration-files}} 152\sphinxAtStartPar 153Modify the configuration files, {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} and 154{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, to reflect the correct information (such as 155domain\sphinxhyphen{}realm mappings and Kerberos servers names) for your realm. 156(See {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the recommended default locations for 157these files). 158 159\sphinxAtStartPar 160Most of the tags in the configuration have default values that will 161work well for most sites. There are some tags in the 162{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file whose values must be specified, and this 163section will explain those. 164 165\sphinxAtStartPar 166If the locations for these configuration files differs from the 167default ones, set \sphinxstylestrong{KRB5\_CONFIG} and \sphinxstylestrong{KRB5\_KDC\_PROFILE} environment 168variables to point to the krb5.conf and kdc.conf respectively. For 169example: 170 171\begin{sphinxVerbatim}[commandchars=\\\{\}] 172\PYG{n}{export} \PYG{n}{KRB5\PYGZus{}CONFIG}\PYG{o}{=}\PYG{o}{/}\PYG{n}{yourdir}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{conf} 173\PYG{n}{export} \PYG{n}{KRB5\PYGZus{}KDC\PYGZus{}PROFILE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{yourdir}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{conf} 174\end{sphinxVerbatim} 175 176 177\paragraph{krb5.conf} 178\label{\detokenize{admin/install_kdc:krb5-conf}} 179\sphinxAtStartPar 180If you are not using DNS TXT records (see {\hyperref[\detokenize{admin/realm_config:mapping-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Mapping hostnames onto Kerberos realms}}}}), 181you must specify the \sphinxstylestrong{default\_realm} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} 182section. If you are not using DNS URI or SRV records (see 183{\hyperref[\detokenize{admin/realm_config:kdc-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Hostnames for KDCs}}}} and {\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC Discovery}}}}), you must include the 184\sphinxstylestrong{kdc} tag for each \sphinxstyleemphasis{realm} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section. To 185communicate with the kadmin server in each realm, the \sphinxstylestrong{admin\_server} 186tag must be set in the 187{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section. 188 189\sphinxAtStartPar 190An example krb5.conf file: 191 192\begin{sphinxVerbatim}[commandchars=\\\{\}] 193\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 194 \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 195 196\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 197 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 198 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 199 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 200 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 201 \PYG{p}{\PYGZcb{}} 202\end{sphinxVerbatim} 203 204 205\paragraph{kdc.conf} 206\label{\detokenize{admin/install_kdc:kdc-conf}} 207\sphinxAtStartPar 208The kdc.conf file can be used to control the listening ports of the 209KDC and kadmind, as well as realm\sphinxhyphen{}specific defaults, the database type 210and location, and logging. 211 212\sphinxAtStartPar 213An example kdc.conf file: 214 215\begin{sphinxVerbatim}[commandchars=\\\{\}] 216\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} 217 \PYG{n}{kdc\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} 218 \PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} 219 220\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 221 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 222 \PYG{n}{kadmind\PYGZus{}port} \PYG{o}{=} \PYG{l+m+mi}{749} 223 \PYG{n}{max\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{12}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} 224 \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} 225 \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts} 226 \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} 227 \PYG{c+c1}{\PYGZsh{} If the default location does not suit your setup,} 228 \PYG{c+c1}{\PYGZsh{} explicitly configure the following values:} 229 \PYG{c+c1}{\PYGZsh{} database\PYGZus{}name = /var/krb5kdc/principal} 230 \PYG{c+c1}{\PYGZsh{} key\PYGZus{}stash\PYGZus{}file = /var/krb5kdc/.k5.ATHENA.MIT.EDU} 231 \PYG{c+c1}{\PYGZsh{} acl\PYGZus{}file = /var/krb5kdc/kadm5.acl} 232 \PYG{p}{\PYGZcb{}} 233 234\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} 235 \PYG{c+c1}{\PYGZsh{} By default, the KDC and kadmind will log output using} 236 \PYG{c+c1}{\PYGZsh{} syslog. You can instead send log output to files like this:} 237 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{.}\PYG{n}{log} 238 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} 239 \PYG{n}{default} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5lib}\PYG{o}{.}\PYG{n}{log} 240\end{sphinxVerbatim} 241 242\sphinxAtStartPar 243Replace \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} and \sphinxcode{\sphinxupquote{kerberos.mit.edu}} with the name of 244your Kerberos realm and server respectively. 245 246\begin{sphinxadmonition}{note}{Note:} 247\sphinxAtStartPar 248You have to have write permission on the target directories 249(these directories must exist) used by \sphinxstylestrong{database\_name}, 250\sphinxstylestrong{key\_stash\_file}, and \sphinxstylestrong{acl\_file}. 251\end{sphinxadmonition} 252 253 254\subsubsection{Create the KDC database} 255\label{\detokenize{admin/install_kdc:create-the-kdc-database}}\label{\detokenize{admin/install_kdc:create-db}} 256\sphinxAtStartPar 257You will use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command on the primary KDC to 258create the Kerberos database and the optional \DUrole{xref,std,std-ref}{stash\_definition}. 259 260\begin{sphinxadmonition}{note}{Note:} 261\sphinxAtStartPar 262If you choose not to install a stash file, the KDC will 263prompt you for the master key each time it starts up. This 264means that the KDC will not be able to start automatically, 265such as after a system reboot. 266\end{sphinxadmonition} 267 268\sphinxAtStartPar 269{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} will prompt you for the master password for the 270Kerberos database. This password can be any string. A good password 271is one you can remember, but that no one else can guess. Examples of 272bad passwords are words that can be found in a dictionary, any common 273or popular name, especially a famous person (or cartoon character), 274your username in any form (e.g., forward, backward, repeated twice, 275etc.), and any of the sample passwords that appear in this manual. 276One example of a password which might be good if it did not appear in 277this manual is “MITiys4K5!”, which represents the sentence “MIT is 278your source for Kerberos 5!” (It’s the first letter of each word, 279substituting the numeral “4” for the word “for”, and includes the 280punctuation mark at the end.) 281 282\sphinxAtStartPar 283The following is an example of how to create a Kerberos database and 284stash file on the primary KDC, using the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command. 285Replace \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} with the name of your Kerberos realm: 286 287\begin{sphinxVerbatim}[commandchars=\\\{\}] 288\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}util} \PYG{n}{create} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}}\PYG{n}{s} 289 290\PYG{n}{Initializing} \PYG{n}{database} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{/usr/local/var/krb5kdc/principal}\PYG{l+s+s1}{\PYGZsq{}} \PYG{k}{for} \PYG{n}{realm} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}}\PYG{p}{,} 291\PYG{n}{master} \PYG{n}{key} \PYG{n}{name} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{K/M@ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}} 292\PYG{n}{You} \PYG{n}{will} \PYG{n}{be} \PYG{n}{prompted} \PYG{k}{for} \PYG{n}{the} \PYG{n}{database} \PYG{n}{Master} \PYG{n}{Password}\PYG{o}{.} 293\PYG{n}{It} \PYG{o+ow}{is} \PYG{n}{important} \PYG{n}{that} \PYG{n}{you} \PYG{n}{NOT} \PYG{n}{FORGET} \PYG{n}{this} \PYG{n}{password}\PYG{o}{.} 294\PYG{n}{Enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{the} \PYG{n}{master} \PYG{n}{password}\PYG{o}{.} 295\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key} \PYG{n}{to} \PYG{n}{verify}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{it} \PYG{n}{again}\PYG{o}{.} 296\PYG{n}{shell}\PYG{o}{\PYGZpc{}} 297\end{sphinxVerbatim} 298 299\sphinxAtStartPar 300This will create five files in {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}} (or at the locations specified 301in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}): 302\begin{itemize} 303\item {} 304\sphinxAtStartPar 305two Kerberos database files, \sphinxcode{\sphinxupquote{principal}}, and \sphinxcode{\sphinxupquote{principal.ok}} 306 307\item {} 308\sphinxAtStartPar 309the Kerberos administrative database file, \sphinxcode{\sphinxupquote{principal.kadm5}} 310 311\item {} 312\sphinxAtStartPar 313the administrative database lock file, \sphinxcode{\sphinxupquote{principal.kadm5.lock}} 314 315\item {} 316\sphinxAtStartPar 317the stash file, in this example \sphinxcode{\sphinxupquote{.k5.ATHENA.MIT.EDU}}. If you do 318not want a stash file, run the above command without the \sphinxstylestrong{\sphinxhyphen{}s} 319option. 320 321\end{itemize} 322 323\sphinxAtStartPar 324For more information on administrating Kerberos database see 325{\hyperref[\detokenize{admin/database:db-operations}]{\sphinxcrossref{\DUrole{std,std-ref}{Operations on the Kerberos database}}}}. 326 327 328\subsubsection{Add administrators to the ACL file} 329\label{\detokenize{admin/install_kdc:add-administrators-to-the-acl-file}}\label{\detokenize{admin/install_kdc:admin-acl}} 330\sphinxAtStartPar 331Next, you need create an Access Control List (ACL) file and put the 332Kerberos principal of at least one of the administrators into it. 333This file is used by the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon to control which 334principals may view and make privileged modifications to the Kerberos 335database files. The ACL filename is determined by the \sphinxstylestrong{acl\_file} 336variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}; the default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. 337 338\sphinxAtStartPar 339For more information on Kerberos ACL file see {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. 340 341 342\subsubsection{Add administrators to the Kerberos database} 343\label{\detokenize{admin/install_kdc:add-administrators-to-the-kerberos-database}}\label{\detokenize{admin/install_kdc:addadmin-kdb}} 344\sphinxAtStartPar 345Next you need to add administrative principals (i.e., principals who 346are allowed to administer Kerberos database) to the Kerberos database. 347You \sphinxstyleemphasis{must} add at least one principal now to allow communication 348between the Kerberos administration daemon kadmind and the kadmin 349program over the network for further administration. To do this, use 350the kadmin.local utility on the primary KDC. kadmin.local is designed 351to be run on the primary KDC host without using Kerberos 352authentication to an admin server; instead, it must have read and 353write access to the Kerberos database on the local filesystem. 354 355\sphinxAtStartPar 356The administrative principals you create should be the ones you added 357to the ACL file (see {\hyperref[\detokenize{admin/install_kdc:admin-acl}]{\sphinxcrossref{\DUrole{std,std-ref}{Add administrators to the ACL file}}}}). 358 359\sphinxAtStartPar 360In the following example, the administrative principal \sphinxcode{\sphinxupquote{admin/admin}} 361is created: 362 363\begin{sphinxVerbatim}[commandchars=\\\{\}] 364\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local} 365 366\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local}\PYG{p}{:} \PYG{n}{addprinc} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 367 368\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{admin/admin@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} 369\PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}}\PYG{o}{.} 370\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Enter} \PYG{n}{a} \PYG{n}{password}\PYG{o}{.} 371\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} \PYG{o}{\PYGZlt{}}\PYG{o}{=} \PYG{n}{Type} \PYG{n}{it} \PYG{n}{again}\PYG{o}{.} 372\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{admin/admin@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} 373\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local}\PYG{p}{:} 374\end{sphinxVerbatim} 375 376 377\subsubsection{Start the Kerberos daemons on the primary KDC} 378\label{\detokenize{admin/install_kdc:start-the-kerberos-daemons-on-the-primary-kdc}}\label{\detokenize{admin/install_kdc:start-kdc-daemons}} 379\sphinxAtStartPar 380At this point, you are ready to start the Kerberos KDC 381({\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}) and administrative daemons on the primary KDC. To 382do so, type: 383 384\begin{sphinxVerbatim}[commandchars=\\\{\}] 385\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{krb5kdc} 386\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmind} 387\end{sphinxVerbatim} 388 389\sphinxAtStartPar 390Each server daemon will fork and run in the background. 391 392\begin{sphinxadmonition}{note}{Note:} 393\sphinxAtStartPar 394Assuming you want these daemons to start up automatically at 395boot time, you can add them to the KDC’s \sphinxcode{\sphinxupquote{/etc/rc}} or 396\sphinxcode{\sphinxupquote{/etc/inittab}} file. You need to have a 397\DUrole{xref,std,std-ref}{stash\_definition} in order to do this. 398\end{sphinxadmonition} 399 400\sphinxAtStartPar 401You can verify that they started properly by checking for their 402startup messages in the logging locations you defined in 403{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} (see {\hyperref[\detokenize{admin/conf_files/kdc_conf:logging}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}logging{]}}}}}). For example: 404 405\begin{sphinxVerbatim}[commandchars=\\\{\}] 406\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{tail} \PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{.}\PYG{n}{log} 407\PYG{n}{Dec} \PYG{l+m+mi}{02} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{35}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{beeblebrox} \PYG{n}{krb5kdc}\PYG{p}{[}\PYG{l+m+mi}{3187}\PYG{p}{]}\PYG{p}{(}\PYG{n}{info}\PYG{p}{)}\PYG{p}{:} \PYG{n}{commencing} \PYG{n}{operation} 408\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{tail} \PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{log}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} 409\PYG{n}{Dec} \PYG{l+m+mi}{02} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{35}\PYG{p}{:}\PYG{l+m+mi}{52} \PYG{n}{beeblebrox} \PYG{n}{kadmind}\PYG{p}{[}\PYG{l+m+mi}{3189}\PYG{p}{]}\PYG{p}{(}\PYG{n}{info}\PYG{p}{)}\PYG{p}{:} \PYG{n}{starting} 410\end{sphinxVerbatim} 411 412\sphinxAtStartPar 413Any errors the daemons encounter while starting will also be listed in 414the logging output. 415 416\sphinxAtStartPar 417As an additional verification, check if \DUrole{xref,std,std-ref}{kinit(1)} succeeds 418against the principals that you have created on the previous step 419({\hyperref[\detokenize{admin/install_kdc:addadmin-kdb}]{\sphinxcrossref{\DUrole{std,std-ref}{Add administrators to the Kerberos database}}}}). Run: 420 421\begin{sphinxVerbatim}[commandchars=\\\{\}] 422\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kinit} \PYG{n}{admin}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 423\end{sphinxVerbatim} 424 425 426\subsubsection{Install the replica KDCs} 427\label{\detokenize{admin/install_kdc:install-the-replica-kdcs}} 428\sphinxAtStartPar 429You are now ready to start configuring the replica KDCs. 430 431\begin{sphinxadmonition}{note}{Note:} 432\sphinxAtStartPar 433Assuming you are setting the KDCs up so that you can easily 434switch the primary KDC with one of the replicas, you should 435perform each of these steps on the primary KDC as well as 436the replica KDCs, unless these instructions specify 437otherwise. 438\end{sphinxadmonition} 439 440 441\paragraph{Create host keytabs for replica KDCs} 442\label{\detokenize{admin/install_kdc:create-host-keytabs-for-replica-kdcs}}\label{\detokenize{admin/install_kdc:replica-host-key}} 443\sphinxAtStartPar 444Each KDC needs a \sphinxcode{\sphinxupquote{host}} key in the Kerberos database. These keys 445are used for mutual authentication when propagating the database dump 446file from the primary KDC to the secondary KDC servers. 447 448\sphinxAtStartPar 449On the primary KDC, connect to administrative interface and create the 450host principal for each of the KDCs’ \sphinxcode{\sphinxupquote{host}} services. For example, 451if the primary KDC were called \sphinxcode{\sphinxupquote{kerberos.mit.edu}}, and you had a 452replica KDC named \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}, you would type the 453following: 454 455\begin{sphinxVerbatim}[commandchars=\\\{\}] 456\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin} 457\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 458\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} \PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}} 459\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} 460 461\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 462\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos\PYGZhy{}1.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} \PYG{n}{assigning} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{default}\PYG{l+s+s2}{\PYGZdq{}} 463\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{host/kerberos\PYGZhy{}1.mit.edu@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} 464\end{sphinxVerbatim} 465 466\sphinxAtStartPar 467It is not strictly necessary to have the primary KDC server in the 468Kerberos database, but it can be handy if you want to be able to swap 469the primary KDC with one of the replicas. 470 471\sphinxAtStartPar 472Next, extract \sphinxcode{\sphinxupquote{host}} random keys for all participating KDCs and 473store them in each host’s default keytab file. Ideally, you should 474extract each keytab locally on its own KDC. If this is not feasible, 475you should use an encrypted session to send them across the network. 476To extract a keytab directly on a replica KDC called 477\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}, you would execute the following command: 478 479\begin{sphinxVerbatim}[commandchars=\\\{\}] 480\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 481\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 482 \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 483\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 484 \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 485\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 486 \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 487\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 488 \PYG{n+nb}{type} \PYG{n}{arcfour}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 489\end{sphinxVerbatim} 490 491\sphinxAtStartPar 492If you are instead extracting a keytab for the replica KDC called 493\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}} on the primary KDC, you should use a dedicated 494temporary keytab file for that machine’s keytab: 495 496\begin{sphinxVerbatim}[commandchars=\\\{\}] 497\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 498\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 499 \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 500\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} 501 \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 502\end{sphinxVerbatim} 503 504\sphinxAtStartPar 505The file \sphinxcode{\sphinxupquote{/tmp/kerberos\sphinxhyphen{}1.keytab}} can then be installed as 506\sphinxcode{\sphinxupquote{/etc/krb5.keytab}} on the host \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1.mit.edu}}. 507 508 509\paragraph{Configure replica KDCs} 510\label{\detokenize{admin/install_kdc:configure-replica-kdcs}} 511\sphinxAtStartPar 512Database propagation copies the contents of the primary’s database, 513but does not propagate configuration files, stash files, or the kadm5 514ACL file. The following files must be copied by hand to each replica 515(see {\hyperref[\detokenize{mitK5defaults:mitk5defaults}]{\sphinxcrossref{\DUrole{std,std-ref}{MIT Kerberos defaults}}}} for the default locations for these files): 516\begin{itemize} 517\item {} 518\sphinxAtStartPar 519krb5.conf 520 521\item {} 522\sphinxAtStartPar 523kdc.conf 524 525\item {} 526\sphinxAtStartPar 527kadm5.acl 528 529\item {} 530\sphinxAtStartPar 531master key stash file 532 533\end{itemize} 534 535\sphinxAtStartPar 536Move the copied files into their appropriate directories, exactly as 537on the primary KDC. kadm5.acl is only needed to allow a replica to 538swap with the primary KDC. 539 540\sphinxAtStartPar 541The database is propagated from the primary KDC to the replica KDCs 542via the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} daemon. You must explicitly specify the 543principals which are allowed to provide Kerberos dump updates on the 544replica machine with a new database. Create a file named kpropd.acl 545in the KDC state directory containing the \sphinxcode{\sphinxupquote{host}} principals for each 546of the KDCs: 547 548\begin{sphinxVerbatim}[commandchars=\\\{\}] 549\PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 550\PYG{n}{host}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 551\end{sphinxVerbatim} 552 553\begin{sphinxadmonition}{note}{Note:} 554\sphinxAtStartPar 555If you expect that the primary and replica KDCs will be 556switched at some point of time, list the host principals 557from all participating KDC servers in kpropd.acl files on 558all of the KDCs. Otherwise, you only need to list the 559primary KDC’s host principal in the kpropd.acl files of the 560replica KDCs. 561\end{sphinxadmonition} 562 563\sphinxAtStartPar 564Then, add the following line to \sphinxcode{\sphinxupquote{/etc/inetd.conf}} on each KDC 565(adjust the path to kpropd): 566 567\begin{sphinxVerbatim}[commandchars=\\\{\}] 568\PYG{n}{krb5\PYGZus{}prop} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{kpropd} \PYG{n}{kpropd} 569\end{sphinxVerbatim} 570 571\sphinxAtStartPar 572You also need to add the following line to \sphinxcode{\sphinxupquote{/etc/services}} on each 573KDC, if it is not already present (assuming that the default port is 574used): 575 576\begin{sphinxVerbatim}[commandchars=\\\{\}] 577\PYG{n}{krb5\PYGZus{}prop} \PYG{l+m+mi}{754}\PYG{o}{/}\PYG{n}{tcp} \PYG{c+c1}{\PYGZsh{} Kerberos replica propagation} 578\end{sphinxVerbatim} 579 580\sphinxAtStartPar 581Restart inetd daemon. 582 583\sphinxAtStartPar 584Alternatively, start {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} as a stand\sphinxhyphen{}alone daemon. This is 585required when incremental propagation is enabled. 586 587\sphinxAtStartPar 588Now that the replica KDC is able to accept database propagation, 589you’ll need to propagate the database from the primary server. 590 591\sphinxAtStartPar 592NOTE: Do not start the replica KDC yet; you still do not have a copy 593of the primary’s database. 594 595 596\paragraph{Propagate the database to each replica KDC} 597\label{\detokenize{admin/install_kdc:propagate-the-database-to-each-replica-kdc}}\label{\detokenize{admin/install_kdc:kprop-to-replicas}} 598\sphinxAtStartPar 599First, create a dump file of the database on the primary KDC, as 600follows: 601 602\begin{sphinxVerbatim}[commandchars=\\\{\}] 603\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}util} \PYG{n}{dump} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{replica\PYGZus{}datatrans} 604\end{sphinxVerbatim} 605 606\sphinxAtStartPar 607Then, manually propagate the database to each replica KDC, as in the 608following example: 609 610\begin{sphinxVerbatim}[commandchars=\\\{\}] 611\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kprop} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{replica\PYGZus{}datatrans} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 612 613\PYG{n}{Database} \PYG{n}{propagation} \PYG{n}{to} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{p}{:} \PYG{n}{SUCCEEDED} 614\end{sphinxVerbatim} 615 616\sphinxAtStartPar 617You will need a script to dump and propagate the database. The 618following is an example of a Bourne shell script that will do this. 619 620\begin{sphinxadmonition}{note}{Note:} 621\sphinxAtStartPar 622Remember that you need to replace \sphinxcode{\sphinxupquote{/usr/local/var/krb5kdc}} 623with the name of the KDC state directory. 624\end{sphinxadmonition} 625 626\begin{sphinxVerbatim}[commandchars=\\\{\}] 627\PYGZsh{}!/bin/sh 628 629kdclist = \PYGZdq{}kerberos\PYGZhy{}1.mit.edu kerberos\PYGZhy{}2.mit.edu\PYGZdq{} 630 631kdb5\PYGZus{}util dump /usr/local/var/krb5kdc/replica\PYGZus{}datatrans 632 633for kdc in \PYGZdl{}kdclist 634do 635 kprop \PYGZhy{}f /usr/local/var/krb5kdc/replica\PYGZus{}datatrans \PYGZdl{}kdc 636done 637\end{sphinxVerbatim} 638 639\sphinxAtStartPar 640You will need to set up a cron job to run this script at the intervals 641you decided on earlier (see {\hyperref[\detokenize{admin/realm_config:db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Database propagation}}}}). 642 643\sphinxAtStartPar 644Now that the replica KDC has a copy of the Kerberos database, you can 645start the krb5kdc daemon: 646 647\begin{sphinxVerbatim}[commandchars=\\\{\}] 648\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{krb5kdc} 649\end{sphinxVerbatim} 650 651\sphinxAtStartPar 652As with the primary KDC, you will probably want to add this command to 653the KDCs’ \sphinxcode{\sphinxupquote{/etc/rc}} or \sphinxcode{\sphinxupquote{/etc/inittab}} files, so they will start 654the krb5kdc daemon automatically at boot time. 655 656 657\subparagraph{Propagation failed?} 658\label{\detokenize{admin/install_kdc:propagation-failed}} 659\sphinxAtStartPar 660You may encounter the following error messages. For a more detailed 661discussion on possible causes and solutions click on the error link 662to be redirected to {\hyperref[\detokenize{admin/troubleshoot:troubleshoot}]{\sphinxcrossref{\DUrole{std,std-ref}{Troubleshooting}}}} section. 663\begin{enumerate} 664\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 665\item {} 666\sphinxAtStartPar 667{\hyperref[\detokenize{admin/troubleshoot:kprop-no-route}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: No route to host while connecting to server}}}} 668 669\item {} 670\sphinxAtStartPar 671{\hyperref[\detokenize{admin/troubleshoot:kprop-con-refused}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Connection refused while connecting to server}}}} 672 673\item {} 674\sphinxAtStartPar 675{\hyperref[\detokenize{admin/troubleshoot:kprop-sendauth-exchange}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server}}}} 676 677\end{enumerate} 678 679 680\subsubsection{Add Kerberos principals to the database} 681\label{\detokenize{admin/install_kdc:add-kerberos-principals-to-the-database}} 682\sphinxAtStartPar 683Once your KDCs are set up and running, you are ready to use 684{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} to load principals for your users, hosts, and other 685services into the Kerberos database. This procedure is described 686fully in {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}. 687 688\sphinxAtStartPar 689You may occasionally want to use one of your replica KDCs as the 690primary. This might happen if you are upgrading the primary KDC, or 691if your primary KDC has a disk crash. See the following section for 692the instructions. 693 694 695\subsubsection{Switching primary and replica KDCs} 696\label{\detokenize{admin/install_kdc:switching-primary-and-replica-kdcs}}\label{\detokenize{admin/install_kdc:switch-primary-replica}} 697\sphinxAtStartPar 698You may occasionally want to use one of your replica KDCs as the 699primary. This might happen if you are upgrading the primary KDC, or 700if your primary KDC has a disk crash. 701 702\sphinxAtStartPar 703Assuming you have configured all of your KDCs to be able to function 704as either the primary KDC or a replica KDC (as this document 705recommends), all you need to do to make the changeover is: 706 707\sphinxAtStartPar 708If the primary KDC is still running, do the following on the \sphinxstyleemphasis{old} 709primary KDC: 710\begin{enumerate} 711\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 712\item {} 713\sphinxAtStartPar 714Kill the kadmind process. 715 716\item {} 717\sphinxAtStartPar 718Disable the cron job that propagates the database. 719 720\item {} 721\sphinxAtStartPar 722Run your database propagation script manually, to ensure that the 723replicas all have the latest copy of the database (see 724{\hyperref[\detokenize{admin/install_kdc:kprop-to-replicas}]{\sphinxcrossref{\DUrole{std,std-ref}{Propagate the database to each replica KDC}}}}). 725 726\end{enumerate} 727 728\sphinxAtStartPar 729On the \sphinxstyleemphasis{new} primary KDC: 730\begin{enumerate} 731\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 732\item {} 733\sphinxAtStartPar 734Start the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon (see {\hyperref[\detokenize{admin/install_kdc:start-kdc-daemons}]{\sphinxcrossref{\DUrole{std,std-ref}{Start the Kerberos daemons on the primary KDC}}}}). 735 736\item {} 737\sphinxAtStartPar 738Set up the cron job to propagate the database (see 739{\hyperref[\detokenize{admin/install_kdc:kprop-to-replicas}]{\sphinxcrossref{\DUrole{std,std-ref}{Propagate the database to each replica KDC}}}}). 740 741\item {} 742\sphinxAtStartPar 743Switch the CNAMEs of the old and new primary KDCs. If you can’t do 744this, you’ll need to change the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file on every 745client machine in your Kerberos realm. 746 747\end{enumerate} 748 749 750\subsubsection{Incremental database propagation} 751\label{\detokenize{admin/install_kdc:incremental-database-propagation}} 752\sphinxAtStartPar 753If you expect your Kerberos database to become large, you may wish to 754set up incremental propagation to replica KDCs. See 755{\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}} for details. 756 757 758\subsection{Installing and configuring UNIX client machines} 759\label{\detokenize{admin/install_clients:installing-and-configuring-unix-client-machines}}\label{\detokenize{admin/install_clients::doc}} 760\sphinxAtStartPar 761The Kerberized client programs include \DUrole{xref,std,std-ref}{kinit(1)}, 762\DUrole{xref,std,std-ref}{klist(1)}, \DUrole{xref,std,std-ref}{kdestroy(1)}, and \DUrole{xref,std,std-ref}{kpasswd(1)}. All of 763these programs are in the directory {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{BINDIR}}}}. 764 765\sphinxAtStartPar 766You can often integrate Kerberos with the login system on client 767machines, typically through the use of PAM. The details vary by 768operating system, and should be covered in your operating system’s 769documentation. If you do this, you will need to make sure your users 770know to use their Kerberos passwords when they log in. 771 772\sphinxAtStartPar 773You will also need to educate your users to use the ticket management 774programs kinit, klist, and kdestroy. If you do not have Kerberos 775password changing integrated into the native password program (again, 776typically through PAM), you will need to educate users to use kpasswd 777in place of its non\sphinxhyphen{}Kerberos counterparts passwd. 778 779 780\subsubsection{Client machine configuration files} 781\label{\detokenize{admin/install_clients:client-machine-configuration-files}} 782\sphinxAtStartPar 783Each machine running Kerberos should have a {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file. 784At a minimum, it should define a \sphinxstylestrong{default\_realm} setting in 785{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. If you are not using DNS SRV records 786({\hyperref[\detokenize{admin/realm_config:kdc-hostnames}]{\sphinxcrossref{\DUrole{std,std-ref}{Hostnames for KDCs}}}}) or URI records ({\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC Discovery}}}}), it must 787also contain a {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section containing information for your 788realm’s KDCs. 789 790\sphinxAtStartPar 791Consider setting \sphinxstylestrong{rdns} to false in order to reduce your dependence 792on precisely correct DNS information for service hostnames. Turning 793this flag off means that service hostnames will be canonicalized 794through forward name resolution (which adds your domain name to 795unqualified hostnames, and resolves CNAME records in DNS), but not 796through reverse address lookup. The default value of this flag is 797true for historical reasons only. 798 799\sphinxAtStartPar 800If you anticipate users frequently logging into remote hosts 801(e.g., using ssh) using forwardable credentials, consider setting 802\sphinxstylestrong{forwardable} to true so that users obtain forwardable tickets by 803default. Otherwise users will need to use \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}f}} to get 804forwardable tickets. 805 806\sphinxAtStartPar 807Consider adjusting the \sphinxstylestrong{ticket\_lifetime} setting to match the likely 808length of sessions for your users. For instance, if most of your 809users will be logging in for an eight\sphinxhyphen{}hour workday, you could set the 810default to ten hours so that tickets obtained in the morning expire 811shortly after the end of the workday. Users can still manually 812request longer tickets when necessary, up to the maximum allowed by 813each user’s principal record on the KDC. 814 815\sphinxAtStartPar 816If a client host may access services in different realms, it may be 817useful to define a {\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} mapping so that clients know 818which hosts belong to which realms. However, if your clients and KDC 819are running release 1.7 or later, it is also reasonable to leave this 820section out on client machines and just define it in the KDC’s 821krb5.conf. 822 823 824\subsection{UNIX Application Servers} 825\label{\detokenize{admin/install_appl_srv:unix-application-servers}}\label{\detokenize{admin/install_appl_srv::doc}} 826\sphinxAtStartPar 827An application server is a host that provides one or more services 828over the network. Application servers can be “secure” or “insecure.” 829A “secure” host is set up to require authentication from every client 830connecting to it. An “insecure” host will still provide Kerberos 831authentication, but will also allow unauthenticated clients to 832connect. 833 834\sphinxAtStartPar 835If you have Kerberos V5 installed on all of your client machines, MIT 836recommends that you make your hosts secure, to take advantage of the 837security that Kerberos authentication affords. However, if you have 838some clients that do not have Kerberos V5 installed, you can run an 839insecure server, and still take advantage of Kerberos V5’s single 840sign\sphinxhyphen{}on capability. 841 842 843\subsubsection{The keytab file} 844\label{\detokenize{admin/install_appl_srv:the-keytab-file}}\label{\detokenize{admin/install_appl_srv:keytab-file}} 845\sphinxAtStartPar 846All Kerberos server machines need a keytab file to authenticate to the 847KDC. By default on UNIX\sphinxhyphen{}like systems this file is named {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. 848The keytab file is an local copy of the host’s key. The keytab file 849is a potential point of entry for a break\sphinxhyphen{}in, and if compromised, 850would allow unrestricted access to its host. The keytab file should 851be readable only by root, and should exist only on the machine’s local 852disk. The file should not be part of any backup of the machine, 853unless access to the backup data is secured as tightly as access to 854the machine’s root password. 855 856\sphinxAtStartPar 857In order to generate a keytab for a host, the host must have a 858principal in the Kerberos database. The procedure for adding hosts to 859the database is described fully in {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}. (See 860{\hyperref[\detokenize{admin/install_kdc:replica-host-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Create host keytabs for replica KDCs}}}} for a brief description.) The keytab is 861generated by running {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} and issuing the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:ktadd}]{\sphinxcrossref{\DUrole{std,std-ref}{ktadd}}}} 862command. 863 864\sphinxAtStartPar 865For example, to generate a keytab file to allow the host 866\sphinxcode{\sphinxupquote{trillium.mit.edu}} to authenticate for the services host, ftp, and 867pop, the administrator \sphinxcode{\sphinxupquote{joeadmin}} would issue the command (on 868\sphinxcode{\sphinxupquote{trillium.mit.edu}}): 869 870\begin{sphinxVerbatim}[commandchars=\\\{\}] 871\PYG{n}{trillium}\PYG{o}{\PYGZpc{}} \PYG{n}{kadmin} 872\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 873\PYG{n}{Password} \PYG{k}{for} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} 874\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{ftp}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{pop}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 875\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 876\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{ftp}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 877\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{pop}\PYG{o}{/}\PYG{n}{trillium}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 878\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{quit} 879\PYG{n}{trillium}\PYG{o}{\PYGZpc{}} 880\end{sphinxVerbatim} 881 882\sphinxAtStartPar 883If you generate the keytab file on another host, you need to get a 884copy of the keytab file onto the destination host (\sphinxcode{\sphinxupquote{trillium}}, in 885the above example) without sending it unencrypted over the network. 886 887 888\subsubsection{Some advice about secure hosts} 889\label{\detokenize{admin/install_appl_srv:some-advice-about-secure-hosts}} 890\sphinxAtStartPar 891Kerberos V5 can protect your host from certain types of break\sphinxhyphen{}ins, but 892it is possible to install Kerberos V5 and still leave your host 893vulnerable to attack. Obviously an installation guide is not the 894place to try to include an exhaustive list of countermeasures for 895every possible attack, but it is worth noting some of the larger holes 896and how to close them. 897 898\sphinxAtStartPar 899We recommend that backups of secure machines exclude the keytab file 900({\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}). If this is not possible, the backups should at least be 901done locally, rather than over a network, and the backup tapes should 902be physically secured. 903 904\sphinxAtStartPar 905The keytab file and any programs run by root, including the Kerberos 906V5 binaries, should be kept on local disk. The keytab file should be 907readable only by root. 908 909 910\section{Additional references} 911\label{\detokenize{admin/install:additional-references}}\begin{enumerate} 912\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 913\item {} 914\sphinxAtStartPar 915Debian: \sphinxhref{http://techpubs.spinlocksolutions.com/dklar/kerberos.html}{Setting up MIT Kerberos 5} 916 917\item {} 918\sphinxAtStartPar 919Solaris: \sphinxhref{https://docs.oracle.com/cd/E19253-01/816-4557/6maosrjv2/index.html}{Configuring the Kerberos Service} 920 921\end{enumerate} 922 923 924\chapter{Configuration Files} 925\label{\detokenize{admin/conf_files/index:configuration-files}}\label{\detokenize{admin/conf_files/index::doc}} 926\sphinxAtStartPar 927Kerberos uses configuration files to allow administrators to specify 928settings on a per\sphinxhyphen{}machine basis. {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} applies to all 929applications using the Kerboros library, on clients and servers. 930For KDC\sphinxhyphen{}specific applications, additional settings can be specified in 931{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}; the two files are merged into a configuration profile 932used by applications accessing the KDC database directly. {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} 933is also only used on the KDC, it controls permissions for modifying the 934KDC database. 935 936 937\section{Contents} 938\label{\detokenize{admin/conf_files/index:contents}} 939 940\subsection{krb5.conf} 941\label{\detokenize{admin/conf_files/krb5_conf:krb5-conf}}\label{\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}}\label{\detokenize{admin/conf_files/krb5_conf::doc}} 942\sphinxAtStartPar 943The krb5.conf file contains Kerberos configuration information, 944including the locations of KDCs and admin servers for the Kerberos 945realms of interest, defaults for the current realm and for Kerberos 946applications, and mappings of hostnames onto Kerberos realms. 947Normally, you should install your krb5.conf file in the directory 948\sphinxcode{\sphinxupquote{/etc}}. You can override the default location by setting the 949environment variable \sphinxstylestrong{KRB5\_CONFIG}. Multiple colon\sphinxhyphen{}separated 950filenames may be specified in \sphinxstylestrong{KRB5\_CONFIG}; all files which are 951present will be read. Starting in release 1.14, directory names can 952also be specified in \sphinxstylestrong{KRB5\_CONFIG}; all files within the directory 953whose names consist solely of alphanumeric characters, dashes, or 954underscores will be read. 955 956 957\subsubsection{Structure} 958\label{\detokenize{admin/conf_files/krb5_conf:structure}} 959\sphinxAtStartPar 960The krb5.conf file is set up in the style of a Windows INI file. 961Lines beginning with ‘\#’ or ‘;’ (possibly after initial whitespace) 962are ignored as comments. Sections are headed by the section name, in 963square brackets. Each section may contain zero or more relations, of 964the form: 965 966\begin{sphinxVerbatim}[commandchars=\\\{\}] 967\PYG{n}{foo} \PYG{o}{=} \PYG{n}{bar} 968\end{sphinxVerbatim} 969 970\sphinxAtStartPar 971or: 972 973\begin{sphinxVerbatim}[commandchars=\\\{\}] 974\PYG{n}{fubar} \PYG{o}{=} \PYG{p}{\PYGZob{}} 975 \PYG{n}{foo} \PYG{o}{=} \PYG{n}{bar} 976 \PYG{n}{baz} \PYG{o}{=} \PYG{n}{quux} 977\PYG{p}{\PYGZcb{}} 978\end{sphinxVerbatim} 979 980\sphinxAtStartPar 981Placing a ‘*’ after the closing bracket of a section name indicates 982that the section is \sphinxstyleemphasis{final}, meaning that if the same section appears 983within a later file specified in \sphinxstylestrong{KRB5\_CONFIG}, it will be ignored. 984A subsection can be marked as final by placing a ‘*’ after either the 985tag name or the closing brace. 986 987\sphinxAtStartPar 988The krb5.conf file can include other files using either of the 989following directives at the beginning of a line: 990 991\begin{sphinxVerbatim}[commandchars=\\\{\}] 992\PYG{n}{include} \PYG{n}{FILENAME} 993\PYG{n}{includedir} \PYG{n}{DIRNAME} 994\end{sphinxVerbatim} 995 996\sphinxAtStartPar 997\sphinxstyleemphasis{FILENAME} or \sphinxstyleemphasis{DIRNAME} should be an absolute path. The named file or 998directory must exist and be readable. Including a directory includes 999all files within the directory whose names consist solely of 1000alphanumeric characters, dashes, or underscores. Starting in release 10011.15, files with names ending in “.conf” are also included, unless the 1002name begins with “.”. Included profile files are syntactically 1003independent of their parents, so each included file must begin with a 1004section header. Starting in release 1.17, files are read in 1005alphanumeric order; in previous releases, they may be read in any 1006order. 1007 1008\sphinxAtStartPar 1009The krb5.conf file can specify that configuration should be obtained 1010from a loadable module, rather than the file itself, using the 1011following directive at the beginning of a line before any section 1012headers: 1013 1014\begin{sphinxVerbatim}[commandchars=\\\{\}] 1015\PYG{n}{module} \PYG{n}{MODULEPATH}\PYG{p}{:}\PYG{n}{RESIDUAL} 1016\end{sphinxVerbatim} 1017 1018\sphinxAtStartPar 1019\sphinxstyleemphasis{MODULEPATH} may be relative to the library path of the krb5 1020installation, or it may be an absolute path. \sphinxstyleemphasis{RESIDUAL} is provided 1021to the module at initialization time. If krb5.conf uses a module 1022directive, {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} should also use one if it exists. 1023 1024 1025\subsubsection{Sections} 1026\label{\detokenize{admin/conf_files/krb5_conf:sections}} 1027\sphinxAtStartPar 1028The krb5.conf file may contain the following sections: 1029 1030 1031\begin{savenotes}\sphinxattablestart 1032\centering 1033\begin{tabulary}{\linewidth}[t]{|T|T|} 1034\hline 1035 1036\sphinxAtStartPar 1037{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} 1038& 1039\sphinxAtStartPar 1040Settings used by the Kerberos V5 library 1041\\ 1042\hline 1043\sphinxAtStartPar 1044{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} 1045& 1046\sphinxAtStartPar 1047Realm\sphinxhyphen{}specific contact information and settings 1048\\ 1049\hline 1050\sphinxAtStartPar 1051{\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} 1052& 1053\sphinxAtStartPar 1054Maps server hostnames to Kerberos realms 1055\\ 1056\hline 1057\sphinxAtStartPar 1058{\hyperref[\detokenize{admin/conf_files/krb5_conf:capaths}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}capaths{]}}}}} 1059& 1060\sphinxAtStartPar 1061Authentication paths for non\sphinxhyphen{}hierarchical cross\sphinxhyphen{}realm 1062\\ 1063\hline 1064\sphinxAtStartPar 1065{\hyperref[\detokenize{admin/conf_files/krb5_conf:appdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}appdefaults{]}}}}} 1066& 1067\sphinxAtStartPar 1068Settings used by some Kerberos V5 applications 1069\\ 1070\hline 1071\sphinxAtStartPar 1072{\hyperref[\detokenize{admin/conf_files/krb5_conf:plugins}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}plugins{]}}}}} 1073& 1074\sphinxAtStartPar 1075Controls plugin module registration 1076\\ 1077\hline 1078\end{tabulary} 1079\par 1080\sphinxattableend\end{savenotes} 1081 1082\sphinxAtStartPar 1083Additionally, krb5.conf may include any of the relations described in 1084{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, but it is not a recommended practice. 1085 1086 1087\paragraph{{[}libdefaults{]}} 1088\label{\detokenize{admin/conf_files/krb5_conf:libdefaults}}\label{\detokenize{admin/conf_files/krb5_conf:id1}} 1089\sphinxAtStartPar 1090The libdefaults section may contain any of the following relations: 1091\begin{description} 1092\item[{\sphinxstylestrong{allow\_des3}}] \leavevmode 1093\sphinxAtStartPar 1094Permit the KDC to issue tickets with des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 session keys. 1095In future releases, this flag will allow des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 to be used 1096at all. The default value for this tag is false. (Added in 1097release 1.21.) 1098 1099\item[{\sphinxstylestrong{allow\_rc4}}] \leavevmode 1100\sphinxAtStartPar 1101Permit the KDC to issue tickets with arcfour\sphinxhyphen{}hmac session keys. 1102In future releases, this flag will allow arcfour\sphinxhyphen{}hmac to be used 1103at all. The default value for this tag is false. (Added in 1104release 1.21.) 1105 1106\item[{\sphinxstylestrong{allow\_weak\_crypto}}] \leavevmode 1107\sphinxAtStartPar 1108If this flag is set to false, then weak encryption types (as noted 1109in {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}) will be filtered 1110out of the lists \sphinxstylestrong{default\_tgs\_enctypes}, 1111\sphinxstylestrong{default\_tkt\_enctypes}, and \sphinxstylestrong{permitted\_enctypes}. The default 1112value for this tag is false. 1113 1114\item[{\sphinxstylestrong{canonicalize}}] \leavevmode 1115\sphinxAtStartPar 1116If this flag is set to true, initial ticket requests to the KDC 1117will request canonicalization of the client principal name, and 1118answers with different client principals than the requested 1119principal will be accepted. The default value is false. 1120 1121\item[{\sphinxstylestrong{ccache\_type}}] \leavevmode 1122\sphinxAtStartPar 1123This parameter determines the format of credential cache types 1124created by \DUrole{xref,std,std-ref}{kinit(1)} or other programs. The default value 1125is 4, which represents the most current format. Smaller values 1126can be used for compatibility with very old implementations of 1127Kerberos which interact with credential caches on the same host. 1128 1129\item[{\sphinxstylestrong{clockskew}}] \leavevmode 1130\sphinxAtStartPar 1131Sets the maximum allowable amount of clockskew in seconds that the 1132library will tolerate before assuming that a Kerberos message is 1133invalid. The default value is 300 seconds, or five minutes. 1134 1135\sphinxAtStartPar 1136The clockskew setting is also used when evaluating ticket start 1137and expiration times. For example, tickets that have reached 1138their expiration time can still be used (and renewed if they are 1139renewable tickets) if they have been expired for a shorter 1140duration than the \sphinxstylestrong{clockskew} setting. 1141 1142\item[{\sphinxstylestrong{default\_ccache\_name}}] \leavevmode 1143\sphinxAtStartPar 1144This relation specifies the name of the default credential cache. 1145The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCCNAME}}}}. This relation is subject to parameter 1146expansion (see below). New in release 1.11. 1147 1148\item[{\sphinxstylestrong{default\_client\_keytab\_name}}] \leavevmode 1149\sphinxAtStartPar 1150This relation specifies the name of the default keytab for 1151obtaining client credentials. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}}. This 1152relation is subject to parameter expansion (see below). 1153New in release 1.11. 1154 1155\item[{\sphinxstylestrong{default\_keytab\_name}}] \leavevmode 1156\sphinxAtStartPar 1157This relation specifies the default keytab name to be used by 1158application servers such as sshd. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. This 1159relation is subject to parameter expansion (see below). 1160 1161\item[{\sphinxstylestrong{default\_rcache\_name}}] \leavevmode 1162\sphinxAtStartPar 1163This relation specifies the name of the default replay cache. 1164The default is \sphinxcode{\sphinxupquote{dfl:}}. This relation is subject to parameter 1165expansion (see below). New in release 1.18. 1166 1167\item[{\sphinxstylestrong{default\_realm}}] \leavevmode 1168\sphinxAtStartPar 1169Identifies the default Kerberos realm for the client. Set its 1170value to your Kerberos realm. If this value is not set, then a 1171realm must be specified with every Kerberos principal when 1172invoking programs such as \DUrole{xref,std,std-ref}{kinit(1)}. 1173 1174\item[{\sphinxstylestrong{default\_tgs\_enctypes}}] \leavevmode 1175\sphinxAtStartPar 1176Identifies the supported list of session key encryption types that 1177the client should request when making a TGS\sphinxhyphen{}REQ, in order of 1178preference from highest to lowest. The list may be delimited with 1179commas or whitespace. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in 1180{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the accepted values for this tag. 1181Starting in release 1.18, the default value is the value of 1182\sphinxstylestrong{permitted\_enctypes}. For previous releases or if 1183\sphinxstylestrong{permitted\_enctypes} is not set, the default value is 1184\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. 1185 1186\sphinxAtStartPar 1187Do not set this unless required for specific backward 1188compatibility purposes; stale values of this setting can prevent 1189clients from taking advantage of new stronger enctypes when the 1190libraries are upgraded. 1191 1192\item[{\sphinxstylestrong{default\_tkt\_enctypes}}] \leavevmode 1193\sphinxAtStartPar 1194Identifies the supported list of session key encryption types that 1195the client should request when making an AS\sphinxhyphen{}REQ, in order of 1196preference from highest to lowest. The format is the same as for 1197default\_tgs\_enctypes. Starting in release 1.18, the default 1198value is the value of \sphinxstylestrong{permitted\_enctypes}. For previous 1199releases or if \sphinxstylestrong{permitted\_enctypes} is not set, the default 1200value is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. 1201 1202\sphinxAtStartPar 1203Do not set this unless required for specific backward 1204compatibility purposes; stale values of this setting can prevent 1205clients from taking advantage of new stronger enctypes when the 1206libraries are upgraded. 1207 1208\item[{\sphinxstylestrong{dns\_canonicalize\_hostname}}] \leavevmode 1209\sphinxAtStartPar 1210Indicate whether name lookups will be used to canonicalize 1211hostnames for use in service principal names. Setting this flag 1212to false can improve security by reducing reliance on DNS, but 1213means that short hostnames will not be canonicalized to 1214fully\sphinxhyphen{}qualified hostnames. If this option is set to \sphinxcode{\sphinxupquote{fallback}} (new 1215in release 1.18), DNS canonicalization will only be performed the 1216server hostname is not found with the original name when 1217requesting credentials. The default value is true. 1218 1219\item[{\sphinxstylestrong{dns\_lookup\_kdc}}] \leavevmode 1220\sphinxAtStartPar 1221Indicate whether DNS SRV records should be used to locate the KDCs 1222and other servers for a realm, if they are not listed in the 1223krb5.conf information for the realm. (Note that the admin\_server 1224entry must be in the krb5.conf realm information in order to 1225contact kadmind, because the DNS implementation for kadmin is 1226incomplete.) 1227 1228\sphinxAtStartPar 1229Enabling this option does open up a type of denial\sphinxhyphen{}of\sphinxhyphen{}service 1230attack, if someone spoofs the DNS records and redirects you to 1231another server. However, it’s no worse than a denial of service, 1232because that fake KDC will be unable to decode anything you send 1233it (besides the initial ticket request, which has no encrypted 1234data), and anything the fake KDC sends will not be trusted without 1235verification using some secret that it won’t know. 1236 1237\item[{\sphinxstylestrong{dns\_uri\_lookup}}] \leavevmode 1238\sphinxAtStartPar 1239Indicate whether DNS URI records should be used to locate the KDCs 1240and other servers for a realm, if they are not listed in the 1241krb5.conf information for the realm. SRV records are used as a 1242fallback if no URI records were found. The default value is true. 1243New in release 1.15. 1244 1245\item[{\sphinxstylestrong{enforce\_ok\_as\_delegate}}] \leavevmode 1246\sphinxAtStartPar 1247If this flag to true, GSSAPI credential delegation will be 1248disabled when the \sphinxcode{\sphinxupquote{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}} flag is not set in the 1249service ticket. If this flag is false, the \sphinxcode{\sphinxupquote{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}} 1250ticket flag is only enforced when an application specifically 1251requests enforcement. The default value is false. 1252 1253\item[{\sphinxstylestrong{err\_fmt}}] \leavevmode 1254\sphinxAtStartPar 1255This relation allows for custom error message formatting. If a 1256value is set, error messages will be formatted by substituting a 1257normal error message for \%M and an error code for \%C in the value. 1258 1259\item[{\sphinxstylestrong{extra\_addresses}}] \leavevmode 1260\sphinxAtStartPar 1261This allows a computer to use multiple local addresses, in order 1262to allow Kerberos to work in a network that uses NATs while still 1263using address\sphinxhyphen{}restricted tickets. The addresses should be in a 1264comma\sphinxhyphen{}separated list. This option has no effect if 1265\sphinxstylestrong{noaddresses} is true. 1266 1267\item[{\sphinxstylestrong{forwardable}}] \leavevmode 1268\sphinxAtStartPar 1269If this flag is true, initial tickets will be forwardable by 1270default, if allowed by the KDC. The default value is false. 1271 1272\item[{\sphinxstylestrong{ignore\_acceptor\_hostname}}] \leavevmode 1273\sphinxAtStartPar 1274When accepting GSSAPI or krb5 security contexts for host\sphinxhyphen{}based 1275service principals, ignore any hostname passed by the calling 1276application, and allow clients to authenticate to any service 1277principal in the keytab matching the service name and realm name 1278(if given). This option can improve the administrative 1279flexibility of server applications on multihomed hosts, but could 1280compromise the security of virtual hosting environments. The 1281default value is false. New in release 1.10. 1282 1283\item[{\sphinxstylestrong{k5login\_authoritative}}] \leavevmode 1284\sphinxAtStartPar 1285If this flag is true, principals must be listed in a local user’s 1286k5login file to be granted login access, if a \DUrole{xref,std,std-ref}{.k5login(5)} 1287file exists. If this flag is false, a principal may still be 1288granted login access through other mechanisms even if a k5login 1289file exists but does not list the principal. The default value is 1290true. 1291 1292\item[{\sphinxstylestrong{k5login\_directory}}] \leavevmode 1293\sphinxAtStartPar 1294If set, the library will look for a local user’s k5login file 1295within the named directory, with a filename corresponding to the 1296local username. If not set, the library will look for k5login 1297files in the user’s home directory, with the filename .k5login. 1298For security reasons, .k5login files must be owned by 1299the local user or by root. 1300 1301\item[{\sphinxstylestrong{kcm\_mach\_service}}] \leavevmode 1302\sphinxAtStartPar 1303On macOS only, determines the name of the bootstrap service used to 1304contact the KCM daemon for the KCM credential cache type. If the 1305value is \sphinxcode{\sphinxupquote{\sphinxhyphen{}}}, Mach RPC will not be used to contact the KCM 1306daemon. The default value is \sphinxcode{\sphinxupquote{org.h5l.kcm}}. 1307 1308\item[{\sphinxstylestrong{kcm\_socket}}] \leavevmode 1309\sphinxAtStartPar 1310Determines the path to the Unix domain socket used to access the 1311KCM daemon for the KCM credential cache type. If the value is 1312\sphinxcode{\sphinxupquote{\sphinxhyphen{}}}, Unix domain sockets will not be used to contact the KCM 1313daemon. The default value is 1314\sphinxcode{\sphinxupquote{/var/run/.heim\_org.h5l.kcm\sphinxhyphen{}socket}}. 1315 1316\item[{\sphinxstylestrong{kdc\_default\_options}}] \leavevmode 1317\sphinxAtStartPar 1318Default KDC options (Xored for multiple values) when requesting 1319initial tickets. By default it is set to 0x00000010 1320(KDC\_OPT\_RENEWABLE\_OK). 1321 1322\item[{\sphinxstylestrong{kdc\_timesync}}] \leavevmode 1323\sphinxAtStartPar 1324Accepted values for this relation are 1 or 0. If it is nonzero, 1325client machines will compute the difference between their time and 1326the time returned by the KDC in the timestamps in the tickets and 1327use this value to correct for an inaccurate system clock when 1328requesting service tickets or authenticating to services. This 1329corrective factor is only used by the Kerberos library; it is not 1330used to change the system clock. The default value is 1. 1331 1332\item[{\sphinxstylestrong{noaddresses}}] \leavevmode 1333\sphinxAtStartPar 1334If this flag is true, requests for initial tickets will not be 1335made with address restrictions set, allowing the tickets to be 1336used across NATs. The default value is true. 1337 1338\item[{\sphinxstylestrong{permitted\_enctypes}}] \leavevmode 1339\sphinxAtStartPar 1340Identifies the encryption types that servers will permit for 1341session keys and for ticket and authenticator encryption, ordered 1342by preference from highest to lowest. Starting in release 1.18, 1343this tag also acts as the default value for 1344\sphinxstylestrong{default\_tgs\_enctypes} and \sphinxstylestrong{default\_tkt\_enctypes}. The 1345default value for this tag is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}}. 1346 1347\item[{\sphinxstylestrong{plugin\_base\_dir}}] \leavevmode 1348\sphinxAtStartPar 1349If set, determines the base directory where krb5 plugins are 1350located. The default value is the \sphinxcode{\sphinxupquote{krb5/plugins}} subdirectory 1351of the krb5 library directory. This relation is subject to 1352parameter expansion (see below) in release 1.17 and later. 1353 1354\item[{\sphinxstylestrong{preferred\_preauth\_types}}] \leavevmode 1355\sphinxAtStartPar 1356This allows you to set the preferred preauthentication types which 1357the client will attempt before others which may be advertised by a 1358KDC. The default value for this setting is “17, 16, 15, 14”, 1359which forces libkrb5 to attempt to use PKINIT if it is supported. 1360 1361\item[{\sphinxstylestrong{proxiable}}] \leavevmode 1362\sphinxAtStartPar 1363If this flag is true, initial tickets will be proxiable by 1364default, if allowed by the KDC. The default value is false. 1365 1366\item[{\sphinxstylestrong{qualify\_shortname}}] \leavevmode 1367\sphinxAtStartPar 1368If this string is set, it determines the domain suffix for 1369single\sphinxhyphen{}component hostnames when DNS canonicalization is not used 1370(either because \sphinxstylestrong{dns\_canonicalize\_hostname} is false or because 1371forward canonicalization failed). The default value is the first 1372search domain of the system’s DNS configuration. To disable 1373qualification of shortnames, set this relation to the empty string 1374with \sphinxcode{\sphinxupquote{qualify\_shortname = ""}}. (New in release 1.18.) 1375 1376\item[{\sphinxstylestrong{rdns}}] \leavevmode 1377\sphinxAtStartPar 1378If this flag is true, reverse name lookup will be used in addition 1379to forward name lookup to canonicalizing hostnames for use in 1380service principal names. If \sphinxstylestrong{dns\_canonicalize\_hostname} is set 1381to false, this flag has no effect. The default value is true. 1382 1383\item[{\sphinxstylestrong{realm\_try\_domains}}] \leavevmode 1384\sphinxAtStartPar 1385Indicate whether a host’s domain components should be used to 1386determine the Kerberos realm of the host. The value of this 1387variable is an integer: \sphinxhyphen{}1 means not to search, 0 means to try the 1388host’s domain itself, 1 means to also try the domain’s immediate 1389parent, and so forth. The library’s usual mechanism for locating 1390Kerberos realms is used to determine whether a domain is a valid 1391realm, which may involve consulting DNS if \sphinxstylestrong{dns\_lookup\_kdc} is 1392set. The default is not to search domain components. 1393 1394\item[{\sphinxstylestrong{renew\_lifetime}}] \leavevmode 1395\sphinxAtStartPar 1396(\DUrole{xref,std,std-ref}{duration} string.) Sets the default renewable lifetime 1397for initial ticket requests. The default value is 0. 1398 1399\item[{\sphinxstylestrong{spake\_preauth\_groups}}] \leavevmode 1400\sphinxAtStartPar 1401A whitespace or comma\sphinxhyphen{}separated list of words which specifies the 1402groups allowed for SPAKE preauthentication. The possible values 1403are: 1404 1405 1406\begin{savenotes}\sphinxattablestart 1407\centering 1408\begin{tabulary}{\linewidth}[t]{|T|T|} 1409\hline 1410 1411\sphinxAtStartPar 1412edwards25519 1413& 1414\sphinxAtStartPar 1415Edwards25519 curve (\index{RFC@\spxentry{RFC}!RFC 7748@\spxentry{RFC 7748}}\sphinxhref{https://tools.ietf.org/html/rfc7748.html}{\sphinxstylestrong{RFC 7748}}) 1416\\ 1417\hline 1418\sphinxAtStartPar 1419P\sphinxhyphen{}256 1420& 1421\sphinxAtStartPar 1422NIST P\sphinxhyphen{}256 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://tools.ietf.org/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) 1423\\ 1424\hline 1425\sphinxAtStartPar 1426P\sphinxhyphen{}384 1427& 1428\sphinxAtStartPar 1429NIST P\sphinxhyphen{}384 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://tools.ietf.org/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) 1430\\ 1431\hline 1432\sphinxAtStartPar 1433P\sphinxhyphen{}521 1434& 1435\sphinxAtStartPar 1436NIST P\sphinxhyphen{}521 curve (\index{RFC@\spxentry{RFC}!RFC 5480@\spxentry{RFC 5480}}\sphinxhref{https://tools.ietf.org/html/rfc5480.html}{\sphinxstylestrong{RFC 5480}}) 1437\\ 1438\hline 1439\end{tabulary} 1440\par 1441\sphinxattableend\end{savenotes} 1442 1443\sphinxAtStartPar 1444The default value for the client is \sphinxcode{\sphinxupquote{edwards25519}}. The default 1445value for the KDC is empty. New in release 1.17. 1446 1447\item[{\sphinxstylestrong{ticket\_lifetime}}] \leavevmode 1448\sphinxAtStartPar 1449(\DUrole{xref,std,std-ref}{duration} string.) Sets the default lifetime for initial 1450ticket requests. The default value is 1 day. 1451 1452\item[{\sphinxstylestrong{udp\_preference\_limit}}] \leavevmode 1453\sphinxAtStartPar 1454When sending a message to the KDC, the library will try using TCP 1455before UDP if the size of the message is above 1456\sphinxstylestrong{udp\_preference\_limit}. If the message is smaller than 1457\sphinxstylestrong{udp\_preference\_limit}, then UDP will be tried before TCP. 1458Regardless of the size, both protocols will be tried if the first 1459attempt fails. 1460 1461\item[{\sphinxstylestrong{verify\_ap\_req\_nofail}}] \leavevmode 1462\sphinxAtStartPar 1463If this flag is true, then an attempt to verify initial 1464credentials will fail if the client machine does not have a 1465keytab. The default value is false. 1466 1467\item[{\sphinxstylestrong{client\_aware\_channel\_bindings}}] \leavevmode 1468\sphinxAtStartPar 1469If this flag is true, then all application protocol authentication 1470requests will be flagged to indicate that the application supports 1471channel bindings when operating over a secure channel. The 1472default value is false. 1473 1474\end{description} 1475 1476 1477\paragraph{{[}realms{]}} 1478\label{\detokenize{admin/conf_files/krb5_conf:realms}}\label{\detokenize{admin/conf_files/krb5_conf:id2}} 1479\sphinxAtStartPar 1480Each tag in the {[}realms{]} section of the file is the name of a Kerberos 1481realm. The value of the tag is a subsection with relations that 1482define the properties of that particular realm. For each realm, the 1483following tags may be specified in the realm’s subsection: 1484\begin{description} 1485\item[{\sphinxstylestrong{admin\_server}}] \leavevmode 1486\sphinxAtStartPar 1487Identifies the host where the administration server is running. 1488Typically, this is the primary Kerberos server. This tag must be 1489given a value in order to communicate with the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} 1490server for the realm. 1491 1492\item[{\sphinxstylestrong{auth\_to\_local}}] \leavevmode 1493\sphinxAtStartPar 1494This tag allows you to set a general rule for mapping principal 1495names to local user names. It will be used if there is not an 1496explicit mapping for the principal name that is being 1497translated. The possible values are: 1498\begin{description} 1499\item[{\sphinxstylestrong{RULE:}\sphinxstyleemphasis{exp}}] \leavevmode 1500\sphinxAtStartPar 1501The local name will be formulated from \sphinxstyleemphasis{exp}. 1502 1503\sphinxAtStartPar 1504The format for \sphinxstyleemphasis{exp} is \sphinxstylestrong{{[}}\sphinxstyleemphasis{n}\sphinxstylestrong{:}\sphinxstyleemphasis{string}\sphinxstylestrong{{]}(}\sphinxstyleemphasis{regexp}\sphinxstylestrong{)s/}\sphinxstyleemphasis{pattern}\sphinxstylestrong{/}\sphinxstyleemphasis{replacement}\sphinxstylestrong{/g}. 1505The integer \sphinxstyleemphasis{n} indicates how many components the target 1506principal should have. If this matches, then a string will be 1507formed from \sphinxstyleemphasis{string}, substituting the realm of the principal 1508for \sphinxcode{\sphinxupquote{\$0}} and the \sphinxstyleemphasis{n}’th component of the principal for 1509\sphinxcode{\sphinxupquote{\$n}} (e.g., if the principal was \sphinxcode{\sphinxupquote{johndoe/admin}} then 1510\sphinxcode{\sphinxupquote{{[}2:\$2\$1foo{]}}} would result in the string 1511\sphinxcode{\sphinxupquote{adminjohndoefoo}}). If this string matches \sphinxstyleemphasis{regexp}, then 1512the \sphinxcode{\sphinxupquote{s//{[}g{]}}} substitution command will be run over the 1513string. The optional \sphinxstylestrong{g} will cause the substitution to be 1514global over the \sphinxstyleemphasis{string}, instead of replacing only the first 1515match in the \sphinxstyleemphasis{string}. 1516 1517\item[{\sphinxstylestrong{DEFAULT}}] \leavevmode 1518\sphinxAtStartPar 1519The principal name will be used as the local user name. If 1520the principal has more than one component or is not in the 1521default realm, this rule is not applicable and the conversion 1522will fail. 1523 1524\end{description} 1525 1526\sphinxAtStartPar 1527For example: 1528 1529\begin{sphinxVerbatim}[commandchars=\\\{\}] 1530[realms] 1531 ATHENA.MIT.EDU = \PYGZob{} 1532 auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}1](johndoe)s/\PYGZca{}.*\PYGZdl{}/guest/ 1533 auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}1;\PYGZdl{}2](\PYGZca{}.*;admin\PYGZdl{})s/;admin\PYGZdl{}// 1534 auth\PYGZus{}to\PYGZus{}local = RULE:[2:\PYGZdl{}2](\PYGZca{}.*;root)s/\PYGZca{}.*\PYGZdl{}/root/ 1535 auth\PYGZus{}to\PYGZus{}local = DEFAULT 1536 \PYGZcb{} 1537\end{sphinxVerbatim} 1538 1539\sphinxAtStartPar 1540would result in any principal without \sphinxcode{\sphinxupquote{root}} or \sphinxcode{\sphinxupquote{admin}} as the 1541second component to be translated with the default rule. A 1542principal with a second component of \sphinxcode{\sphinxupquote{admin}} will become its 1543first component. \sphinxcode{\sphinxupquote{root}} will be used as the local name for any 1544principal with a second component of \sphinxcode{\sphinxupquote{root}}. The exception to 1545these two rules are any principals \sphinxcode{\sphinxupquote{johndoe/*}}, which will 1546always get the local name \sphinxcode{\sphinxupquote{guest}}. 1547 1548\item[{\sphinxstylestrong{auth\_to\_local\_names}}] \leavevmode 1549\sphinxAtStartPar 1550This subsection allows you to set explicit mappings from principal 1551names to local user names. The tag is the mapping name, and the 1552value is the corresponding local user name. 1553 1554\item[{\sphinxstylestrong{default\_domain}}] \leavevmode 1555\sphinxAtStartPar 1556This tag specifies the domain used to expand hostnames when 1557translating Kerberos 4 service principals to Kerberos 5 principals 1558(for example, when converting \sphinxcode{\sphinxupquote{rcmd.hostname}} to 1559\sphinxcode{\sphinxupquote{host/hostname.domain}}). 1560 1561\item[{\sphinxstylestrong{disable\_encrypted\_timestamp}}] \leavevmode 1562\sphinxAtStartPar 1563If this flag is true, the client will not perform encrypted 1564timestamp preauthentication if requested by the KDC. Setting this 1565flag can help to prevent dictionary attacks by active attackers, 1566if the realm’s KDCs support SPAKE preauthentication or if initial 1567authentication always uses another mechanism or always uses FAST. 1568This flag persists across client referrals during initial 1569authentication. This flag does not prevent the KDC from offering 1570encrypted timestamp. New in release 1.17. 1571 1572\item[{\sphinxstylestrong{http\_anchors}}] \leavevmode 1573\sphinxAtStartPar 1574When KDCs and kpasswd servers are accessed through HTTPS proxies, this tag 1575can be used to specify the location of the CA certificate which should be 1576trusted to issue the certificate for a proxy server. If left unspecified, 1577the system\sphinxhyphen{}wide default set of CA certificates is used. 1578 1579\sphinxAtStartPar 1580The syntax for values is similar to that of values for the 1581\sphinxstylestrong{pkinit\_anchors} tag: 1582 1583\sphinxAtStartPar 1584\sphinxstylestrong{FILE:} \sphinxstyleemphasis{filename} 1585 1586\sphinxAtStartPar 1587\sphinxstyleemphasis{filename} is assumed to be the name of an OpenSSL\sphinxhyphen{}style ca\sphinxhyphen{}bundle file. 1588 1589\sphinxAtStartPar 1590\sphinxstylestrong{DIR:} \sphinxstyleemphasis{dirname} 1591 1592\sphinxAtStartPar 1593\sphinxstyleemphasis{dirname} is assumed to be an directory which contains CA certificates. 1594All files in the directory will be examined; if they contain certificates 1595(in PEM format), they will be used. 1596 1597\sphinxAtStartPar 1598\sphinxstylestrong{ENV:} \sphinxstyleemphasis{envvar} 1599 1600\sphinxAtStartPar 1601\sphinxstyleemphasis{envvar} specifies the name of an environment variable which has been set 1602to a value conforming to one of the previous values. For example, 1603\sphinxcode{\sphinxupquote{ENV:X509\_PROXY\_CA}}, where environment variable \sphinxcode{\sphinxupquote{X509\_PROXY\_CA}} has 1604been set to \sphinxcode{\sphinxupquote{FILE:/tmp/my\_proxy.pem}}. 1605 1606\item[{\sphinxstylestrong{kdc}}] \leavevmode 1607\sphinxAtStartPar 1608The name or address of a host running a KDC for that realm. An 1609optional port number, separated from the hostname by a colon, may 1610be included. If the name or address contains colons (for example, 1611if it is an IPv6 address), enclose it in square brackets to 1612distinguish the colon from a port separator. For your computer to 1613be able to communicate with the KDC for each realm, this tag must 1614be given a value in each realm subsection in the configuration 1615file, or there must be DNS SRV records specifying the KDCs. 1616 1617\item[{\sphinxstylestrong{kpasswd\_server}}] \leavevmode 1618\sphinxAtStartPar 1619Points to the server where all the password changes are performed. 1620If there is no such entry, DNS will be queried (unless forbidden 1621by \sphinxstylestrong{dns\_lookup\_kdc}). Finally, port 464 on the \sphinxstylestrong{admin\_server} 1622host will be tried. 1623 1624\item[{\sphinxstylestrong{master\_kdc}}] \leavevmode 1625\sphinxAtStartPar 1626The name for \sphinxstylestrong{primary\_kdc} prior to release 1.19. Its value is 1627used as a fallback if \sphinxstylestrong{primary\_kdc} is not specified. 1628 1629\item[{\sphinxstylestrong{primary\_kdc}}] \leavevmode 1630\sphinxAtStartPar 1631Identifies the primary KDC(s). Currently, this tag is used in only 1632one case: If an attempt to get credentials fails because of an 1633invalid password, the client software will attempt to contact the 1634primary KDC, in case the user’s password has just been changed, and 1635the updated database has not been propagated to the replica 1636servers yet. New in release 1.19. 1637 1638\item[{\sphinxstylestrong{v4\_instance\_convert}}] \leavevmode 1639\sphinxAtStartPar 1640This subsection allows the administrator to configure exceptions 1641to the \sphinxstylestrong{default\_domain} mapping rule. It contains V4 instances 1642(the tag name) which should be translated to some specific 1643hostname (the tag value) as the second component in a Kerberos V5 1644principal name. 1645 1646\item[{\sphinxstylestrong{v4\_realm}}] \leavevmode 1647\sphinxAtStartPar 1648This relation is used by the krb524 library routines when 1649converting a V5 principal name to a V4 principal name. It is used 1650when the V4 realm name and the V5 realm name are not the same, but 1651still share the same principal names and passwords. The tag value 1652is the Kerberos V4 realm name. 1653 1654\end{description} 1655 1656 1657\paragraph{{[}domain\_realm{]}} 1658\label{\detokenize{admin/conf_files/krb5_conf:domain-realm}}\label{\detokenize{admin/conf_files/krb5_conf:id3}} 1659\sphinxAtStartPar 1660The {[}domain\_realm{]} section provides a translation from hostnames to 1661Kerberos realms. Each tag is a domain name, providing the mapping for 1662that domain and all subdomains. If the tag begins with a period 1663(\sphinxcode{\sphinxupquote{.}}) then it applies only to subdomains. The Kerberos realm may be 1664identified either in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{realms}}} section or using DNS SRV records. 1665Tag names should be in lower case. For example: 1666 1667\begin{sphinxVerbatim}[commandchars=\\\{\}] 1668\PYG{p}{[}\PYG{n}{domain\PYGZus{}realm}\PYG{p}{]} 1669 \PYG{n}{crash}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 1670 \PYG{o}{.}\PYG{n}{dev}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 1671 \PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 1672\end{sphinxVerbatim} 1673 1674\sphinxAtStartPar 1675maps the host with the name \sphinxcode{\sphinxupquote{crash.mit.edu}} into the 1676\sphinxcode{\sphinxupquote{TEST.ATHENA.MIT.EDU}} realm. The second entry maps all hosts under the 1677domain \sphinxcode{\sphinxupquote{dev.mit.edu}} into the \sphinxcode{\sphinxupquote{TEST.ATHENA.MIT.EDU}} realm, but not 1678the host with the name \sphinxcode{\sphinxupquote{dev.mit.edu}}. That host is matched 1679by the third entry, which maps the host \sphinxcode{\sphinxupquote{mit.edu}} and all hosts 1680under the domain \sphinxcode{\sphinxupquote{mit.edu}} that do not match a preceding rule 1681into the realm \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}}. 1682 1683\sphinxAtStartPar 1684If no translation entry applies to a hostname used for a service 1685principal for a service ticket request, the library will try to get a 1686referral to the appropriate realm from the client realm’s KDC. If 1687that does not succeed, the host’s realm is considered to be the 1688hostname’s domain portion converted to uppercase, unless the 1689\sphinxstylestrong{realm\_try\_domains} setting in {[}libdefaults{]} causes a different 1690parent domain to be used. 1691 1692 1693\paragraph{{[}capaths{]}} 1694\label{\detokenize{admin/conf_files/krb5_conf:capaths}}\label{\detokenize{admin/conf_files/krb5_conf:id4}} 1695\sphinxAtStartPar 1696In order to perform direct (non\sphinxhyphen{}hierarchical) cross\sphinxhyphen{}realm 1697authentication, configuration is needed to determine the 1698authentication paths between realms. 1699 1700\sphinxAtStartPar 1701A client will use this section to find the authentication path between 1702its realm and the realm of the server. The server will use this 1703section to verify the authentication path used by the client, by 1704checking the transited field of the received ticket. 1705 1706\sphinxAtStartPar 1707There is a tag for each participating client realm, and each tag has 1708subtags for each of the server realms. The value of the subtags is an 1709intermediate realm which may participate in the cross\sphinxhyphen{}realm 1710authentication. The subtags may be repeated if there is more then one 1711intermediate realm. A value of “.” means that the two realms share 1712keys directly, and no intermediate realms should be allowed to 1713participate. 1714 1715\sphinxAtStartPar 1716Only those entries which will be needed on the client or the server 1717need to be present. A client needs a tag for its local realm with 1718subtags for all the realms of servers it will need to authenticate to. 1719A server needs a tag for each realm of the clients it will serve, with 1720a subtag of the server realm. 1721 1722\sphinxAtStartPar 1723For example, \sphinxcode{\sphinxupquote{ANL.GOV}}, \sphinxcode{\sphinxupquote{PNL.GOV}}, and \sphinxcode{\sphinxupquote{NERSC.GOV}} all wish to 1724use the \sphinxcode{\sphinxupquote{ES.NET}} realm as an intermediate realm. ANL has a sub 1725realm of \sphinxcode{\sphinxupquote{TEST.ANL.GOV}} which will authenticate with \sphinxcode{\sphinxupquote{NERSC.GOV}} 1726but not \sphinxcode{\sphinxupquote{PNL.GOV}}. The {[}capaths{]} section for \sphinxcode{\sphinxupquote{ANL.GOV}} systems 1727would look like this: 1728 1729\begin{sphinxVerbatim}[commandchars=\\\{\}] 1730\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} 1731 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1732 \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} 1733 \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1734 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1735 \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{o}{.} 1736 \PYG{p}{\PYGZcb{}} 1737 \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1738 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} 1739 \PYG{p}{\PYGZcb{}} 1740 \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1741 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1742 \PYG{p}{\PYGZcb{}} 1743 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1744 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1745 \PYG{p}{\PYGZcb{}} 1746 \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1747 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} 1748 \PYG{p}{\PYGZcb{}} 1749\end{sphinxVerbatim} 1750 1751\sphinxAtStartPar 1752The {[}capaths{]} section of the configuration file used on \sphinxcode{\sphinxupquote{NERSC.GOV}} 1753systems would look like this: 1754 1755\begin{sphinxVerbatim}[commandchars=\\\{\}] 1756\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} 1757 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1758 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1759 \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1760 \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} 1761 \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1762 \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{o}{.} 1763 \PYG{p}{\PYGZcb{}} 1764 \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1765 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1766 \PYG{p}{\PYGZcb{}} 1767 \PYG{n}{PNL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1768 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1769 \PYG{p}{\PYGZcb{}} 1770 \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1771 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{o}{.} 1772 \PYG{p}{\PYGZcb{}} 1773 \PYG{n}{TEST}\PYG{o}{.}\PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1774 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ANL}\PYG{o}{.}\PYG{n}{GOV} 1775 \PYG{n}{NERSC}\PYG{o}{.}\PYG{n}{GOV} \PYG{o}{=} \PYG{n}{ES}\PYG{o}{.}\PYG{n}{NET} 1776 \PYG{p}{\PYGZcb{}} 1777\end{sphinxVerbatim} 1778 1779\sphinxAtStartPar 1780When a subtag is used more than once within a tag, clients will use 1781the order of values to determine the path. The order of values is not 1782important to servers. 1783 1784 1785\paragraph{{[}appdefaults{]}} 1786\label{\detokenize{admin/conf_files/krb5_conf:appdefaults}}\label{\detokenize{admin/conf_files/krb5_conf:id5}} 1787\sphinxAtStartPar 1788Each tag in the {[}appdefaults{]} section names a Kerberos V5 application 1789or an option that is used by some Kerberos V5 application{[}s{]}. The 1790value of the tag defines the default behaviors for that application. 1791 1792\sphinxAtStartPar 1793For example: 1794 1795\begin{sphinxVerbatim}[commandchars=\\\{\}] 1796\PYG{p}{[}\PYG{n}{appdefaults}\PYG{p}{]} 1797 \PYG{n}{telnet} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1798 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1799 \PYG{n}{option1} \PYG{o}{=} \PYG{n}{false} 1800 \PYG{p}{\PYGZcb{}} 1801 \PYG{p}{\PYGZcb{}} 1802 \PYG{n}{telnet} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1803 \PYG{n}{option1} \PYG{o}{=} \PYG{n}{true} 1804 \PYG{n}{option2} \PYG{o}{=} \PYG{n}{true} 1805 \PYG{p}{\PYGZcb{}} 1806 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 1807 \PYG{n}{option2} \PYG{o}{=} \PYG{n}{false} 1808 \PYG{p}{\PYGZcb{}} 1809 \PYG{n}{option2} \PYG{o}{=} \PYG{n}{true} 1810\end{sphinxVerbatim} 1811 1812\sphinxAtStartPar 1813The above four ways of specifying the value of an option are shown in 1814order of decreasing precedence. In this example, if telnet is running 1815in the realm EXAMPLE.COM, it should, by default, have option1 and 1816option2 set to true. However, a telnet program in the realm 1817\sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} should have \sphinxcode{\sphinxupquote{option1}} set to false and 1818\sphinxcode{\sphinxupquote{option2}} set to true. Any other programs in ATHENA.MIT.EDU should 1819have \sphinxcode{\sphinxupquote{option2}} set to false by default. Any programs running in 1820other realms should have \sphinxcode{\sphinxupquote{option2}} set to true. 1821 1822\sphinxAtStartPar 1823The list of specifiable options for each application may be found in 1824that application’s man pages. The application defaults specified here 1825are overridden by those specified in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{realms}}} section. 1826 1827 1828\paragraph{{[}plugins{]}} 1829\label{\detokenize{admin/conf_files/krb5_conf:plugins}}\label{\detokenize{admin/conf_files/krb5_conf:id6}}\begin{itemize} 1830\item {} 1831\sphinxAtStartPar 1832{\hyperref[\detokenize{admin/conf_files/krb5_conf:pwqual}]{\sphinxcrossref{pwqual}}} interface 1833 1834\item {} 1835\sphinxAtStartPar 1836{\hyperref[\detokenize{admin/conf_files/krb5_conf:kadm5-hook}]{\sphinxcrossref{kadm5\_hook}}} interface 1837 1838\item {} 1839\sphinxAtStartPar 1840{\hyperref[\detokenize{admin/conf_files/krb5_conf:clpreauth}]{\sphinxcrossref{clpreauth}}} and {\hyperref[\detokenize{admin/conf_files/krb5_conf:kdcpreauth}]{\sphinxcrossref{kdcpreauth}}} interfaces 1841 1842\end{itemize} 1843 1844\sphinxAtStartPar 1845Tags in the {[}plugins{]} section can be used to register dynamic plugin 1846modules and to turn modules on and off. Not every krb5 pluggable 1847interface uses the {[}plugins{]} section; the ones that do are documented 1848here. 1849 1850\sphinxAtStartPar 1851New in release 1.9. 1852 1853\sphinxAtStartPar 1854Each pluggable interface corresponds to a subsection of {[}plugins{]}. 1855All subsections support the same tags: 1856\begin{description} 1857\item[{\sphinxstylestrong{disable}}] \leavevmode 1858\sphinxAtStartPar 1859This tag may have multiple values. If there are values for this 1860tag, then the named modules will be disabled for the pluggable 1861interface. 1862 1863\item[{\sphinxstylestrong{enable\_only}}] \leavevmode 1864\sphinxAtStartPar 1865This tag may have multiple values. If there are values for this 1866tag, then only the named modules will be enabled for the pluggable 1867interface. 1868 1869\item[{\sphinxstylestrong{module}}] \leavevmode 1870\sphinxAtStartPar 1871This tag may have multiple values. Each value is a string of the 1872form \sphinxcode{\sphinxupquote{modulename:pathname}}, which causes the shared object 1873located at \sphinxstyleemphasis{pathname} to be registered as a dynamic module named 1874\sphinxstyleemphasis{modulename} for the pluggable interface. If \sphinxstyleemphasis{pathname} is not an 1875absolute path, it will be treated as relative to the 1876\sphinxstylestrong{plugin\_base\_dir} value from {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. 1877 1878\end{description} 1879 1880\sphinxAtStartPar 1881For pluggable interfaces where module order matters, modules 1882registered with a \sphinxstylestrong{module} tag normally come first, in the order 1883they are registered, followed by built\sphinxhyphen{}in modules in the order they 1884are documented below. If \sphinxstylestrong{enable\_only} tags are used, then the 1885order of those tags overrides the normal module order. 1886 1887\sphinxAtStartPar 1888The following subsections are currently supported within the {[}plugins{]} 1889section: 1890 1891 1892\subparagraph{ccselect interface} 1893\label{\detokenize{admin/conf_files/krb5_conf:ccselect-interface}}\label{\detokenize{admin/conf_files/krb5_conf:ccselect}} 1894\sphinxAtStartPar 1895The ccselect subsection controls modules for credential cache 1896selection within a cache collection. In addition to any registered 1897dynamic modules, the following built\sphinxhyphen{}in modules exist (and may be 1898disabled with the disable tag): 1899\begin{description} 1900\item[{\sphinxstylestrong{k5identity}}] \leavevmode 1901\sphinxAtStartPar 1902Uses a .k5identity file in the user’s home directory to select a 1903client principal 1904 1905\item[{\sphinxstylestrong{realm}}] \leavevmode 1906\sphinxAtStartPar 1907Uses the service realm to guess an appropriate cache from the 1908collection 1909 1910\item[{\sphinxstylestrong{hostname}}] \leavevmode 1911\sphinxAtStartPar 1912If the service principal is host\sphinxhyphen{}based, uses the service hostname 1913to guess an appropriate cache from the collection 1914 1915\end{description} 1916 1917 1918\subparagraph{pwqual interface} 1919\label{\detokenize{admin/conf_files/krb5_conf:pwqual-interface}}\label{\detokenize{admin/conf_files/krb5_conf:pwqual}} 1920\sphinxAtStartPar 1921The pwqual subsection controls modules for the password quality 1922interface, which is used to reject weak passwords when passwords are 1923changed. The following built\sphinxhyphen{}in modules exist for this interface: 1924\begin{description} 1925\item[{\sphinxstylestrong{dict}}] \leavevmode 1926\sphinxAtStartPar 1927Checks against the realm dictionary file 1928 1929\item[{\sphinxstylestrong{empty}}] \leavevmode 1930\sphinxAtStartPar 1931Rejects empty passwords 1932 1933\item[{\sphinxstylestrong{hesiod}}] \leavevmode 1934\sphinxAtStartPar 1935Checks against user information stored in Hesiod (only if Kerberos 1936was built with Hesiod support) 1937 1938\item[{\sphinxstylestrong{princ}}] \leavevmode 1939\sphinxAtStartPar 1940Checks against components of the principal name 1941 1942\end{description} 1943 1944 1945\subparagraph{kadm5\_hook interface} 1946\label{\detokenize{admin/conf_files/krb5_conf:kadm5-hook-interface}}\label{\detokenize{admin/conf_files/krb5_conf:kadm5-hook}} 1947\sphinxAtStartPar 1948The kadm5\_hook interface provides plugins with information on 1949principal creation, modification, password changes and deletion. This 1950interface can be used to write a plugin to synchronize MIT Kerberos 1951with another database such as Active Directory. No plugins are built 1952in for this interface. 1953 1954 1955\subparagraph{kadm5\_auth interface} 1956\label{\detokenize{admin/conf_files/krb5_conf:kadm5-auth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:kadm5-auth}} 1957\sphinxAtStartPar 1958The kadm5\_auth section (introduced in release 1.16) controls modules 1959for the kadmin authorization interface, which determines whether a 1960client principal is allowed to perform a kadmin operation. The 1961following built\sphinxhyphen{}in modules exist for this interface: 1962\begin{description} 1963\item[{\sphinxstylestrong{acl}}] \leavevmode 1964\sphinxAtStartPar 1965This module reads the {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} file, and authorizes 1966operations which are allowed according to the rules in the file. 1967 1968\item[{\sphinxstylestrong{self}}] \leavevmode 1969\sphinxAtStartPar 1970This module authorizes self\sphinxhyphen{}service operations including password 1971changes, creation of new random keys, fetching the client’s 1972principal record or string attributes, and fetching the policy 1973record associated with the client principal. 1974 1975\end{description} 1976 1977 1978\subparagraph{clpreauth and kdcpreauth interfaces} 1979\label{\detokenize{admin/conf_files/krb5_conf:clpreauth-and-kdcpreauth-interfaces}}\label{\detokenize{admin/conf_files/krb5_conf:kdcpreauth}}\label{\detokenize{admin/conf_files/krb5_conf:clpreauth}} 1980\sphinxAtStartPar 1981The clpreauth and kdcpreauth interfaces allow plugin modules to 1982provide client and KDC preauthentication mechanisms. The following 1983built\sphinxhyphen{}in modules exist for these interfaces: 1984\begin{description} 1985\item[{\sphinxstylestrong{pkinit}}] \leavevmode 1986\sphinxAtStartPar 1987This module implements the PKINIT preauthentication mechanism. 1988 1989\item[{\sphinxstylestrong{encrypted\_challenge}}] \leavevmode 1990\sphinxAtStartPar 1991This module implements the encrypted challenge FAST factor. 1992 1993\item[{\sphinxstylestrong{encrypted\_timestamp}}] \leavevmode 1994\sphinxAtStartPar 1995This module implements the encrypted timestamp mechanism. 1996 1997\end{description} 1998 1999 2000\subparagraph{hostrealm interface} 2001\label{\detokenize{admin/conf_files/krb5_conf:hostrealm-interface}}\label{\detokenize{admin/conf_files/krb5_conf:hostrealm}} 2002\sphinxAtStartPar 2003The hostrealm section (introduced in release 1.12) controls modules 2004for the host\sphinxhyphen{}to\sphinxhyphen{}realm interface, which affects the local mapping of 2005hostnames to realm names and the choice of default realm. The following 2006built\sphinxhyphen{}in modules exist for this interface: 2007\begin{description} 2008\item[{\sphinxstylestrong{profile}}] \leavevmode 2009\sphinxAtStartPar 2010This module consults the {[}domain\_realm{]} section of the profile for 2011authoritative host\sphinxhyphen{}to\sphinxhyphen{}realm mappings, and the \sphinxstylestrong{default\_realm} 2012variable for the default realm. 2013 2014\item[{\sphinxstylestrong{dns}}] \leavevmode 2015\sphinxAtStartPar 2016This module looks for DNS records for fallback host\sphinxhyphen{}to\sphinxhyphen{}realm 2017mappings and the default realm. It only operates if the 2018\sphinxstylestrong{dns\_lookup\_realm} variable is set to true. 2019 2020\item[{\sphinxstylestrong{domain}}] \leavevmode 2021\sphinxAtStartPar 2022This module applies heuristics for fallback host\sphinxhyphen{}to\sphinxhyphen{}realm 2023mappings. It implements the \sphinxstylestrong{realm\_try\_domains} variable, and 2024uses the uppercased parent domain of the hostname if that does not 2025produce a result. 2026 2027\end{description} 2028 2029 2030\subparagraph{localauth interface} 2031\label{\detokenize{admin/conf_files/krb5_conf:localauth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:localauth}} 2032\sphinxAtStartPar 2033The localauth section (introduced in release 1.12) controls modules 2034for the local authorization interface, which affects the relationship 2035between Kerberos principals and local system accounts. The following 2036built\sphinxhyphen{}in modules exist for this interface: 2037\begin{description} 2038\item[{\sphinxstylestrong{default}}] \leavevmode 2039\sphinxAtStartPar 2040This module implements the \sphinxstylestrong{DEFAULT} type for \sphinxstylestrong{auth\_to\_local} 2041values. 2042 2043\item[{\sphinxstylestrong{rule}}] \leavevmode 2044\sphinxAtStartPar 2045This module implements the \sphinxstylestrong{RULE} type for \sphinxstylestrong{auth\_to\_local} 2046values. 2047 2048\item[{\sphinxstylestrong{names}}] \leavevmode 2049\sphinxAtStartPar 2050This module looks for an \sphinxstylestrong{auth\_to\_local\_names} mapping for the 2051principal name. 2052 2053\item[{\sphinxstylestrong{auth\_to\_local}}] \leavevmode 2054\sphinxAtStartPar 2055This module processes \sphinxstylestrong{auth\_to\_local} values in the default 2056realm’s section, and applies the default method if no 2057\sphinxstylestrong{auth\_to\_local} values exist. 2058 2059\item[{\sphinxstylestrong{k5login}}] \leavevmode 2060\sphinxAtStartPar 2061This module authorizes a principal to a local account according to 2062the account’s \DUrole{xref,std,std-ref}{.k5login(5)} file. 2063 2064\item[{\sphinxstylestrong{an2ln}}] \leavevmode 2065\sphinxAtStartPar 2066This module authorizes a principal to a local account if the 2067principal name maps to the local account name. 2068 2069\end{description} 2070 2071 2072\subparagraph{certauth interface} 2073\label{\detokenize{admin/conf_files/krb5_conf:certauth-interface}}\label{\detokenize{admin/conf_files/krb5_conf:certauth}} 2074\sphinxAtStartPar 2075The certauth section (introduced in release 1.16) controls modules for 2076the certificate authorization interface, which determines whether a 2077certificate is allowed to preauthenticate a user via PKINIT. The 2078following built\sphinxhyphen{}in modules exist for this interface: 2079\begin{description} 2080\item[{\sphinxstylestrong{pkinit\_san}}] \leavevmode 2081\sphinxAtStartPar 2082This module authorizes the certificate if it contains a PKINIT 2083Subject Alternative Name for the requested client principal, or a 2084Microsoft UPN SAN matching the principal if \sphinxstylestrong{pkinit\_allow\_upn} 2085is set to true for the realm. 2086 2087\item[{\sphinxstylestrong{pkinit\_eku}}] \leavevmode 2088\sphinxAtStartPar 2089This module rejects the certificate if it does not contain an 2090Extended Key Usage attribute consistent with the 2091\sphinxstylestrong{pkinit\_eku\_checking} value for the realm. 2092 2093\item[{\sphinxstylestrong{dbmatch}}] \leavevmode 2094\sphinxAtStartPar 2095This module authorizes or rejects the certificate according to 2096whether it matches the \sphinxstylestrong{pkinit\_cert\_match} string attribute on 2097the client principal, if that attribute is present. 2098 2099\end{description} 2100 2101 2102\subsubsection{PKINIT options} 2103\label{\detokenize{admin/conf_files/krb5_conf:pkinit-options}} 2104\begin{sphinxadmonition}{note}{Note:} 2105\sphinxAtStartPar 2106The following are PKINIT\sphinxhyphen{}specific options. These values may 2107be specified in {[}libdefaults{]} as global defaults, or within 2108a realm\sphinxhyphen{}specific subsection of {[}libdefaults{]}, or may be 2109specified as realm\sphinxhyphen{}specific values in the {[}realms{]} section. 2110A realm\sphinxhyphen{}specific value overrides, not adds to, a generic 2111{[}libdefaults{]} specification. The search order is: 2112\end{sphinxadmonition} 2113\begin{enumerate} 2114\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 2115\item {} 2116\sphinxAtStartPar 2117realm\sphinxhyphen{}specific subsection of {[}libdefaults{]}: 2118 2119\begin{sphinxVerbatim}[commandchars=\\\{\}] 2120\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 2121 \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2122 \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{o}{.}\PYG{n}{crt} 2123 \PYG{p}{\PYGZcb{}} 2124\end{sphinxVerbatim} 2125 2126\item {} 2127\sphinxAtStartPar 2128realm\sphinxhyphen{}specific value in the {[}realms{]} section: 2129 2130\begin{sphinxVerbatim}[commandchars=\\\{\}] 2131\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 2132 \PYG{n}{OTHERREALM}\PYG{o}{.}\PYG{n}{ORG} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2133 \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{otherrealm}\PYG{o}{.}\PYG{n}{org}\PYG{o}{.}\PYG{n}{crt} 2134 \PYG{p}{\PYGZcb{}} 2135\end{sphinxVerbatim} 2136 2137\item {} 2138\sphinxAtStartPar 2139generic value in the {[}libdefaults{]} section: 2140 2141\begin{sphinxVerbatim}[commandchars=\\\{\}] 2142\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 2143 \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{generic\PYGZus{}trusted\PYGZus{}cas}\PYG{o}{/} 2144\end{sphinxVerbatim} 2145 2146\end{enumerate} 2147 2148 2149\paragraph{Specifying PKINIT identity information} 2150\label{\detokenize{admin/conf_files/krb5_conf:specifying-pkinit-identity-information}}\label{\detokenize{admin/conf_files/krb5_conf:pkinit-identity}} 2151\sphinxAtStartPar 2152The syntax for specifying Public Key identity, trust, and revocation 2153information for PKINIT is as follows: 2154\begin{description} 2155\item[{\sphinxstylestrong{FILE:}\sphinxstyleemphasis{filename}{[}\sphinxstylestrong{,}\sphinxstyleemphasis{keyfilename}{]}}] \leavevmode 2156\sphinxAtStartPar 2157This option has context\sphinxhyphen{}specific behavior. 2158 2159\sphinxAtStartPar 2160In \sphinxstylestrong{pkinit\_identity} or \sphinxstylestrong{pkinit\_identities}, \sphinxstyleemphasis{filename} 2161specifies the name of a PEM\sphinxhyphen{}format file containing the user’s 2162certificate. If \sphinxstyleemphasis{keyfilename} is not specified, the user’s 2163private key is expected to be in \sphinxstyleemphasis{filename} as well. Otherwise, 2164\sphinxstyleemphasis{keyfilename} is the name of the file containing the private key. 2165 2166\sphinxAtStartPar 2167In \sphinxstylestrong{pkinit\_anchors} or \sphinxstylestrong{pkinit\_pool}, \sphinxstyleemphasis{filename} is assumed to 2168be the name of an OpenSSL\sphinxhyphen{}style ca\sphinxhyphen{}bundle file. 2169 2170\item[{\sphinxstylestrong{DIR:}\sphinxstyleemphasis{dirname}}] \leavevmode 2171\sphinxAtStartPar 2172This option has context\sphinxhyphen{}specific behavior. 2173 2174\sphinxAtStartPar 2175In \sphinxstylestrong{pkinit\_identity} or \sphinxstylestrong{pkinit\_identities}, \sphinxstyleemphasis{dirname} 2176specifies a directory with files named \sphinxcode{\sphinxupquote{*.crt}} and \sphinxcode{\sphinxupquote{*.key}} 2177where the first part of the file name is the same for matching 2178pairs of certificate and private key files. When a file with a 2179name ending with \sphinxcode{\sphinxupquote{.crt}} is found, a matching file ending with 2180\sphinxcode{\sphinxupquote{.key}} is assumed to contain the private key. If no such file 2181is found, then the certificate in the \sphinxcode{\sphinxupquote{.crt}} is not used. 2182 2183\sphinxAtStartPar 2184In \sphinxstylestrong{pkinit\_anchors} or \sphinxstylestrong{pkinit\_pool}, \sphinxstyleemphasis{dirname} is assumed to 2185be an OpenSSL\sphinxhyphen{}style hashed CA directory where each CA cert is 2186stored in a file named \sphinxcode{\sphinxupquote{hash\sphinxhyphen{}of\sphinxhyphen{}ca\sphinxhyphen{}cert.\#}}. This infrastructure 2187is encouraged, but all files in the directory will be examined and 2188if they contain certificates (in PEM format), they will be used. 2189 2190\sphinxAtStartPar 2191In \sphinxstylestrong{pkinit\_revoke}, \sphinxstyleemphasis{dirname} is assumed to be an OpenSSL\sphinxhyphen{}style 2192hashed CA directory where each revocation list is stored in a file 2193named \sphinxcode{\sphinxupquote{hash\sphinxhyphen{}of\sphinxhyphen{}ca\sphinxhyphen{}cert.r\#}}. This infrastructure is encouraged, 2194but all files in the directory will be examined and if they 2195contain a revocation list (in PEM format), they will be used. 2196 2197\item[{\sphinxstylestrong{PKCS12:}\sphinxstyleemphasis{filename}}] \leavevmode 2198\sphinxAtStartPar 2199\sphinxstyleemphasis{filename} is the name of a PKCS \#12 format file, containing the 2200user’s certificate and private key. 2201 2202\item[{\sphinxstylestrong{PKCS11:}{[}\sphinxstylestrong{module\_name=}{]}\sphinxstyleemphasis{modname}{[}\sphinxstylestrong{:slotid=}\sphinxstyleemphasis{slot\sphinxhyphen{}id}{]}{[}\sphinxstylestrong{:token=}\sphinxstyleemphasis{token\sphinxhyphen{}label}{]}{[}\sphinxstylestrong{:certid=}\sphinxstyleemphasis{cert\sphinxhyphen{}id}{]}{[}\sphinxstylestrong{:certlabel=}\sphinxstyleemphasis{cert\sphinxhyphen{}label}{]}}] \leavevmode 2203\sphinxAtStartPar 2204All keyword/values are optional. \sphinxstyleemphasis{modname} specifies the location 2205of a library implementing PKCS \#11. If a value is encountered 2206with no keyword, it is assumed to be the \sphinxstyleemphasis{modname}. If no 2207module\sphinxhyphen{}name is specified, the default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{PKCS11\_MODNAME}}}}. 2208\sphinxcode{\sphinxupquote{slotid=}} and/or \sphinxcode{\sphinxupquote{token=}} may be specified to force the use of 2209a particular smard card reader or token if there is more than one 2210available. \sphinxcode{\sphinxupquote{certid=}} and/or \sphinxcode{\sphinxupquote{certlabel=}} may be specified to 2211force the selection of a particular certificate on the device. 2212See the \sphinxstylestrong{pkinit\_cert\_match} configuration option for more ways 2213to select a particular certificate to use for PKINIT. 2214 2215\item[{\sphinxstylestrong{ENV:}\sphinxstyleemphasis{envvar}}] \leavevmode 2216\sphinxAtStartPar 2217\sphinxstyleemphasis{envvar} specifies the name of an environment variable which has 2218been set to a value conforming to one of the previous values. For 2219example, \sphinxcode{\sphinxupquote{ENV:X509\_PROXY}}, where environment variable 2220\sphinxcode{\sphinxupquote{X509\_PROXY}} has been set to \sphinxcode{\sphinxupquote{FILE:/tmp/my\_proxy.pem}}. 2221 2222\end{description} 2223 2224 2225\paragraph{PKINIT krb5.conf options} 2226\label{\detokenize{admin/conf_files/krb5_conf:pkinit-krb5-conf-options}}\begin{description} 2227\item[{\sphinxstylestrong{pkinit\_anchors}}] \leavevmode 2228\sphinxAtStartPar 2229Specifies the location of trusted anchor (root) certificates which 2230the client trusts to sign KDC certificates. This option may be 2231specified multiple times. These values from the config file are 2232not used if the user specifies X509\_anchors on the command line. 2233 2234\item[{\sphinxstylestrong{pkinit\_cert\_match}}] \leavevmode 2235\sphinxAtStartPar 2236Specifies matching rules that the client certificate must match 2237before it is used to attempt PKINIT authentication. If a user has 2238multiple certificates available (on a smart card, or via other 2239media), there must be exactly one certificate chosen before 2240attempting PKINIT authentication. This option may be specified 2241multiple times. All the available certificates are checked 2242against each rule in order until there is a match of exactly one 2243certificate. 2244 2245\sphinxAtStartPar 2246The Subject and Issuer comparison strings are the \index{RFC@\spxentry{RFC}!RFC 2253@\spxentry{RFC 2253}}\sphinxhref{https://tools.ietf.org/html/rfc2253.html}{\sphinxstylestrong{RFC 2253}} 2247string representations from the certificate Subject DN and Issuer 2248DN values. 2249 2250\sphinxAtStartPar 2251The syntax of the matching rules is: 2252\begin{quote} 2253 2254\sphinxAtStartPar 2255{[}\sphinxstyleemphasis{relation\sphinxhyphen{}operator}{]}\sphinxstyleemphasis{component\sphinxhyphen{}rule} … 2256\end{quote} 2257 2258\sphinxAtStartPar 2259where: 2260\begin{description} 2261\item[{\sphinxstyleemphasis{relation\sphinxhyphen{}operator}}] \leavevmode 2262\sphinxAtStartPar 2263can be either \sphinxcode{\sphinxupquote{\&\&}}, meaning all component rules must match, 2264or \sphinxcode{\sphinxupquote{||}}, meaning only one component rule must match. The 2265default is \sphinxcode{\sphinxupquote{\&\&}}. 2266 2267\item[{\sphinxstyleemphasis{component\sphinxhyphen{}rule}}] \leavevmode 2268\sphinxAtStartPar 2269can be one of the following. Note that there is no 2270punctuation or whitespace between component rules. 2271\begin{quote} 2272 2273\begin{DUlineblock}{0em} 2274\item[] \sphinxstylestrong{\textless{}SUBJECT\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} 2275\item[] \sphinxstylestrong{\textless{}ISSUER\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} 2276\item[] \sphinxstylestrong{\textless{}SAN\textgreater{}}\sphinxstyleemphasis{regular\sphinxhyphen{}expression} 2277\item[] \sphinxstylestrong{\textless{}EKU\textgreater{}}\sphinxstyleemphasis{extended\sphinxhyphen{}key\sphinxhyphen{}usage\sphinxhyphen{}list} 2278\item[] \sphinxstylestrong{\textless{}KU\textgreater{}}\sphinxstyleemphasis{key\sphinxhyphen{}usage\sphinxhyphen{}list} 2279\end{DUlineblock} 2280\end{quote} 2281 2282\sphinxAtStartPar 2283\sphinxstyleemphasis{extended\sphinxhyphen{}key\sphinxhyphen{}usage\sphinxhyphen{}list} is a comma\sphinxhyphen{}separated list of 2284required Extended Key Usage values. All values in the list 2285must be present in the certificate. Extended Key Usage values 2286can be: 2287\begin{itemize} 2288\item {} 2289\sphinxAtStartPar 2290pkinit 2291 2292\item {} 2293\sphinxAtStartPar 2294msScLogin 2295 2296\item {} 2297\sphinxAtStartPar 2298clientAuth 2299 2300\item {} 2301\sphinxAtStartPar 2302emailProtection 2303 2304\end{itemize} 2305 2306\sphinxAtStartPar 2307\sphinxstyleemphasis{key\sphinxhyphen{}usage\sphinxhyphen{}list} is a comma\sphinxhyphen{}separated list of required Key 2308Usage values. All values in the list must be present in the 2309certificate. Key Usage values can be: 2310\begin{itemize} 2311\item {} 2312\sphinxAtStartPar 2313digitalSignature 2314 2315\item {} 2316\sphinxAtStartPar 2317keyEncipherment 2318 2319\end{itemize} 2320 2321\end{description} 2322 2323\sphinxAtStartPar 2324Examples: 2325 2326\begin{sphinxVerbatim}[commandchars=\\\{\}] 2327\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{|}\PYG{o}{|}\PYG{o}{\PYGZlt{}}\PYG{n}{SUBJECT}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n}{DoE}\PYG{o}{.}\PYG{o}{*}\PYG{o}{\PYGZlt{}}\PYG{n}{SAN}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 2328\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{\PYGZam{}}\PYG{o}{\PYGZam{}}\PYG{o}{\PYGZlt{}}\PYG{n}{EKU}\PYG{o}{\PYGZgt{}}\PYG{n}{msScLogin}\PYG{p}{,}\PYG{n}{clientAuth}\PYG{o}{\PYGZlt{}}\PYG{n}{ISSUER}\PYG{o}{\PYGZgt{}}\PYG{o}{.}\PYG{o}{*}\PYG{n}{DoE}\PYG{o}{.}\PYG{o}{*} 2329\PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{EKU}\PYG{o}{\PYGZgt{}}\PYG{n}{msScLogin}\PYG{p}{,}\PYG{n}{clientAuth}\PYG{o}{\PYGZlt{}}\PYG{n}{KU}\PYG{o}{\PYGZgt{}}\PYG{n}{digitalSignature} 2330\end{sphinxVerbatim} 2331 2332\item[{\sphinxstylestrong{pkinit\_eku\_checking}}] \leavevmode 2333\sphinxAtStartPar 2334This option specifies what Extended Key Usage value the KDC 2335certificate presented to the client must contain. (Note that if 2336the KDC certificate has the pkinit SubjectAlternativeName encoded 2337as the Kerberos TGS name, EKU checking is not necessary since the 2338issuing CA has certified this as a KDC certificate.) The values 2339recognized in the krb5.conf file are: 2340\begin{description} 2341\item[{\sphinxstylestrong{kpKDC}}] \leavevmode 2342\sphinxAtStartPar 2343This is the default value and specifies that the KDC must have 2344the id\sphinxhyphen{}pkinit\sphinxhyphen{}KPKdc EKU as defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://tools.ietf.org/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. 2345 2346\item[{\sphinxstylestrong{kpServerAuth}}] \leavevmode 2347\sphinxAtStartPar 2348If \sphinxstylestrong{kpServerAuth} is specified, a KDC certificate with the 2349id\sphinxhyphen{}kp\sphinxhyphen{}serverAuth EKU will be accepted. This key usage value 2350is used in most commercially issued server certificates. 2351 2352\item[{\sphinxstylestrong{none}}] \leavevmode 2353\sphinxAtStartPar 2354If \sphinxstylestrong{none} is specified, then the KDC certificate will not be 2355checked to verify it has an acceptable EKU. The use of this 2356option is not recommended. 2357 2358\end{description} 2359 2360\item[{\sphinxstylestrong{pkinit\_dh\_min\_bits}}] \leavevmode 2361\sphinxAtStartPar 2362Specifies the size of the Diffie\sphinxhyphen{}Hellman key the client will 2363attempt to use. The acceptable values are 1024, 2048, and 4096. 2364The default is 2048. 2365 2366\item[{\sphinxstylestrong{pkinit\_identities}}] \leavevmode 2367\sphinxAtStartPar 2368Specifies the location(s) to be used to find the user’s X.509 2369identity information. If this option is specified multiple times, 2370each value is attempted in order until certificates are found. 2371Note that these values are not used if the user specifies 2372\sphinxstylestrong{X509\_user\_identity} on the command line. 2373 2374\item[{\sphinxstylestrong{pkinit\_kdc\_hostname}}] \leavevmode 2375\sphinxAtStartPar 2376The presence of this option indicates that the client is willing 2377to accept a KDC certificate with a dNSName SAN (Subject 2378Alternative Name) rather than requiring the id\sphinxhyphen{}pkinit\sphinxhyphen{}san as 2379defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://tools.ietf.org/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. This option may be specified multiple 2380times. Its value should contain the acceptable hostname for the 2381KDC (as contained in its certificate). 2382 2383\item[{\sphinxstylestrong{pkinit\_pool}}] \leavevmode 2384\sphinxAtStartPar 2385Specifies the location of intermediate certificates which may be 2386used by the client to complete the trust chain between a KDC 2387certificate and a trusted anchor. This option may be specified 2388multiple times. 2389 2390\item[{\sphinxstylestrong{pkinit\_require\_crl\_checking}}] \leavevmode 2391\sphinxAtStartPar 2392The default certificate verification process will always check the 2393available revocation information to see if a certificate has been 2394revoked. If a match is found for the certificate in a CRL, 2395verification fails. If the certificate being verified is not 2396listed in a CRL, or there is no CRL present for its issuing CA, 2397and \sphinxstylestrong{pkinit\_require\_crl\_checking} is false, then verification 2398succeeds. 2399 2400\sphinxAtStartPar 2401However, if \sphinxstylestrong{pkinit\_require\_crl\_checking} is true and there is 2402no CRL information available for the issuing CA, then verification 2403fails. 2404 2405\sphinxAtStartPar 2406\sphinxstylestrong{pkinit\_require\_crl\_checking} should be set to true if the 2407policy is such that up\sphinxhyphen{}to\sphinxhyphen{}date CRLs must be present for every CA. 2408 2409\item[{\sphinxstylestrong{pkinit\_revoke}}] \leavevmode 2410\sphinxAtStartPar 2411Specifies the location of Certificate Revocation List (CRL) 2412information to be used by the client when verifying the validity 2413of the KDC certificate presented. This option may be specified 2414multiple times. 2415 2416\end{description} 2417 2418 2419\subsubsection{Parameter expansion} 2420\label{\detokenize{admin/conf_files/krb5_conf:parameter-expansion}}\label{\detokenize{admin/conf_files/krb5_conf:id7}} 2421\sphinxAtStartPar 2422Starting with release 1.11, several variables, such as 2423\sphinxstylestrong{default\_keytab\_name}, allow parameters to be expanded. 2424Valid parameters are: 2425\begin{quote} 2426 2427 2428\begin{savenotes}\sphinxattablestart 2429\centering 2430\begin{tabulary}{\linewidth}[t]{|T|T|} 2431\hline 2432 2433\sphinxAtStartPar 2434\%\{TEMP\} 2435& 2436\sphinxAtStartPar 2437Temporary directory 2438\\ 2439\hline 2440\sphinxAtStartPar 2441\%\{uid\} 2442& 2443\sphinxAtStartPar 2444Unix real UID or Windows SID 2445\\ 2446\hline 2447\sphinxAtStartPar 2448\%\{euid\} 2449& 2450\sphinxAtStartPar 2451Unix effective user ID or Windows SID 2452\\ 2453\hline 2454\sphinxAtStartPar 2455\%\{USERID\} 2456& 2457\sphinxAtStartPar 2458Same as \%\{uid\} 2459\\ 2460\hline 2461\sphinxAtStartPar 2462\%\{null\} 2463& 2464\sphinxAtStartPar 2465Empty string 2466\\ 2467\hline 2468\sphinxAtStartPar 2469\%\{LIBDIR\} 2470& 2471\sphinxAtStartPar 2472Installation library directory 2473\\ 2474\hline 2475\sphinxAtStartPar 2476\%\{BINDIR\} 2477& 2478\sphinxAtStartPar 2479Installation binary directory 2480\\ 2481\hline 2482\sphinxAtStartPar 2483\%\{SBINDIR\} 2484& 2485\sphinxAtStartPar 2486Installation admin binary directory 2487\\ 2488\hline 2489\sphinxAtStartPar 2490\%\{username\} 2491& 2492\sphinxAtStartPar 2493(Unix) Username of effective user ID 2494\\ 2495\hline 2496\sphinxAtStartPar 2497\%\{APPDATA\} 2498& 2499\sphinxAtStartPar 2500(Windows) Roaming application data for current user 2501\\ 2502\hline 2503\sphinxAtStartPar 2504\%\{COMMON\_APPDATA\} 2505& 2506\sphinxAtStartPar 2507(Windows) Application data for all users 2508\\ 2509\hline 2510\sphinxAtStartPar 2511\%\{LOCAL\_APPDATA\} 2512& 2513\sphinxAtStartPar 2514(Windows) Local application data for current user 2515\\ 2516\hline 2517\sphinxAtStartPar 2518\%\{SYSTEM\} 2519& 2520\sphinxAtStartPar 2521(Windows) Windows system folder 2522\\ 2523\hline 2524\sphinxAtStartPar 2525\%\{WINDOWS\} 2526& 2527\sphinxAtStartPar 2528(Windows) Windows folder 2529\\ 2530\hline 2531\sphinxAtStartPar 2532\%\{USERCONFIG\} 2533& 2534\sphinxAtStartPar 2535(Windows) Per\sphinxhyphen{}user MIT krb5 config file directory 2536\\ 2537\hline 2538\sphinxAtStartPar 2539\%\{COMMONCONFIG\} 2540& 2541\sphinxAtStartPar 2542(Windows) Common MIT krb5 config file directory 2543\\ 2544\hline 2545\end{tabulary} 2546\par 2547\sphinxattableend\end{savenotes} 2548\end{quote} 2549 2550 2551\subsubsection{Sample krb5.conf file} 2552\label{\detokenize{admin/conf_files/krb5_conf:sample-krb5-conf-file}} 2553\sphinxAtStartPar 2554Here is an example of a generic krb5.conf file: 2555 2556\begin{sphinxVerbatim}[commandchars=\\\{\}] 2557\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 2558 \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 2559 \PYG{n}{dns\PYGZus{}lookup\PYGZus{}kdc} \PYG{o}{=} \PYG{n}{true} 2560 \PYG{n}{dns\PYGZus{}lookup\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} 2561 2562\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 2563 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2564 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 2565 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 2566 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{2.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 2567 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 2568 \PYG{n}{primary\PYGZus{}kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 2569 \PYG{p}{\PYGZcb{}} 2570 \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2571 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 2572 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{\PYGZhy{}}\PYG{l+m+mf}{1.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 2573 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 2574 \PYG{p}{\PYGZcb{}} 2575 2576\PYG{p}{[}\PYG{n}{domain\PYGZus{}realm}\PYG{p}{]} 2577 \PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 2578 2579\PYG{p}{[}\PYG{n}{capaths}\PYG{p}{]} 2580 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2581 \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{o}{.} 2582 \PYG{p}{\PYGZcb{}} 2583 \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2584 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{o}{.} 2585 \PYG{p}{\PYGZcb{}} 2586\end{sphinxVerbatim} 2587 2588 2589\subsubsection{FILES} 2590\label{\detokenize{admin/conf_files/krb5_conf:files}} 2591\sphinxAtStartPar 2592\sphinxcode{\sphinxupquote{/etc/krb5.conf}} 2593 2594 2595\subsubsection{SEE ALSO} 2596\label{\detokenize{admin/conf_files/krb5_conf:see-also}} 2597\sphinxAtStartPar 2598syslog(3) 2599 2600 2601\subsection{kdc.conf} 2602\label{\detokenize{admin/conf_files/kdc_conf:kdc-conf}}\label{\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}}\label{\detokenize{admin/conf_files/kdc_conf::doc}} 2603\sphinxAtStartPar 2604The kdc.conf file supplements {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} for programs which 2605are typically only used on a KDC, such as the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and 2606{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemons and the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} program. 2607Relations documented here may also be specified in krb5.conf; for the 2608KDC programs mentioned, krb5.conf and kdc.conf will be merged into a 2609single configuration profile. 2610 2611\sphinxAtStartPar 2612Normally, the kdc.conf file is found in the KDC state directory, 2613{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}. You can override the default location by setting the 2614environment variable \sphinxstylestrong{KRB5\_KDC\_PROFILE}. 2615 2616\sphinxAtStartPar 2617Please note that you need to restart the KDC daemon for any configuration 2618changes to take effect. 2619 2620 2621\subsubsection{Structure} 2622\label{\detokenize{admin/conf_files/kdc_conf:structure}} 2623\sphinxAtStartPar 2624The kdc.conf file is set up in the same format as the 2625{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file. 2626 2627 2628\subsubsection{Sections} 2629\label{\detokenize{admin/conf_files/kdc_conf:sections}} 2630\sphinxAtStartPar 2631The kdc.conf file may contain the following sections: 2632 2633 2634\begin{savenotes}\sphinxattablestart 2635\centering 2636\begin{tabulary}{\linewidth}[t]{|T|T|} 2637\hline 2638 2639\sphinxAtStartPar 2640{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} 2641& 2642\sphinxAtStartPar 2643Default values for KDC behavior 2644\\ 2645\hline 2646\sphinxAtStartPar 2647{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} 2648& 2649\sphinxAtStartPar 2650Realm\sphinxhyphen{}specific database configuration and settings 2651\\ 2652\hline 2653\sphinxAtStartPar 2654{\hyperref[\detokenize{admin/conf_files/kdc_conf:dbdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbdefaults{]}}}}} 2655& 2656\sphinxAtStartPar 2657Default database settings 2658\\ 2659\hline 2660\sphinxAtStartPar 2661{\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} 2662& 2663\sphinxAtStartPar 2664Per\sphinxhyphen{}database settings 2665\\ 2666\hline 2667\sphinxAtStartPar 2668{\hyperref[\detokenize{admin/conf_files/kdc_conf:logging}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}logging{]}}}}} 2669& 2670\sphinxAtStartPar 2671Controls how Kerberos daemons perform logging 2672\\ 2673\hline 2674\end{tabulary} 2675\par 2676\sphinxattableend\end{savenotes} 2677 2678 2679\paragraph{{[}kdcdefaults{]}} 2680\label{\detokenize{admin/conf_files/kdc_conf:kdcdefaults}}\label{\detokenize{admin/conf_files/kdc_conf:id1}} 2681\sphinxAtStartPar 2682Some relations in the {[}kdcdefaults{]} section specify default values for 2683realm variables, to be used if the {[}realms{]} subsection does not 2684contain a relation for the tag. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section for 2685the definitions of these relations. 2686\begin{itemize} 2687\item {} 2688\sphinxAtStartPar 2689\sphinxstylestrong{host\_based\_services} 2690 2691\item {} 2692\sphinxAtStartPar 2693\sphinxstylestrong{kdc\_listen} 2694 2695\item {} 2696\sphinxAtStartPar 2697\sphinxstylestrong{kdc\_ports} 2698 2699\item {} 2700\sphinxAtStartPar 2701\sphinxstylestrong{kdc\_tcp\_listen} 2702 2703\item {} 2704\sphinxAtStartPar 2705\sphinxstylestrong{kdc\_tcp\_ports} 2706 2707\item {} 2708\sphinxAtStartPar 2709\sphinxstylestrong{no\_host\_referral} 2710 2711\item {} 2712\sphinxAtStartPar 2713\sphinxstylestrong{restrict\_anonymous\_to\_tgt} 2714 2715\end{itemize} 2716 2717\sphinxAtStartPar 2718The following {[}kdcdefaults{]} variables have no per\sphinxhyphen{}realm equivalent: 2719\begin{description} 2720\item[{\sphinxstylestrong{kdc\_max\_dgram\_reply\_size}}] \leavevmode 2721\sphinxAtStartPar 2722Specifies the maximum packet size that can be sent over UDP. The 2723default value is 4096 bytes. 2724 2725\item[{\sphinxstylestrong{kdc\_tcp\_listen\_backlog}}] \leavevmode 2726\sphinxAtStartPar 2727(Integer.) Set the size of the listen queue length for the KDC 2728daemon. The value may be limited by OS settings. The default 2729value is 5. 2730 2731\item[{\sphinxstylestrong{spake\_preauth\_kdc\_challenge}}] \leavevmode 2732\sphinxAtStartPar 2733(String.) Specifies the group for a SPAKE optimistic challenge. 2734See the \sphinxstylestrong{spake\_preauth\_groups} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} 2735for possible values. The default is not to issue an optimistic 2736challenge. (New in release 1.17.) 2737 2738\end{description} 2739 2740 2741\paragraph{{[}realms{]}} 2742\label{\detokenize{admin/conf_files/kdc_conf:realms}}\label{\detokenize{admin/conf_files/kdc_conf:kdc-realms}} 2743\sphinxAtStartPar 2744Each tag in the {[}realms{]} section is the name of a Kerberos realm. The 2745value of the tag is a subsection where the relations define KDC 2746parameters for that particular realm. The following example shows how 2747to define one parameter for the ATHENA.MIT.EDU realm: 2748 2749\begin{sphinxVerbatim}[commandchars=\\\{\}] 2750\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 2751 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 2752 \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} 2753 \PYG{p}{\PYGZcb{}} 2754\end{sphinxVerbatim} 2755 2756\sphinxAtStartPar 2757The following tags may be specified in a {[}realms{]} subsection: 2758\begin{description} 2759\item[{\sphinxstylestrong{acl\_file}}] \leavevmode 2760\sphinxAtStartPar 2761(String.) Location of the access control list file that 2762{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} uses to determine which principals are allowed 2763which permissions on the Kerberos database. To operate without an 2764ACL file, set this relation to the empty string with \sphinxcode{\sphinxupquote{acl\_file = 2765""}}. The default value is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. For more 2766information on Kerberos ACL file see {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. 2767 2768\item[{\sphinxstylestrong{database\_module}}] \leavevmode 2769\sphinxAtStartPar 2770(String.) This relation indicates the name of the configuration 2771section under {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} for database\sphinxhyphen{}specific parameters 2772used by the loadable database library. The default value is the 2773realm name. If this configuration section does not exist, default 2774values will be used for all database parameters. 2775 2776\item[{\sphinxstylestrong{database\_name}}] \leavevmode 2777\sphinxAtStartPar 2778(String, deprecated.) This relation specifies the location of the 2779Kerberos database for this realm, if the DB2 module is being used 2780and the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} configuration section does not specify a 2781database name. The default value is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}}. 2782 2783\item[{\sphinxstylestrong{default\_principal\_expiration}}] \leavevmode 2784\sphinxAtStartPar 2785(\DUrole{xref,std,std-ref}{abstime} string.) Specifies the default expiration date of 2786principals created in this realm. The default value is 0, which 2787means no expiration date. 2788 2789\item[{\sphinxstylestrong{default\_principal\_flags}}] \leavevmode 2790\sphinxAtStartPar 2791(Flag string.) Specifies the default attributes of principals 2792created in this realm. The format for this string is a 2793comma\sphinxhyphen{}separated list of flags, with ‘+’ before each flag that 2794should be enabled and ‘\sphinxhyphen{}’ before each flag that should be 2795disabled. The \sphinxstylestrong{postdateable}, \sphinxstylestrong{forwardable}, \sphinxstylestrong{tgt\sphinxhyphen{}based}, 2796\sphinxstylestrong{renewable}, \sphinxstylestrong{proxiable}, \sphinxstylestrong{dup\sphinxhyphen{}skey}, \sphinxstylestrong{allow\sphinxhyphen{}tickets}, and 2797\sphinxstylestrong{service} flags default to enabled. 2798 2799\sphinxAtStartPar 2800There are a number of possible flags: 2801\begin{description} 2802\item[{\sphinxstylestrong{allow\sphinxhyphen{}tickets}}] \leavevmode 2803\sphinxAtStartPar 2804Enabling this flag means that the KDC will issue tickets for 2805this principal. Disabling this flag essentially deactivates 2806the principal within this realm. 2807 2808\item[{\sphinxstylestrong{dup\sphinxhyphen{}skey}}] \leavevmode 2809\sphinxAtStartPar 2810Enabling this flag allows the KDC to issue user\sphinxhyphen{}to\sphinxhyphen{}user 2811service tickets for this principal. 2812 2813\item[{\sphinxstylestrong{forwardable}}] \leavevmode 2814\sphinxAtStartPar 2815Enabling this flag allows the principal to obtain forwardable 2816tickets. 2817 2818\item[{\sphinxstylestrong{hwauth}}] \leavevmode 2819\sphinxAtStartPar 2820If this flag is enabled, then the principal is required to 2821preauthenticate using a hardware device before receiving any 2822tickets. 2823 2824\item[{\sphinxstylestrong{no\sphinxhyphen{}auth\sphinxhyphen{}data\sphinxhyphen{}required}}] \leavevmode 2825\sphinxAtStartPar 2826Enabling this flag prevents PAC or AD\sphinxhyphen{}SIGNEDPATH data from 2827being added to service tickets for the principal. 2828 2829\item[{\sphinxstylestrong{ok\sphinxhyphen{}as\sphinxhyphen{}delegate}}] \leavevmode 2830\sphinxAtStartPar 2831If this flag is enabled, it hints the client that credentials 2832can and should be delegated when authenticating to the 2833service. 2834 2835\item[{\sphinxstylestrong{ok\sphinxhyphen{}to\sphinxhyphen{}auth\sphinxhyphen{}as\sphinxhyphen{}delegate}}] \leavevmode 2836\sphinxAtStartPar 2837Enabling this flag allows the principal to use S4USelf tickets. 2838 2839\item[{\sphinxstylestrong{postdateable}}] \leavevmode 2840\sphinxAtStartPar 2841Enabling this flag allows the principal to obtain postdateable 2842tickets. 2843 2844\item[{\sphinxstylestrong{preauth}}] \leavevmode 2845\sphinxAtStartPar 2846If this flag is enabled on a client principal, then that 2847principal is required to preauthenticate to the KDC before 2848receiving any tickets. On a service principal, enabling this 2849flag means that service tickets for this principal will only 2850be issued to clients with a TGT that has the preauthenticated 2851bit set. 2852 2853\item[{\sphinxstylestrong{proxiable}}] \leavevmode 2854\sphinxAtStartPar 2855Enabling this flag allows the principal to obtain proxy 2856tickets. 2857 2858\item[{\sphinxstylestrong{pwchange}}] \leavevmode 2859\sphinxAtStartPar 2860Enabling this flag forces a password change for this 2861principal. 2862 2863\item[{\sphinxstylestrong{pwservice}}] \leavevmode 2864\sphinxAtStartPar 2865If this flag is enabled, it marks this principal as a password 2866change service. This should only be used in special cases, 2867for example, if a user’s password has expired, then the user 2868has to get tickets for that principal without going through 2869the normal password authentication in order to be able to 2870change the password. 2871 2872\item[{\sphinxstylestrong{renewable}}] \leavevmode 2873\sphinxAtStartPar 2874Enabling this flag allows the principal to obtain renewable 2875tickets. 2876 2877\item[{\sphinxstylestrong{service}}] \leavevmode 2878\sphinxAtStartPar 2879Enabling this flag allows the the KDC to issue service tickets 2880for this principal. In release 1.17 and later, user\sphinxhyphen{}to\sphinxhyphen{}user 2881service tickets are still allowed if the \sphinxstylestrong{dup\sphinxhyphen{}skey} flag is 2882set. 2883 2884\item[{\sphinxstylestrong{tgt\sphinxhyphen{}based}}] \leavevmode 2885\sphinxAtStartPar 2886Enabling this flag allows a principal to obtain tickets based 2887on a ticket\sphinxhyphen{}granting\sphinxhyphen{}ticket, rather than repeating the 2888authentication process that was used to obtain the TGT. 2889 2890\end{description} 2891 2892\item[{\sphinxstylestrong{dict\_file}}] \leavevmode 2893\sphinxAtStartPar 2894(String.) Location of the dictionary file containing strings that 2895are not allowed as passwords. The file should contain one string 2896per line, with no additional whitespace. If none is specified or 2897if there is no policy assigned to the principal, no dictionary 2898checks of passwords will be performed. 2899 2900\item[{\sphinxstylestrong{disable\_pac}}] \leavevmode 2901\sphinxAtStartPar 2902(Boolean value.) If true, the KDC will not issue PACs for this 2903realm, and S4U2Self and S4U2Proxy operations will be disabled. 2904The default is false, which will permit the KDC to issue PACs. 2905New in release 1.20. 2906 2907\item[{\sphinxstylestrong{encrypted\_challenge\_indicator}}] \leavevmode 2908\sphinxAtStartPar 2909(String.) Specifies the authentication indicator value that the KDC 2910asserts into tickets obtained using FAST encrypted challenge 2911pre\sphinxhyphen{}authentication. New in 1.16. 2912 2913\item[{\sphinxstylestrong{host\_based\_services}}] \leavevmode 2914\sphinxAtStartPar 2915(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Lists services which will 2916get host\sphinxhyphen{}based referral processing even if the server principal is 2917not marked as host\sphinxhyphen{}based by the client. 2918 2919\item[{\sphinxstylestrong{iprop\_enable}}] \leavevmode 2920\sphinxAtStartPar 2921(Boolean value.) Specifies whether incremental database 2922propagation is enabled. The default value is false. 2923 2924\item[{\sphinxstylestrong{iprop\_ulogsize}}] \leavevmode 2925\sphinxAtStartPar 2926(Integer.) Specifies the maximum number of log entries to be 2927retained for incremental propagation. The default value is 1000. 2928Prior to release 1.11, the maximum value was 2500. New in release 29291.19. 2930 2931\item[{\sphinxstylestrong{iprop\_master\_ulogsize}}] \leavevmode 2932\sphinxAtStartPar 2933The name for \sphinxstylestrong{iprop\_ulogsize} prior to release 1.19. Its value is 2934used as a fallback if \sphinxstylestrong{iprop\_ulogsize} is not specified. 2935 2936\item[{\sphinxstylestrong{iprop\_replica\_poll}}] \leavevmode 2937\sphinxAtStartPar 2938(Delta time string.) Specifies how often the replica KDC polls 2939for new updates from the primary. The default value is \sphinxcode{\sphinxupquote{2m}} 2940(that is, two minutes). New in release 1.17. 2941 2942\item[{\sphinxstylestrong{iprop\_slave\_poll}}] \leavevmode 2943\sphinxAtStartPar 2944(Delta time string.) The name for \sphinxstylestrong{iprop\_replica\_poll} prior to 2945release 1.17. Its value is used as a fallback if 2946\sphinxstylestrong{iprop\_replica\_poll} is not specified. 2947 2948\item[{\sphinxstylestrong{iprop\_listen}}] \leavevmode 2949\sphinxAtStartPar 2950(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the iprop RPC 2951listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. 2952Each entry may be an interface address, a port number, or an 2953address and port number separated by a colon. If the address 2954contains colons, enclose it in square brackets. If no address is 2955specified, the wildcard address is used. If kadmind fails to bind 2956to any of the specified addresses, it will fail to start. The 2957default (when \sphinxstylestrong{iprop\_enable} is true) is to bind to the wildcard 2958address at the port specified in \sphinxstylestrong{iprop\_port}. New in release 29591.15. 2960 2961\item[{\sphinxstylestrong{iprop\_port}}] \leavevmode 2962\sphinxAtStartPar 2963(Port number.) Specifies the port number to be used for 2964incremental propagation. When \sphinxstylestrong{iprop\_enable} is true, this 2965relation is required in the replica KDC configuration file, and 2966this relation or \sphinxstylestrong{iprop\_listen} is required in the primary 2967configuration file, as there is no default port number. Port 2968numbers specified in \sphinxstylestrong{iprop\_listen} entries will override this 2969port number for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. 2970 2971\item[{\sphinxstylestrong{iprop\_resync\_timeout}}] \leavevmode 2972\sphinxAtStartPar 2973(Delta time string.) Specifies the amount of time to wait for a 2974full propagation to complete. This is optional in configuration 2975files, and is used by replica KDCs only. The default value is 5 2976minutes (\sphinxcode{\sphinxupquote{5m}}). New in release 1.11. 2977 2978\item[{\sphinxstylestrong{iprop\_logfile}}] \leavevmode 2979\sphinxAtStartPar 2980(File name.) Specifies where the update log file for the realm 2981database is to be stored. The default is to use the 2982\sphinxstylestrong{database\_name} entry from the realms section of the krb5 config 2983file, with \sphinxcode{\sphinxupquote{.ulog}} appended. (NOTE: If \sphinxstylestrong{database\_name} isn’t 2984specified in the realms section, perhaps because the LDAP database 2985back end is being used, or the file name is specified in the 2986{[}dbmodules{]} section, then the hard\sphinxhyphen{}coded default for 2987\sphinxstylestrong{database\_name} is used. Determination of the \sphinxstylestrong{iprop\_logfile} 2988default value will not use values from the {[}dbmodules{]} section.) 2989 2990\item[{\sphinxstylestrong{kadmind\_listen}}] \leavevmode 2991\sphinxAtStartPar 2992(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the kadmin RPC 2993listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. 2994Each entry may be an interface address, a port number, or an 2995address and port number separated by a colon. If the address 2996contains colons, enclose it in square brackets. If no address is 2997specified, the wildcard address is used. If kadmind fails to bind 2998to any of the specified addresses, it will fail to start. The 2999default is to bind to the wildcard address at the port specified 3000in \sphinxstylestrong{kadmind\_port}, or the standard kadmin port (749). New in 3001release 1.15. 3002 3003\item[{\sphinxstylestrong{kadmind\_port}}] \leavevmode 3004\sphinxAtStartPar 3005(Port number.) Specifies the port on which the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} 3006daemon is to listen for this realm. Port numbers specified in 3007\sphinxstylestrong{kadmind\_listen} entries will override this port number. The 3008assigned port for kadmind is 749, which is used by default. 3009 3010\item[{\sphinxstylestrong{key\_stash\_file}}] \leavevmode 3011\sphinxAtStartPar 3012(String.) Specifies the location where the master key has been 3013stored (via kdb5\_util stash). The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/.k5.REALM}}, where \sphinxstyleemphasis{REALM} is the Kerberos realm. 3014 3015\item[{\sphinxstylestrong{kdc\_listen}}] \leavevmode 3016\sphinxAtStartPar 3017(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the UDP 3018listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon. 3019Each entry may be an interface address, a port number, or an 3020address and port number separated by a colon. If the address 3021contains colons, enclose it in square brackets. If no address is 3022specified, the wildcard address is used. If no port is specified, 3023the standard port (88) is used. If the KDC daemon fails to bind 3024to any of the specified addresses, it will fail to start. The 3025default is to bind to the wildcard address on the standard port. 3026New in release 1.15. 3027 3028\item[{\sphinxstylestrong{kdc\_ports}}] \leavevmode 3029\sphinxAtStartPar 3030(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list, deprecated.) Prior to 3031release 1.15, this relation lists the ports for the 3032{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to listen on for UDP requests. In 3033release 1.15 and later, it has the same meaning as \sphinxstylestrong{kdc\_listen} 3034if that relation is not defined. 3035 3036\item[{\sphinxstylestrong{kdc\_tcp\_listen}}] \leavevmode 3037\sphinxAtStartPar 3038(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Specifies the TCP 3039listening addresses and/or ports for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon. 3040Each entry may be an interface address, a port number, or an 3041address and port number separated by a colon. If the address 3042contains colons, enclose it in square brackets. If no address is 3043specified, the wildcard address is used. If no port is specified, 3044the standard port (88) is used. To disable listening on TCP, set 3045this relation to the empty string with \sphinxcode{\sphinxupquote{kdc\_tcp\_listen = ""}}. 3046If the KDC daemon fails to bind to any of the specified addresses, 3047it will fail to start. The default is to bind to the wildcard 3048address on the standard port. New in release 1.15. 3049 3050\item[{\sphinxstylestrong{kdc\_tcp\_ports}}] \leavevmode 3051\sphinxAtStartPar 3052(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list, deprecated.) Prior to 3053release 1.15, this relation lists the ports for the 3054{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to listen on for UDP requests. In 3055release 1.15 and later, it has the same meaning as 3056\sphinxstylestrong{kdc\_tcp\_listen} if that relation is not defined. 3057 3058\item[{\sphinxstylestrong{kpasswd\_listen}}] \leavevmode 3059\sphinxAtStartPar 3060(Comma\sphinxhyphen{}separated list.) Specifies the kpasswd listening addresses 3061and/or ports for the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon. Each entry may be 3062an interface address, a port number, or an address and port number 3063separated by a colon. If the address contains colons, enclose it 3064in square brackets. If no address is specified, the wildcard 3065address is used. If kadmind fails to bind to any of the specified 3066addresses, it will fail to start. The default is to bind to the 3067wildcard address at the port specified in \sphinxstylestrong{kpasswd\_port}, or the 3068standard kpasswd port (464). New in release 1.15. 3069 3070\item[{\sphinxstylestrong{kpasswd\_port}}] \leavevmode 3071\sphinxAtStartPar 3072(Port number.) Specifies the port on which the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} 3073daemon is to listen for password change requests for this realm. 3074Port numbers specified in \sphinxstylestrong{kpasswd\_listen} entries will override 3075this port number. The assigned port for password change requests 3076is 464, which is used by default. 3077 3078\item[{\sphinxstylestrong{master\_key\_name}}] \leavevmode 3079\sphinxAtStartPar 3080(String.) Specifies the name of the principal associated with the 3081master key. The default is \sphinxcode{\sphinxupquote{K/M}}. 3082 3083\item[{\sphinxstylestrong{master\_key\_type}}] \leavevmode 3084\sphinxAtStartPar 3085(Key type string.) Specifies the master key’s key type. The 3086default value for this is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}}. For a list of all possible 3087values, see {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}}. 3088 3089\item[{\sphinxstylestrong{max\_life}}] \leavevmode 3090\sphinxAtStartPar 3091(\DUrole{xref,std,std-ref}{duration} string.) Specifies the maximum time period for 3092which a ticket may be valid in this realm. The default value is 309324 hours. 3094 3095\item[{\sphinxstylestrong{max\_renewable\_life}}] \leavevmode 3096\sphinxAtStartPar 3097(\DUrole{xref,std,std-ref}{duration} string.) Specifies the maximum time period 3098during which a valid ticket may be renewed in this realm. 3099The default value is 0. 3100 3101\item[{\sphinxstylestrong{no\_host\_referral}}] \leavevmode 3102\sphinxAtStartPar 3103(Whitespace\sphinxhyphen{} or comma\sphinxhyphen{}separated list.) Lists services to block 3104from getting host\sphinxhyphen{}based referral processing, even if the client 3105marks the server principal as host\sphinxhyphen{}based or the service is also 3106listed in \sphinxstylestrong{host\_based\_services}. \sphinxcode{\sphinxupquote{no\_host\_referral = *}} will 3107disable referral processing altogether. 3108 3109\item[{\sphinxstylestrong{reject\_bad\_transit}}] \leavevmode 3110\sphinxAtStartPar 3111(Boolean value.) If set to true, the KDC will check the list of 3112transited realms for cross\sphinxhyphen{}realm tickets against the transit path 3113computed from the realm names and the capaths section of its 3114{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file; if the path in the ticket to be issued 3115contains any realms not in the computed path, the ticket will not 3116be issued, and an error will be returned to the client instead. 3117If this value is set to false, such tickets will be issued 3118anyways, and it will be left up to the application server to 3119validate the realm transit path. 3120 3121\sphinxAtStartPar 3122If the disable\sphinxhyphen{}transited\sphinxhyphen{}check flag is set in the incoming 3123request, this check is not performed at all. Having the 3124\sphinxstylestrong{reject\_bad\_transit} option will cause such ticket requests to 3125be rejected always. 3126 3127\sphinxAtStartPar 3128This transit path checking and config file option currently apply 3129only to TGS requests. 3130 3131\sphinxAtStartPar 3132The default value is true. 3133 3134\item[{\sphinxstylestrong{restrict\_anonymous\_to\_tgt}}] \leavevmode 3135\sphinxAtStartPar 3136(Boolean value.) If set to true, the KDC will reject ticket 3137requests from anonymous principals to service principals other 3138than the realm’s ticket\sphinxhyphen{}granting service. This option allows 3139anonymous PKINIT to be enabled for use as FAST armor tickets 3140without allowing anonymous authentication to services. The 3141default value is false. New in release 1.9. 3142 3143\item[{\sphinxstylestrong{spake\_preauth\_indicator}}] \leavevmode 3144\sphinxAtStartPar 3145(String.) Specifies an authentication indicator value that the 3146KDC asserts into tickets obtained using SPAKE pre\sphinxhyphen{}authentication. 3147The default is not to add any indicators. This option may be 3148specified multiple times. New in release 1.17. 3149 3150\item[{\sphinxstylestrong{supported\_enctypes}}] \leavevmode 3151\sphinxAtStartPar 3152(List of \sphinxstyleemphasis{key}:\sphinxstyleemphasis{salt} strings.) Specifies the default key/salt 3153combinations of principals for this realm. Any principals created 3154through {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} will have keys of these types. The 3155default value for this tag is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal}}. For lists of 3156possible values, see {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}}. 3157 3158\end{description} 3159 3160 3161\paragraph{{[}dbdefaults{]}} 3162\label{\detokenize{admin/conf_files/kdc_conf:dbdefaults}}\label{\detokenize{admin/conf_files/kdc_conf:id2}} 3163\sphinxAtStartPar 3164The {[}dbdefaults{]} section specifies default values for some database 3165parameters, to be used if the {[}dbmodules{]} subsection does not contain 3166a relation for the tag. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} section for the 3167definitions of these relations. 3168\begin{itemize} 3169\item {} 3170\sphinxAtStartPar 3171\sphinxstylestrong{ldap\_kerberos\_container\_dn} 3172 3173\item {} 3174\sphinxAtStartPar 3175\sphinxstylestrong{ldap\_kdc\_dn} 3176 3177\item {} 3178\sphinxAtStartPar 3179\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} 3180 3181\item {} 3182\sphinxAtStartPar 3183\sphinxstylestrong{ldap\_kdc\_sasl\_authzid} 3184 3185\item {} 3186\sphinxAtStartPar 3187\sphinxstylestrong{ldap\_kdc\_sasl\_mech} 3188 3189\item {} 3190\sphinxAtStartPar 3191\sphinxstylestrong{ldap\_kdc\_sasl\_realm} 3192 3193\item {} 3194\sphinxAtStartPar 3195\sphinxstylestrong{ldap\_kadmind\_dn} 3196 3197\item {} 3198\sphinxAtStartPar 3199\sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} 3200 3201\item {} 3202\sphinxAtStartPar 3203\sphinxstylestrong{ldap\_kadmind\_sasl\_authzid} 3204 3205\item {} 3206\sphinxAtStartPar 3207\sphinxstylestrong{ldap\_kadmind\_sasl\_mech} 3208 3209\item {} 3210\sphinxAtStartPar 3211\sphinxstylestrong{ldap\_kadmind\_sasl\_realm} 3212 3213\item {} 3214\sphinxAtStartPar 3215\sphinxstylestrong{ldap\_service\_password\_file} 3216 3217\item {} 3218\sphinxAtStartPar 3219\sphinxstylestrong{ldap\_conns\_per\_server} 3220 3221\end{itemize} 3222 3223 3224\paragraph{{[}dbmodules{]}} 3225\label{\detokenize{admin/conf_files/kdc_conf:dbmodules}}\label{\detokenize{admin/conf_files/kdc_conf:id3}} 3226\sphinxAtStartPar 3227The {[}dbmodules{]} section contains parameters used by the KDC database 3228library and database modules. Each tag in the {[}dbmodules{]} section is 3229the name of a Kerberos realm or a section name specified by a realm’s 3230\sphinxstylestrong{database\_module} parameter. The following example shows how to 3231define one database parameter for the ATHENA.MIT.EDU realm: 3232 3233\begin{sphinxVerbatim}[commandchars=\\\{\}] 3234\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 3235 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 3236 \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} 3237 \PYG{p}{\PYGZcb{}} 3238\end{sphinxVerbatim} 3239 3240\sphinxAtStartPar 3241The following tags may be specified in a {[}dbmodules{]} subsection: 3242\begin{description} 3243\item[{\sphinxstylestrong{database\_name}}] \leavevmode 3244\sphinxAtStartPar 3245This DB2\sphinxhyphen{}specific tag indicates the location of the database in 3246the filesystem. The default is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}}. 3247 3248\item[{\sphinxstylestrong{db\_library}}] \leavevmode 3249\sphinxAtStartPar 3250This tag indicates the name of the loadable database module. The 3251value should be \sphinxcode{\sphinxupquote{db2}} for the DB2 module, \sphinxcode{\sphinxupquote{klmdb}} for the LMDB 3252module, or \sphinxcode{\sphinxupquote{kldap}} for the LDAP module. 3253 3254\item[{\sphinxstylestrong{disable\_last\_success}}] \leavevmode 3255\sphinxAtStartPar 3256If set to \sphinxcode{\sphinxupquote{true}}, suppresses KDC updates to the “Last successful 3257authentication” field of principal entries requiring 3258preauthentication. Setting this flag may improve performance. 3259(Principal entries which do not require preauthentication never 3260update the “Last successful authentication” field.). First 3261introduced in release 1.9. 3262 3263\item[{\sphinxstylestrong{disable\_lockout}}] \leavevmode 3264\sphinxAtStartPar 3265If set to \sphinxcode{\sphinxupquote{true}}, suppresses KDC updates to the “Last failed 3266authentication” and “Failed password attempts” fields of principal 3267entries requiring preauthentication. Setting this flag may 3268improve performance, but also disables account lockout. First 3269introduced in release 1.9. 3270 3271\item[{\sphinxstylestrong{ldap\_conns\_per\_server}}] \leavevmode 3272\sphinxAtStartPar 3273This LDAP\sphinxhyphen{}specific tag indicates the number of connections to be 3274maintained per LDAP server. 3275 3276\item[{\sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn}}] \leavevmode 3277\sphinxAtStartPar 3278These LDAP\sphinxhyphen{}specific tags indicate the default DN for binding to 3279the LDAP server. The {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon uses 3280\sphinxstylestrong{ldap\_kdc\_dn}, while the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon and other 3281administrative programs use \sphinxstylestrong{ldap\_kadmind\_dn}. The kadmind DN 3282must have the rights to read and write the Kerberos data in the 3283LDAP database. The KDC DN must have the same rights, unless 3284\sphinxstylestrong{disable\_lockout} and \sphinxstylestrong{disable\_last\_success} are true, in 3285which case it only needs to have rights to read the Kerberos data. 3286These tags are ignored if a SASL mechanism is set with 3287\sphinxstylestrong{ldap\_kdc\_sasl\_mech} or \sphinxstylestrong{ldap\_kadmind\_sasl\_mech}. 3288 3289\item[{\sphinxstylestrong{ldap\_kdc\_sasl\_mech} and \sphinxstylestrong{ldap\_kadmind\_sasl\_mech}}] \leavevmode 3290\sphinxAtStartPar 3291These LDAP\sphinxhyphen{}specific tags specify the SASL mechanism (such as 3292\sphinxcode{\sphinxupquote{EXTERNAL}}) to use when binding to the LDAP server. New in 3293release 1.13. 3294 3295\item[{\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} and \sphinxstylestrong{ldap\_kadmind\_sasl\_authcid}}] \leavevmode 3296\sphinxAtStartPar 3297These LDAP\sphinxhyphen{}specific tags specify the SASL authentication identity 3298to use when binding to the LDAP server. Not all SASL mechanisms 3299require an authentication identity. If the SASL mechanism 3300requires a secret (such as the password for \sphinxcode{\sphinxupquote{DIGEST\sphinxhyphen{}MD5}}), these 3301tags also determine the name within the 3302\sphinxstylestrong{ldap\_service\_password\_file} where the secret is stashed. New 3303in release 1.13. 3304 3305\item[{\sphinxstylestrong{ldap\_kdc\_sasl\_authzid} and \sphinxstylestrong{ldap\_kadmind\_sasl\_authzid}}] \leavevmode 3306\sphinxAtStartPar 3307These LDAP\sphinxhyphen{}specific tags specify the SASL authorization identity 3308to use when binding to the LDAP server. In most circumstances 3309they do not need to be specified. New in release 1.13. 3310 3311\item[{\sphinxstylestrong{ldap\_kdc\_sasl\_realm} and \sphinxstylestrong{ldap\_kadmind\_sasl\_realm}}] \leavevmode 3312\sphinxAtStartPar 3313These LDAP\sphinxhyphen{}specific tags specify the SASL realm to use when 3314binding to the LDAP server. In most circumstances they do not 3315need to be set. New in release 1.13. 3316 3317\item[{\sphinxstylestrong{ldap\_kerberos\_container\_dn}}] \leavevmode 3318\sphinxAtStartPar 3319This LDAP\sphinxhyphen{}specific tag indicates the DN of the container object 3320where the realm objects will be located. 3321 3322\item[{\sphinxstylestrong{ldap\_servers}}] \leavevmode 3323\sphinxAtStartPar 3324This LDAP\sphinxhyphen{}specific tag indicates the list of LDAP servers that the 3325Kerberos servers can connect to. The list of LDAP servers is 3326whitespace\sphinxhyphen{}separated. The LDAP server is specified by a LDAP URI. 3327It is recommended to use \sphinxcode{\sphinxupquote{ldapi:}} or \sphinxcode{\sphinxupquote{ldaps:}} URLs to connect 3328to the LDAP server. 3329 3330\item[{\sphinxstylestrong{ldap\_service\_password\_file}}] \leavevmode 3331\sphinxAtStartPar 3332This LDAP\sphinxhyphen{}specific tag indicates the file containing the stashed 3333passwords (created by \sphinxcode{\sphinxupquote{kdb5\_ldap\_util stashsrvpw}}) for the 3334\sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn} objects, or for the 3335\sphinxstylestrong{ldap\_kdc\_sasl\_authcid} or \sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} names 3336for SASL authentication. This file must be kept secure. 3337 3338\item[{\sphinxstylestrong{mapsize}}] \leavevmode 3339\sphinxAtStartPar 3340This LMDB\sphinxhyphen{}specific tag indicates the maximum size of the two 3341database environments in megabytes. The default value is 128. 3342Increase this value to address “Environment mapsize limit reached” 3343errors. New in release 1.17. 3344 3345\item[{\sphinxstylestrong{max\_readers}}] \leavevmode 3346\sphinxAtStartPar 3347This LMDB\sphinxhyphen{}specific tag indicates the maximum number of concurrent 3348reading processes for the databases. The default value is 128. 3349New in release 1.17. 3350 3351\item[{\sphinxstylestrong{nosync}}] \leavevmode 3352\sphinxAtStartPar 3353This LMDB\sphinxhyphen{}specific tag can be set to improve the throughput of 3354kadmind and other administrative agents, at the expense of 3355durability (recent database changes may not survive a power outage 3356or other sudden reboot). It does not affect the throughput of the 3357KDC. The default value is false. New in release 1.17. 3358 3359\item[{\sphinxstylestrong{unlockiter}}] \leavevmode 3360\sphinxAtStartPar 3361If set to \sphinxcode{\sphinxupquote{true}}, this DB2\sphinxhyphen{}specific tag causes iteration 3362operations to release the database lock while processing each 3363principal. Setting this flag to \sphinxcode{\sphinxupquote{true}} can prevent extended 3364blocking of KDC or kadmin operations when dumps of large databases 3365are in progress. First introduced in release 1.13. 3366 3367\end{description} 3368 3369\sphinxAtStartPar 3370The following tag may be specified directly in the {[}dbmodules{]} 3371section to control where database modules are loaded from: 3372\begin{description} 3373\item[{\sphinxstylestrong{db\_module\_dir}}] \leavevmode 3374\sphinxAtStartPar 3375This tag controls where the plugin system looks for database 3376modules. The value should be an absolute path. 3377 3378\end{description} 3379 3380 3381\paragraph{{[}logging{]}} 3382\label{\detokenize{admin/conf_files/kdc_conf:logging}}\label{\detokenize{admin/conf_files/kdc_conf:id4}} 3383\sphinxAtStartPar 3384The {[}logging{]} section indicates how {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and 3385{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} perform logging. It may contain the following 3386relations: 3387\begin{description} 3388\item[{\sphinxstylestrong{admin\_server}}] \leavevmode 3389\sphinxAtStartPar 3390Specifies how {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} performs logging. 3391 3392\item[{\sphinxstylestrong{kdc}}] \leavevmode 3393\sphinxAtStartPar 3394Specifies how {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} performs logging. 3395 3396\item[{\sphinxstylestrong{default}}] \leavevmode 3397\sphinxAtStartPar 3398Specifies how either daemon performs logging in the absence of 3399relations specific to the daemon. 3400 3401\item[{\sphinxstylestrong{debug}}] \leavevmode 3402\sphinxAtStartPar 3403(Boolean value.) Specifies whether debugging messages are 3404included in log outputs other than SYSLOG. Debugging messages are 3405always included in the system log output because syslog performs 3406its own priority filtering. The default value is false. New in 3407release 1.15. 3408 3409\end{description} 3410 3411\sphinxAtStartPar 3412Logging specifications may have the following forms: 3413\begin{description} 3414\item[{\sphinxstylestrong{FILE=}\sphinxstyleemphasis{filename} or \sphinxstylestrong{FILE:}\sphinxstyleemphasis{filename}}] \leavevmode 3415\sphinxAtStartPar 3416This value causes the daemon’s logging messages to go to the 3417\sphinxstyleemphasis{filename}. If the \sphinxcode{\sphinxupquote{=}} form is used, the file is overwritten. 3418If the \sphinxcode{\sphinxupquote{:}} form is used, the file is appended to. 3419 3420\item[{\sphinxstylestrong{STDERR}}] \leavevmode 3421\sphinxAtStartPar 3422This value causes the daemon’s logging messages to go to its 3423standard error stream. 3424 3425\item[{\sphinxstylestrong{CONSOLE}}] \leavevmode 3426\sphinxAtStartPar 3427This value causes the daemon’s logging messages to go to the 3428console, if the system supports it. 3429 3430\item[{\sphinxstylestrong{DEVICE=}\sphinxstyleemphasis{\textless{}devicename\textgreater{}}}] \leavevmode 3431\sphinxAtStartPar 3432This causes the daemon’s logging messages to go to the specified 3433device. 3434 3435\item[{\sphinxstylestrong{SYSLOG}{[}\sphinxstylestrong{:}\sphinxstyleemphasis{severity}{[}\sphinxstylestrong{:}\sphinxstyleemphasis{facility}{]}{]}}] \leavevmode 3436\sphinxAtStartPar 3437This causes the daemon’s logging messages to go to the system log. 3438 3439\sphinxAtStartPar 3440For backward compatibility, a severity argument may be specified, 3441and must be specified in order to specify a facility. This 3442argument will be ignored. 3443 3444\sphinxAtStartPar 3445The facility argument specifies the facility under which the 3446messages are logged. This may be any of the following facilities 3447supported by the syslog(3) call minus the LOG\_ prefix: \sphinxstylestrong{KERN}, 3448\sphinxstylestrong{USER}, \sphinxstylestrong{MAIL}, \sphinxstylestrong{DAEMON}, \sphinxstylestrong{AUTH}, \sphinxstylestrong{LPR}, \sphinxstylestrong{NEWS}, 3449\sphinxstylestrong{UUCP}, \sphinxstylestrong{CRON}, and \sphinxstylestrong{LOCAL0} through \sphinxstylestrong{LOCAL7}. If no 3450facility is specified, the default is \sphinxstylestrong{AUTH}. 3451 3452\end{description} 3453 3454\sphinxAtStartPar 3455In the following example, the logging messages from the KDC will go to 3456the console and to the system log under the facility LOG\_DAEMON, and 3457the logging messages from the administrative server will be appended 3458to the file \sphinxcode{\sphinxupquote{/var/adm/kadmin.log}} and sent to the device 3459\sphinxcode{\sphinxupquote{/dev/tty04}}. 3460 3461\begin{sphinxVerbatim}[commandchars=\\\{\}] 3462\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} 3463 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{CONSOLE} 3464 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{SYSLOG}\PYG{p}{:}\PYG{n}{INFO}\PYG{p}{:}\PYG{n}{DAEMON} 3465 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{adm}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} 3466 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{DEVICE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{dev}\PYG{o}{/}\PYG{n}{tty04} 3467\end{sphinxVerbatim} 3468 3469\sphinxAtStartPar 3470If no logging specification is given, the default is to use syslog. 3471To disable logging entirely, specify \sphinxcode{\sphinxupquote{default = DEVICE=/dev/null}}. 3472 3473 3474\paragraph{{[}otp{]}} 3475\label{\detokenize{admin/conf_files/kdc_conf:otp}}\label{\detokenize{admin/conf_files/kdc_conf:id5}} 3476\sphinxAtStartPar 3477Each subsection of {[}otp{]} is the name of an OTP token type. The tags 3478within the subsection define the configuration required to forward a 3479One Time Password request to a RADIUS server. 3480 3481\sphinxAtStartPar 3482For each token type, the following tags may be specified: 3483\begin{description} 3484\item[{\sphinxstylestrong{server}}] \leavevmode 3485\sphinxAtStartPar 3486This is the server to send the RADIUS request to. It can be a 3487hostname with optional port, an ip address with optional port, or 3488a Unix domain socket address. The default is 3489{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/\textless{}name\textgreater{}.socket}}. 3490 3491\item[{\sphinxstylestrong{secret}}] \leavevmode 3492\sphinxAtStartPar 3493This tag indicates a filename (which may be relative to {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}) 3494containing the secret used to encrypt the RADIUS packets. The 3495secret should appear in the first line of the file by itself; 3496leading and trailing whitespace on the line will be removed. If 3497the value of \sphinxstylestrong{server} is a Unix domain socket address, this tag 3498is optional, and an empty secret will be used if it is not 3499specified. Otherwise, this tag is required. 3500 3501\item[{\sphinxstylestrong{timeout}}] \leavevmode 3502\sphinxAtStartPar 3503An integer which specifies the time in seconds during which the 3504KDC should attempt to contact the RADIUS server. This tag is the 3505total time across all retries and should be less than the time 3506which an OTP value remains valid for. The default is 5 seconds. 3507 3508\item[{\sphinxstylestrong{retries}}] \leavevmode 3509\sphinxAtStartPar 3510This tag specifies the number of retries to make to the RADIUS 3511server. The default is 3 retries (4 tries). 3512 3513\item[{\sphinxstylestrong{strip\_realm}}] \leavevmode 3514\sphinxAtStartPar 3515If this tag is \sphinxcode{\sphinxupquote{true}}, the principal without the realm will be 3516passed to the RADIUS server. Otherwise, the realm will be 3517included. The default value is \sphinxcode{\sphinxupquote{true}}. 3518 3519\item[{\sphinxstylestrong{indicator}}] \leavevmode 3520\sphinxAtStartPar 3521This tag specifies an authentication indicator to be included in 3522the ticket if this token type is used to authenticate. This 3523option may be specified multiple times. (New in release 1.14.) 3524 3525\end{description} 3526 3527\sphinxAtStartPar 3528In the following example, requests are sent to a remote server via UDP: 3529 3530\begin{sphinxVerbatim}[commandchars=\\\{\}] 3531[otp] 3532 MyRemoteTokenType = \PYGZob{} 3533 server = radius.mydomain.com:1812 3534 secret = SEmfiajf42\PYGZdl{} 3535 timeout = 15 3536 retries = 5 3537 strip\PYGZus{}realm = true 3538 \PYGZcb{} 3539\end{sphinxVerbatim} 3540 3541\sphinxAtStartPar 3542An implicit default token type named \sphinxcode{\sphinxupquote{DEFAULT}} is defined for when 3543the per\sphinxhyphen{}principal configuration does not specify a token type. Its 3544configuration is shown below. You may override this token type to 3545something applicable for your situation: 3546 3547\begin{sphinxVerbatim}[commandchars=\\\{\}] 3548\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} 3549 \PYG{n}{DEFAULT} \PYG{o}{=} \PYG{p}{\PYGZob{}} 3550 \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} 3551 \PYG{p}{\PYGZcb{}} 3552\end{sphinxVerbatim} 3553 3554 3555\subsubsection{PKINIT options} 3556\label{\detokenize{admin/conf_files/kdc_conf:pkinit-options}} 3557\begin{sphinxadmonition}{note}{Note:} 3558\sphinxAtStartPar 3559The following are pkinit\sphinxhyphen{}specific options. These values may 3560be specified in {[}kdcdefaults{]} as global defaults, or within 3561a realm\sphinxhyphen{}specific subsection of {[}realms{]}. Also note that a 3562realm\sphinxhyphen{}specific value over\sphinxhyphen{}rides, does not add to, a generic 3563{[}kdcdefaults{]} specification. The search order is: 3564\end{sphinxadmonition} 3565\begin{enumerate} 3566\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 3567\item {} 3568\sphinxAtStartPar 3569realm\sphinxhyphen{}specific subsection of {[}realms{]}: 3570 3571\begin{sphinxVerbatim}[commandchars=\\\{\}] 3572\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 3573 \PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{=} \PYG{p}{\PYGZob{}} 3574 \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{o}{.}\PYG{n}{crt} 3575 \PYG{p}{\PYGZcb{}} 3576\end{sphinxVerbatim} 3577 3578\item {} 3579\sphinxAtStartPar 3580generic value in the {[}kdcdefaults{]} section: 3581 3582\begin{sphinxVerbatim}[commandchars=\\\{\}] 3583\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} 3584 \PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{generic\PYGZus{}trusted\PYGZus{}cas}\PYG{o}{/} 3585\end{sphinxVerbatim} 3586 3587\end{enumerate} 3588 3589\sphinxAtStartPar 3590For information about the syntax of some of these options, see 3591{\hyperref[\detokenize{admin/conf_files/krb5_conf:pkinit-identity}]{\sphinxcrossref{\DUrole{std,std-ref}{Specifying PKINIT identity information}}}} in 3592{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. 3593\begin{description} 3594\item[{\sphinxstylestrong{pkinit\_anchors}}] \leavevmode 3595\sphinxAtStartPar 3596Specifies the location of trusted anchor (root) certificates which 3597the KDC trusts to sign client certificates. This option is 3598required if pkinit is to be supported by the KDC. This option may 3599be specified multiple times. 3600 3601\item[{\sphinxstylestrong{pkinit\_dh\_min\_bits}}] \leavevmode 3602\sphinxAtStartPar 3603Specifies the minimum number of bits the KDC is willing to accept 3604for a client’s Diffie\sphinxhyphen{}Hellman key. The default is 2048. 3605 3606\item[{\sphinxstylestrong{pkinit\_allow\_upn}}] \leavevmode 3607\sphinxAtStartPar 3608Specifies that the KDC is willing to accept client certificates 3609with the Microsoft UserPrincipalName (UPN) Subject Alternative 3610Name (SAN). This means the KDC accepts the binding of the UPN in 3611the certificate to the Kerberos principal name. The default value 3612is false. 3613 3614\sphinxAtStartPar 3615Without this option, the KDC will only accept certificates with 3616the id\sphinxhyphen{}pkinit\sphinxhyphen{}san as defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://tools.ietf.org/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. There is currently 3617no option to disable SAN checking in the KDC. 3618 3619\item[{\sphinxstylestrong{pkinit\_eku\_checking}}] \leavevmode 3620\sphinxAtStartPar 3621This option specifies what Extended Key Usage (EKU) values the KDC 3622is willing to accept in client certificates. The values 3623recognized in the kdc.conf file are: 3624\begin{description} 3625\item[{\sphinxstylestrong{kpClientAuth}}] \leavevmode 3626\sphinxAtStartPar 3627This is the default value and specifies that client 3628certificates must have the id\sphinxhyphen{}pkinit\sphinxhyphen{}KPClientAuth EKU as 3629defined in \index{RFC@\spxentry{RFC}!RFC 4556@\spxentry{RFC 4556}}\sphinxhref{https://tools.ietf.org/html/rfc4556.html}{\sphinxstylestrong{RFC 4556}}. 3630 3631\item[{\sphinxstylestrong{scLogin}}] \leavevmode 3632\sphinxAtStartPar 3633If scLogin is specified, client certificates with the 3634Microsoft Smart Card Login EKU (id\sphinxhyphen{}ms\sphinxhyphen{}kp\sphinxhyphen{}sc\sphinxhyphen{}logon) will be 3635accepted. 3636 3637\item[{\sphinxstylestrong{none}}] \leavevmode 3638\sphinxAtStartPar 3639If none is specified, then client certificates will not be 3640checked to verify they have an acceptable EKU. The use of 3641this option is not recommended. 3642 3643\end{description} 3644 3645\item[{\sphinxstylestrong{pkinit\_identity}}] \leavevmode 3646\sphinxAtStartPar 3647Specifies the location of the KDC’s X.509 identity information. 3648This option is required if pkinit is to be supported by the KDC. 3649 3650\item[{\sphinxstylestrong{pkinit\_indicator}}] \leavevmode 3651\sphinxAtStartPar 3652Specifies an authentication indicator to include in the ticket if 3653pkinit is used to authenticate. This option may be specified 3654multiple times. (New in release 1.14.) 3655 3656\item[{\sphinxstylestrong{pkinit\_pool}}] \leavevmode 3657\sphinxAtStartPar 3658Specifies the location of intermediate certificates which may be 3659used by the KDC to complete the trust chain between a client’s 3660certificate and a trusted anchor. This option may be specified 3661multiple times. 3662 3663\item[{\sphinxstylestrong{pkinit\_revoke}}] \leavevmode 3664\sphinxAtStartPar 3665Specifies the location of Certificate Revocation List (CRL) 3666information to be used by the KDC when verifying the validity of 3667client certificates. This option may be specified multiple times. 3668 3669\item[{\sphinxstylestrong{pkinit\_require\_crl\_checking}}] \leavevmode 3670\sphinxAtStartPar 3671The default certificate verification process will always check the 3672available revocation information to see if a certificate has been 3673revoked. If a match is found for the certificate in a CRL, 3674verification fails. If the certificate being verified is not 3675listed in a CRL, or there is no CRL present for its issuing CA, 3676and \sphinxstylestrong{pkinit\_require\_crl\_checking} is false, then verification 3677succeeds. 3678 3679\sphinxAtStartPar 3680However, if \sphinxstylestrong{pkinit\_require\_crl\_checking} is true and there is 3681no CRL information available for the issuing CA, then verification 3682fails. 3683 3684\sphinxAtStartPar 3685\sphinxstylestrong{pkinit\_require\_crl\_checking} should be set to true if the 3686policy is such that up\sphinxhyphen{}to\sphinxhyphen{}date CRLs must be present for every CA. 3687 3688\item[{\sphinxstylestrong{pkinit\_require\_freshness}}] \leavevmode 3689\sphinxAtStartPar 3690Specifies whether to require clients to include a freshness token 3691in PKINIT requests. The default value is false. (New in release 36921.17.) 3693 3694\end{description} 3695 3696 3697\subsubsection{Encryption types} 3698\label{\detokenize{admin/conf_files/kdc_conf:encryption-types}}\label{\detokenize{admin/conf_files/kdc_conf:id6}} 3699\sphinxAtStartPar 3700Any tag in the configuration files which requires a list of encryption 3701types can be set to some combination of the following strings. 3702Encryption types marked as “weak” and “deprecated” are available for 3703compatibility but not recommended for use. 3704 3705 3706\begin{savenotes}\sphinxattablestart 3707\centering 3708\begin{tabulary}{\linewidth}[t]{|T|T|} 3709\hline 3710 3711\sphinxAtStartPar 3712des3\sphinxhyphen{}cbc\sphinxhyphen{}raw 3713& 3714\sphinxAtStartPar 3715Triple DES cbc mode raw (weak) 3716\\ 3717\hline 3718\sphinxAtStartPar 3719des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 des3\sphinxhyphen{}hmac\sphinxhyphen{}sha1 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1\sphinxhyphen{}kd 3720& 3721\sphinxAtStartPar 3722Triple DES cbc mode with HMAC/sha1 (deprecated) 3723\\ 3724\hline 3725\sphinxAtStartPar 3726aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts aes256\sphinxhyphen{}sha1 3727& 3728\sphinxAtStartPar 3729AES\sphinxhyphen{}256 CTS mode with 96\sphinxhyphen{}bit SHA\sphinxhyphen{}1 HMAC 3730\\ 3731\hline 3732\sphinxAtStartPar 3733aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts aes128\sphinxhyphen{}sha1 3734& 3735\sphinxAtStartPar 3736AES\sphinxhyphen{}128 CTS mode with 96\sphinxhyphen{}bit SHA\sphinxhyphen{}1 HMAC 3737\\ 3738\hline 3739\sphinxAtStartPar 3740aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes256\sphinxhyphen{}sha2 3741& 3742\sphinxAtStartPar 3743AES\sphinxhyphen{}256 CTS mode with 192\sphinxhyphen{}bit SHA\sphinxhyphen{}384 HMAC 3744\\ 3745\hline 3746\sphinxAtStartPar 3747aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 aes128\sphinxhyphen{}sha2 3748& 3749\sphinxAtStartPar 3750AES\sphinxhyphen{}128 CTS mode with 128\sphinxhyphen{}bit SHA\sphinxhyphen{}256 HMAC 3751\\ 3752\hline 3753\sphinxAtStartPar 3754arcfour\sphinxhyphen{}hmac rc4\sphinxhyphen{}hmac arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 3755& 3756\sphinxAtStartPar 3757RC4 with HMAC/MD5 (deprecated) 3758\\ 3759\hline 3760\sphinxAtStartPar 3761arcfour\sphinxhyphen{}hmac\sphinxhyphen{}exp rc4\sphinxhyphen{}hmac\sphinxhyphen{}exp arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5\sphinxhyphen{}exp 3762& 3763\sphinxAtStartPar 3764Exportable RC4 with HMAC/MD5 (weak) 3765\\ 3766\hline 3767\sphinxAtStartPar 3768camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia256\sphinxhyphen{}cts 3769& 3770\sphinxAtStartPar 3771Camellia\sphinxhyphen{}256 CTS mode with CMAC 3772\\ 3773\hline 3774\sphinxAtStartPar 3775camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts 3776& 3777\sphinxAtStartPar 3778Camellia\sphinxhyphen{}128 CTS mode with CMAC 3779\\ 3780\hline 3781\sphinxAtStartPar 3782des3 3783& 3784\sphinxAtStartPar 3785The triple DES family: des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 3786\\ 3787\hline 3788\sphinxAtStartPar 3789aes 3790& 3791\sphinxAtStartPar 3792The AES family: aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96, aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96, aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192, and aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 3793\\ 3794\hline 3795\sphinxAtStartPar 3796rc4 3797& 3798\sphinxAtStartPar 3799The RC4 family: arcfour\sphinxhyphen{}hmac 3800\\ 3801\hline 3802\sphinxAtStartPar 3803camellia 3804& 3805\sphinxAtStartPar 3806The Camellia family: camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac and camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac 3807\\ 3808\hline 3809\end{tabulary} 3810\par 3811\sphinxattableend\end{savenotes} 3812 3813\sphinxAtStartPar 3814The string \sphinxstylestrong{DEFAULT} can be used to refer to the default set of 3815types for the variable in question. Types or families can be removed 3816from the current list by prefixing them with a minus sign (“\sphinxhyphen{}“). 3817Types or families can be prefixed with a plus sign (“+”) for symmetry; 3818it has the same meaning as just listing the type or family. For 3819example, “\sphinxcode{\sphinxupquote{DEFAULT \sphinxhyphen{}rc4}}” would be the default set of encryption 3820types with RC4 types removed, and “\sphinxcode{\sphinxupquote{des3 DEFAULT}}” would be the 3821default set of encryption types with triple DES types moved to the 3822front. 3823 3824\sphinxAtStartPar 3825While \sphinxstylestrong{aes128\sphinxhyphen{}cts} and \sphinxstylestrong{aes256\sphinxhyphen{}cts} are supported for all Kerberos 3826operations, they are not supported by very old versions of our GSSAPI 3827implementation (krb5\sphinxhyphen{}1.3.1 and earlier). Services running versions of 3828krb5 without AES support must not be given keys of these encryption 3829types in the KDC database. 3830 3831\sphinxAtStartPar 3832The \sphinxstylestrong{aes128\sphinxhyphen{}sha2} and \sphinxstylestrong{aes256\sphinxhyphen{}sha2} encryption types are new in 3833release 1.15. Services running versions of krb5 without support for 3834these newer encryption types must not be given keys of these 3835encryption types in the KDC database. 3836 3837 3838\subsubsection{Keysalt lists} 3839\label{\detokenize{admin/conf_files/kdc_conf:keysalt-lists}}\label{\detokenize{admin/conf_files/kdc_conf:id7}} 3840\sphinxAtStartPar 3841Kerberos keys for users are usually derived from passwords. Kerberos 3842commands and configuration parameters that affect generation of keys 3843take lists of enctype\sphinxhyphen{}salttype (“keysalt”) pairs, known as \sphinxstyleemphasis{keysalt 3844lists}. Each keysalt pair is an enctype name followed by a salttype 3845name, in the format \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt}. Individual keysalt list members are 3846separated by comma (“,”) characters or space characters. For example: 3847 3848\begin{sphinxVerbatim}[commandchars=\\\{\}] 3849\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{e} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{p}{:}\PYG{n}{normal} 3850\end{sphinxVerbatim} 3851 3852\sphinxAtStartPar 3853would start up kadmin so that by default it would generate 3854password\sphinxhyphen{}derived keys for the \sphinxstylestrong{aes256\sphinxhyphen{}cts} and \sphinxstylestrong{aes128\sphinxhyphen{}cts} 3855encryption types, using a \sphinxstylestrong{normal} salt. 3856 3857\sphinxAtStartPar 3858To ensure that people who happen to pick the same password do not have 3859the same key, Kerberos 5 incorporates more information into the key 3860using something called a salt. The supported salt types are as 3861follows: 3862 3863 3864\begin{savenotes}\sphinxattablestart 3865\centering 3866\begin{tabulary}{\linewidth}[t]{|T|T|} 3867\hline 3868 3869\sphinxAtStartPar 3870normal 3871& 3872\sphinxAtStartPar 3873default for Kerberos Version 5 3874\\ 3875\hline 3876\sphinxAtStartPar 3877norealm 3878& 3879\sphinxAtStartPar 3880same as the default, without using realm information 3881\\ 3882\hline 3883\sphinxAtStartPar 3884onlyrealm 3885& 3886\sphinxAtStartPar 3887uses only realm information as the salt 3888\\ 3889\hline 3890\sphinxAtStartPar 3891special 3892& 3893\sphinxAtStartPar 3894generate a random salt 3895\\ 3896\hline 3897\end{tabulary} 3898\par 3899\sphinxattableend\end{savenotes} 3900 3901 3902\subsubsection{Sample kdc.conf File} 3903\label{\detokenize{admin/conf_files/kdc_conf:sample-kdc-conf-file}} 3904\sphinxAtStartPar 3905Here’s an example of a kdc.conf file: 3906 3907\begin{sphinxVerbatim}[commandchars=\\\{\}] 3908\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} 3909 \PYG{n}{kdc\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} 3910 \PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} 3911\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 3912 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 3913 \PYG{n}{kadmind\PYGZus{}port} \PYG{o}{=} \PYG{l+m+mi}{749} 3914 \PYG{n}{max\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{12}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} 3915 \PYG{n}{max\PYGZus{}renewable\PYGZus{}life} \PYG{o}{=} \PYG{l+m+mi}{7}\PYG{n}{d} \PYG{l+m+mi}{0}\PYG{n}{h} \PYG{l+m+mi}{0}\PYG{n}{m} \PYG{l+m+mi}{0}\PYG{n}{s} 3916 \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} 3917 \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} 3918 \PYG{n}{database\PYGZus{}module} \PYG{o}{=} \PYG{n}{openldap\PYGZus{}ldapconf} 3919 \PYG{p}{\PYGZcb{}} 3920 3921\PYG{p}{[}\PYG{n}{logging}\PYG{p}{]} 3922 \PYG{n}{kdc} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{log} 3923 \PYG{n}{admin\PYGZus{}server} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{log} 3924 3925\PYG{p}{[}\PYG{n}{dbdefaults}\PYG{p}{]} 3926 \PYG{n}{ldap\PYGZus{}kerberos\PYGZus{}container\PYGZus{}dn} \PYG{o}{=} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{krbcontainer}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{mit}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{edu} 3927 3928\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 3929 \PYG{n}{openldap\PYGZus{}ldapconf} \PYG{o}{=} \PYG{p}{\PYGZob{}} 3930 \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{kldap} 3931 \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} 3932 \PYG{n}{ldap\PYGZus{}kdc\PYGZus{}dn} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=krbadmin,dc=mit,dc=edu}\PYG{l+s+s2}{\PYGZdq{}} 3933 \PYG{c+c1}{\PYGZsh{} this object needs to have read rights on} 3934 \PYG{c+c1}{\PYGZsh{} the realm container and principal subtrees} 3935 \PYG{n}{ldap\PYGZus{}kadmind\PYGZus{}dn} \PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=krbadmin,dc=mit,dc=edu}\PYG{l+s+s2}{\PYGZdq{}} 3936 \PYG{c+c1}{\PYGZsh{} this object needs to have read and write rights on} 3937 \PYG{c+c1}{\PYGZsh{} the realm container and principal subtrees} 3938 \PYG{n}{ldap\PYGZus{}service\PYGZus{}password\PYGZus{}file} \PYG{o}{=} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{/}\PYG{n}{service}\PYG{o}{.}\PYG{n}{keyfile} 3939 \PYG{n}{ldap\PYGZus{}servers} \PYG{o}{=} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 3940 \PYG{n}{ldap\PYGZus{}conns\PYGZus{}per\PYGZus{}server} \PYG{o}{=} \PYG{l+m+mi}{5} 3941 \PYG{p}{\PYGZcb{}} 3942\end{sphinxVerbatim} 3943 3944 3945\subsubsection{FILES} 3946\label{\detokenize{admin/conf_files/kdc_conf:files}} 3947\sphinxAtStartPar 3948{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kdc.conf}} 3949 3950 3951\subsubsection{SEE ALSO} 3952\label{\detokenize{admin/conf_files/kdc_conf:see-also}} 3953\sphinxAtStartPar 3954{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} 3955 3956 3957\subsection{kadm5.acl} 3958\label{\detokenize{admin/conf_files/kadm5_acl:kadm5-acl}}\label{\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}}\label{\detokenize{admin/conf_files/kadm5_acl::doc}} 3959 3960\subsubsection{DESCRIPTION} 3961\label{\detokenize{admin/conf_files/kadm5_acl:description}} 3962\sphinxAtStartPar 3963The Kerberos {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} daemon uses an Access Control List 3964(ACL) file to manage access rights to the Kerberos database. 3965For operations that affect principals, the ACL file also controls 3966which principals can operate on which other principals. 3967 3968\sphinxAtStartPar 3969The default location of the Kerberos ACL file is 3970{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}} unless this is overridden by the \sphinxstyleemphasis{acl\_file} 3971variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 3972 3973 3974\subsubsection{SYNTAX} 3975\label{\detokenize{admin/conf_files/kadm5_acl:syntax}} 3976\sphinxAtStartPar 3977Empty lines and lines starting with the sharp sign (\sphinxcode{\sphinxupquote{\#}}) are 3978ignored. Lines containing ACL entries have the format: 3979 3980\begin{sphinxVerbatim}[commandchars=\\\{\}] 3981\PYG{n}{principal} \PYG{n}{permissions} \PYG{p}{[}\PYG{n}{target\PYGZus{}principal} \PYG{p}{[}\PYG{n}{restrictions}\PYG{p}{]} \PYG{p}{]} 3982\end{sphinxVerbatim} 3983 3984\begin{sphinxadmonition}{note}{Note:} 3985\sphinxAtStartPar 3986Line order in the ACL file is important. The first matching entry 3987will control access for an actor principal on a target principal. 3988\end{sphinxadmonition} 3989\begin{description} 3990\item[{\sphinxstyleemphasis{principal}}] \leavevmode 3991\sphinxAtStartPar 3992(Partially or fully qualified Kerberos principal name.) Specifies 3993the principal whose permissions are to be set. 3994 3995\sphinxAtStartPar 3996Each component of the name may be wildcarded using the \sphinxcode{\sphinxupquote{*}} 3997character. 3998 3999\item[{\sphinxstyleemphasis{permissions}}] \leavevmode 4000\sphinxAtStartPar 4001Specifies what operations may or may not be performed by a 4002\sphinxstyleemphasis{principal} matching a particular entry. This is a string of one or 4003more of the following list of characters or their upper\sphinxhyphen{}case 4004counterparts. If the character is \sphinxstyleemphasis{upper\sphinxhyphen{}case}, then the operation 4005is disallowed. If the character is \sphinxstyleemphasis{lower\sphinxhyphen{}case}, then the operation 4006is permitted. 4007 4008 4009\begin{savenotes}\sphinxattablestart 4010\centering 4011\begin{tabulary}{\linewidth}[t]{|T|T|} 4012\hline 4013 4014\sphinxAtStartPar 4015a 4016& 4017\sphinxAtStartPar 4018{[}Dis{]}allows the addition of principals or policies 4019\\ 4020\hline 4021\sphinxAtStartPar 4022c 4023& 4024\sphinxAtStartPar 4025{[}Dis{]}allows the changing of passwords for principals 4026\\ 4027\hline 4028\sphinxAtStartPar 4029d 4030& 4031\sphinxAtStartPar 4032{[}Dis{]}allows the deletion of principals or policies 4033\\ 4034\hline 4035\sphinxAtStartPar 4036e 4037& 4038\sphinxAtStartPar 4039{[}Dis{]}allows the extraction of principal keys 4040\\ 4041\hline 4042\sphinxAtStartPar 4043i 4044& 4045\sphinxAtStartPar 4046{[}Dis{]}allows inquiries about principals or policies 4047\\ 4048\hline 4049\sphinxAtStartPar 4050l 4051& 4052\sphinxAtStartPar 4053{[}Dis{]}allows the listing of all principals or policies 4054\\ 4055\hline 4056\sphinxAtStartPar 4057m 4058& 4059\sphinxAtStartPar 4060{[}Dis{]}allows the modification of principals or policies 4061\\ 4062\hline 4063\sphinxAtStartPar 4064p 4065& 4066\sphinxAtStartPar 4067{[}Dis{]}allows the propagation of the principal database (used in {\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}}) 4068\\ 4069\hline 4070\sphinxAtStartPar 4071s 4072& 4073\sphinxAtStartPar 4074{[}Dis{]}allows the explicit setting of the key for a principal 4075\\ 4076\hline 4077\sphinxAtStartPar 4078x 4079& 4080\sphinxAtStartPar 4081Short for admcilsp. All privileges (except \sphinxcode{\sphinxupquote{e}}) 4082\\ 4083\hline 4084\sphinxAtStartPar 4085* 4086& 4087\sphinxAtStartPar 4088Same as x. 4089\\ 4090\hline 4091\end{tabulary} 4092\par 4093\sphinxattableend\end{savenotes} 4094 4095\end{description} 4096 4097\begin{sphinxadmonition}{note}{Note:} 4098\sphinxAtStartPar 4099The \sphinxcode{\sphinxupquote{extract}} privilege is not included in the wildcard 4100privilege; it must be explicitly assigned. This privilege 4101allows the user to extract keys from the database, and must be 4102handled with great care to avoid disclosure of important keys 4103like those of the kadmin/* or krbtgt/* principals. The 4104\sphinxstylestrong{lockdown\_keys} principal attribute can be used to prevent 4105key extraction from specific principals regardless of the 4106granted privilege. 4107\end{sphinxadmonition} 4108\begin{description} 4109\item[{\sphinxstyleemphasis{target\_principal}}] \leavevmode 4110\sphinxAtStartPar 4111(Optional. Partially or fully qualified Kerberos principal name.) 4112Specifies the principal on which \sphinxstyleemphasis{permissions} may be applied. 4113Each component of the name may be wildcarded using the \sphinxcode{\sphinxupquote{*}} 4114character. 4115 4116\sphinxAtStartPar 4117\sphinxstyleemphasis{target\_principal} can also include back\sphinxhyphen{}references to \sphinxstyleemphasis{principal}, 4118in which \sphinxcode{\sphinxupquote{*number}} matches the corresponding wildcard in 4119\sphinxstyleemphasis{principal}. 4120 4121\item[{\sphinxstyleemphasis{restrictions}}] \leavevmode 4122\sphinxAtStartPar 4123(Optional) A string of flags. Allowed restrictions are: 4124\begin{quote} 4125\begin{description} 4126\item[{\{+|\sphinxhyphen{}\}\sphinxstyleemphasis{flagname}}] \leavevmode 4127\sphinxAtStartPar 4128flag is forced to the indicated value. The permissible flags 4129are the same as those for the \sphinxstylestrong{default\_principal\_flags} 4130variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 4131 4132\item[{\sphinxstyleemphasis{\sphinxhyphen{}clearpolicy}}] \leavevmode 4133\sphinxAtStartPar 4134policy is forced to be empty. 4135 4136\item[{\sphinxstyleemphasis{\sphinxhyphen{}policy pol}}] \leavevmode 4137\sphinxAtStartPar 4138policy is forced to be \sphinxstyleemphasis{pol}. 4139 4140\item[{\sphinxhyphen{}\{\sphinxstyleemphasis{expire, pwexpire, maxlife, maxrenewlife}\} \sphinxstyleemphasis{time}}] \leavevmode 4141\sphinxAtStartPar 4142(\DUrole{xref,std,std-ref}{getdate} string) associated value will be forced to 4143MIN(\sphinxstyleemphasis{time}, requested value). 4144 4145\end{description} 4146\end{quote} 4147 4148\sphinxAtStartPar 4149The above flags act as restrictions on any add or modify operation 4150which is allowed due to that ACL line. 4151 4152\end{description} 4153 4154\begin{sphinxadmonition}{warning}{Warning:} 4155\sphinxAtStartPar 4156If the kadmind ACL file is modified, the kadmind daemon needs to be 4157restarted for changes to take effect. 4158\end{sphinxadmonition} 4159 4160 4161\subsubsection{EXAMPLE} 4162\label{\detokenize{admin/conf_files/kadm5_acl:example}} 4163\sphinxAtStartPar 4164Here is an example of a kadm5.acl file: 4165 4166\begin{sphinxVerbatim}[commandchars=\\\{\}] 4167\PYG{o}{*}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{*} \PYG{c+c1}{\PYGZsh{} line 1} 4168\PYG{n}{joeadmin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{ADMCIL} \PYG{c+c1}{\PYGZsh{} line 2} 4169\PYG{n}{joeadmin}\PYG{o}{/}\PYG{o}{*}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{i} \PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{c+c1}{\PYGZsh{} line 3} 4170\PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{ci} \PYG{o}{*}\PYG{l+m+mi}{1}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{c+c1}{\PYGZsh{} line 4} 4171\PYG{o}{*}\PYG{o}{/}\PYG{n}{root}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{l} \PYG{o}{*} \PYG{c+c1}{\PYGZsh{} line 5} 4172\PYG{n}{sms}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{x} \PYG{o}{*} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+m+mi}{9}\PYG{n}{h} \PYG{o}{\PYGZhy{}}\PYG{n}{postdateable} \PYG{c+c1}{\PYGZsh{} line 6} 4173\end{sphinxVerbatim} 4174 4175\sphinxAtStartPar 4176(line 1) Any principal in the \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} realm with an 4177\sphinxcode{\sphinxupquote{admin}} instance has all administrative privileges except extracting 4178keys. 4179 4180\sphinxAtStartPar 4181(lines 1\sphinxhyphen{}3) The user \sphinxcode{\sphinxupquote{joeadmin}} has all permissions except 4182extracting keys with his \sphinxcode{\sphinxupquote{admin}} instance, 4183\sphinxcode{\sphinxupquote{joeadmin/admin@ATHENA.MIT.EDU}} (matches line 1). He has no 4184permissions at all with his null instance, \sphinxcode{\sphinxupquote{joeadmin@ATHENA.MIT.EDU}} 4185(matches line 2). His \sphinxcode{\sphinxupquote{root}} and other non\sphinxhyphen{}\sphinxcode{\sphinxupquote{admin}}, non\sphinxhyphen{}null 4186instances (e.g., \sphinxcode{\sphinxupquote{extra}} or \sphinxcode{\sphinxupquote{dbadmin}}) have inquire permissions 4187with any principal that has the instance \sphinxcode{\sphinxupquote{root}} (matches line 3). 4188 4189\sphinxAtStartPar 4190(line 4) Any \sphinxcode{\sphinxupquote{root}} principal in \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} can inquire 4191or change the password of their null instance, but not any other 4192null instance. (Here, \sphinxcode{\sphinxupquote{*1}} denotes a back\sphinxhyphen{}reference to the 4193component matching the first wildcard in the actor principal.) 4194 4195\sphinxAtStartPar 4196(line 5) Any \sphinxcode{\sphinxupquote{root}} principal in \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} can generate 4197the list of principals in the database, and the list of policies 4198in the database. This line is separate from line 4, because list 4199permission can only be granted globally, not to specific target 4200principals. 4201 4202\sphinxAtStartPar 4203(line 6) Finally, the Service Management System principal 4204\sphinxcode{\sphinxupquote{sms@ATHENA.MIT.EDU}} has all permissions except extracting keys, but 4205any principal that it creates or modifies will not be able to get 4206postdateable tickets or tickets with a life of longer than 9 hours. 4207 4208 4209\subsubsection{MODULE BEHAVIOR} 4210\label{\detokenize{admin/conf_files/kadm5_acl:module-behavior}} 4211\sphinxAtStartPar 4212The ACL file can coexist with other authorization modules in release 42131.16 and later, as configured in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:kadm5-auth}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5\_auth interface}}}} section of 4214{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. The ACL file will positively authorize 4215operations according to the rules above, but will never 4216authoritatively deny an operation, so other modules can authorize 4217operations in addition to those authorized by the ACL file. 4218 4219\sphinxAtStartPar 4220To operate without an ACL file, set the \sphinxstyleemphasis{acl\_file} variable in 4221{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} to the empty string with \sphinxcode{\sphinxupquote{acl\_file = ""}}. 4222 4223 4224\subsubsection{SEE ALSO} 4225\label{\detokenize{admin/conf_files/kadm5_acl:see-also}} 4226\sphinxAtStartPar 4227{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} 4228 4229 4230\chapter{Realm configuration decisions} 4231\label{\detokenize{admin/realm_config:realm-configuration-decisions}}\label{\detokenize{admin/realm_config::doc}} 4232\sphinxAtStartPar 4233Before installing Kerberos V5, it is necessary to consider the 4234following issues: 4235\begin{itemize} 4236\item {} 4237\sphinxAtStartPar 4238The name of your Kerberos realm (or the name of each realm, if you 4239need more than one). 4240 4241\item {} 4242\sphinxAtStartPar 4243How you will assign your hostnames to Kerberos realms. 4244 4245\item {} 4246\sphinxAtStartPar 4247Which ports your KDC and and kadmind services will use, if they will 4248not be using the default ports. 4249 4250\item {} 4251\sphinxAtStartPar 4252How many replica KDCs you need and where they should be located. 4253 4254\item {} 4255\sphinxAtStartPar 4256The hostnames of your primary and replica KDCs. 4257 4258\item {} 4259\sphinxAtStartPar 4260How frequently you will propagate the database from the primary KDC 4261to the replica KDCs. 4262 4263\end{itemize} 4264 4265 4266\section{Realm name} 4267\label{\detokenize{admin/realm_config:realm-name}} 4268\sphinxAtStartPar 4269Although your Kerberos realm can be any ASCII string, convention is to 4270make it the same as your domain name, in upper\sphinxhyphen{}case letters. 4271 4272\sphinxAtStartPar 4273For example, hosts in the domain \sphinxcode{\sphinxupquote{example.com}} would be in the 4274Kerberos realm: 4275 4276\begin{sphinxVerbatim}[commandchars=\\\{\}] 4277\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 4278\end{sphinxVerbatim} 4279 4280\sphinxAtStartPar 4281If you need multiple Kerberos realms, MIT recommends that you use 4282descriptive names which end with your domain name, such as: 4283 4284\begin{sphinxVerbatim}[commandchars=\\\{\}] 4285\PYG{n}{BOSTON}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 4286\PYG{n}{HOUSTON}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 4287\end{sphinxVerbatim} 4288 4289 4290\section{Mapping hostnames onto Kerberos realms} 4291\label{\detokenize{admin/realm_config:mapping-hostnames-onto-kerberos-realms}}\label{\detokenize{admin/realm_config:mapping-hostnames}} 4292\sphinxAtStartPar 4293Mapping hostnames onto Kerberos realms is done in one of three ways. 4294 4295\sphinxAtStartPar 4296The first mechanism works through a set of rules in the 4297{\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} section of {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. You can specify 4298mappings for an entire domain or on a per\sphinxhyphen{}hostname basis. Typically 4299you would do this by specifying the mappings for a given domain or 4300subdomain and listing the exceptions. 4301 4302\sphinxAtStartPar 4303The second mechanism is to use KDC host\sphinxhyphen{}based service referrals. With 4304this method, the KDC’s krb5.conf has a full {[}domain\_realm{]} mapping for 4305hosts, but the clients do not, or have mappings for only a subset of 4306the hosts they might contact. When a client needs to contact a server 4307host for which it has no mapping, it will ask the client realm’s KDC 4308for the service ticket, and will receive a referral to the appropriate 4309service realm. 4310 4311\sphinxAtStartPar 4312To use referrals, clients must be running MIT krb5 1.6 or later, and 4313the KDC must be running MIT krb5 1.7 or later. The 4314\sphinxstylestrong{host\_based\_services} and \sphinxstylestrong{no\_host\_referral} variables in the 4315{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section of {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} can be used to 4316fine\sphinxhyphen{}tune referral behavior on the KDC. 4317 4318\sphinxAtStartPar 4319It is also possible for clients to use DNS TXT records, if 4320\sphinxstylestrong{dns\_lookup\_realm} is enabled in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Such lookups 4321are disabled by default because DNS is an insecure protocol and security 4322holes could result if DNS records are spoofed. If enabled, the client 4323will try to look up a TXT record formed by prepending the prefix 4324\sphinxcode{\sphinxupquote{\_kerberos}} to the hostname in question. If that record is not 4325found, the client will attempt a lookup by prepending \sphinxcode{\sphinxupquote{\_kerberos}} to the 4326host’s domain name, then its parent domain, up to the top\sphinxhyphen{}level domain. 4327For the hostname \sphinxcode{\sphinxupquote{boston.engineering.example.com}}, the names looked up 4328would be: 4329 4330\begin{sphinxVerbatim}[commandchars=\\\{\}] 4331\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{boston}\PYG{o}{.}\PYG{n}{engineering}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 4332\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{engineering}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 4333\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 4334\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{com} 4335\end{sphinxVerbatim} 4336 4337\sphinxAtStartPar 4338The value of the first TXT record found is taken as the realm name. 4339 4340\sphinxAtStartPar 4341Even if you do not choose to use this mechanism within your site, 4342you may wish to set it up anyway, for use when interacting with other sites. 4343 4344 4345\section{Ports for the KDC and admin services} 4346\label{\detokenize{admin/realm_config:ports-for-the-kdc-and-admin-services}} 4347\sphinxAtStartPar 4348The default ports used by Kerberos are port 88 for the KDC and port 4349749 for the admin server. You can, however, choose to run on other 4350ports, as long as they are specified in each host’s 4351{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} files or in DNS SRV records, and the 4352{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file on each KDC. For a more thorough treatment of 4353port numbers used by the Kerberos V5 programs, refer to the 4354{\hyperref[\detokenize{admin/appl_servers:conf-firewall}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring your firewall to work with Kerberos V5}}}}. 4355 4356 4357\section{Replica KDCs} 4358\label{\detokenize{admin/realm_config:replica-kdcs}} 4359\sphinxAtStartPar 4360Replica KDCs provide an additional source of Kerberos ticket\sphinxhyphen{}granting 4361services in the event of inaccessibility of the primary KDC. The 4362number of replica KDCs you need and the decision of where to place them, 4363both physically and logically, depends on the specifics of your 4364network. 4365 4366\sphinxAtStartPar 4367Kerberos authentication requires that each client be able to contact a 4368KDC. Therefore, you need to anticipate any likely reason a KDC might 4369be unavailable and have a replica KDC to take up the slack. 4370 4371\sphinxAtStartPar 4372Some considerations include: 4373\begin{itemize} 4374\item {} 4375\sphinxAtStartPar 4376Have at least one replica KDC as a backup, for when the primary KDC 4377is down, is being upgraded, or is otherwise unavailable. 4378 4379\item {} 4380\sphinxAtStartPar 4381If your network is split such that a network outage is likely to 4382cause a network partition (some segment or segments of the network 4383to become cut off or isolated from other segments), have a replica 4384KDC accessible to each segment. 4385 4386\item {} 4387\sphinxAtStartPar 4388If possible, have at least one replica KDC in a different building 4389from the primary, in case of power outages, fires, or other 4390localized disasters. 4391 4392\end{itemize} 4393 4394 4395\section{Hostnames for KDCs} 4396\label{\detokenize{admin/realm_config:hostnames-for-kdcs}}\label{\detokenize{admin/realm_config:kdc-hostnames}} 4397\sphinxAtStartPar 4398MIT recommends that your KDCs have a predefined set of CNAME records 4399(DNS hostname aliases), such as \sphinxcode{\sphinxupquote{kerberos}} for the primary KDC and 4400\sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}1}}, \sphinxcode{\sphinxupquote{kerberos\sphinxhyphen{}2}}, … for the replica KDCs. This way, 4401if you need to swap a machine, you only need to change a DNS entry, 4402rather than having to change hostnames. 4403 4404\sphinxAtStartPar 4405As of MIT krb5 1.4, clients can locate a realm’s KDCs through DNS 4406using SRV records (\index{RFC@\spxentry{RFC}!RFC 2782@\spxentry{RFC 2782}}\sphinxhref{https://tools.ietf.org/html/rfc2782.html}{\sphinxstylestrong{RFC 2782}}), assuming the Kerberos realm name is 4407also a DNS domain name. These records indicate the hostname and port 4408number to contact for that service, optionally with weighting and 4409prioritization. The domain name used in the SRV record name is the 4410realm name. Several different Kerberos\sphinxhyphen{}related service names are 4411used: 4412\begin{description} 4413\item[{\_kerberos.\_udp}] \leavevmode 4414\sphinxAtStartPar 4415This is for contacting any KDC by UDP. This entry will be used 4416the most often. Normally you should list port 88 on each of your 4417KDCs. 4418 4419\item[{\_kerberos.\_tcp}] \leavevmode 4420\sphinxAtStartPar 4421This is for contacting any KDC by TCP. Normally you should use 4422port 88. This entry should be omitted if the KDC does not listen 4423on TCP ports, as was the default prior to release 1.13. 4424 4425\item[{\_kerberos\sphinxhyphen{}master.\_udp}] \leavevmode 4426\sphinxAtStartPar 4427This entry should refer to those KDCs, if any, that will 4428immediately see password changes to the Kerberos database. If a 4429user is logging in and the password appears to be incorrect, the 4430client will retry with the primary KDC before failing with an 4431“incorrect password” error given. 4432 4433\sphinxAtStartPar 4434If you have only one KDC, or for whatever reason there is no 4435accessible KDC that would get database changes faster than the 4436others, you do not need to define this entry. 4437 4438\item[{\_kerberos\sphinxhyphen{}adm.\_tcp}] \leavevmode 4439\sphinxAtStartPar 4440This should list port 749 on your primary KDC. Support for it is 4441not complete at this time, but it will eventually be used by the 4442{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program and related utilities. For now, you will 4443also need the \sphinxstylestrong{admin\_server} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. 4444 4445\item[{\_kerberos\sphinxhyphen{}master.\_tcp}] \leavevmode 4446\sphinxAtStartPar 4447The corresponding TCP port for \_kerberos\sphinxhyphen{}master.\_udp, assuming the 4448primary KDC listens on a TCP port. 4449 4450\item[{\_kpasswd.\_udp}] \leavevmode 4451\sphinxAtStartPar 4452This entry should list port 464 on your primary KDC. It is used 4453when a user changes her password. If this entry is not defined 4454but a \_kerberos\sphinxhyphen{}adm.\_tcp entry is defined, the client will use the 4455\_kerberos\sphinxhyphen{}adm.\_tcp entry with the port number changed to 464. 4456 4457\item[{\_kpasswd.\_tcp}] \leavevmode 4458\sphinxAtStartPar 4459The corresponding TCP port for \_kpasswd.\_udp. 4460 4461\end{description} 4462 4463\sphinxAtStartPar 4464The DNS SRV specification requires that the hostnames listed be the 4465canonical names, not aliases. So, for example, you might include the 4466following records in your (BIND\sphinxhyphen{}style) zone file: 4467 4468\begin{sphinxVerbatim}[commandchars=\\\{\}] 4469\PYGZdl{}ORIGIN foobar.com. 4470\PYGZus{}kerberos TXT \PYGZdq{}FOOBAR.COM\PYGZdq{} 4471kerberos CNAME daisy 4472kerberos\PYGZhy{}1 CNAME use\PYGZhy{}the\PYGZhy{}force\PYGZhy{}luke 4473kerberos\PYGZhy{}2 CNAME bunny\PYGZhy{}rabbit 4474\PYGZus{}kerberos.\PYGZus{}udp SRV 0 0 88 daisy 4475 SRV 0 0 88 use\PYGZhy{}the\PYGZhy{}force\PYGZhy{}luke 4476 SRV 0 0 88 bunny\PYGZhy{}rabbit 4477\PYGZus{}kerberos\PYGZhy{}master.\PYGZus{}udp SRV 0 0 88 daisy 4478\PYGZus{}kerberos\PYGZhy{}adm.\PYGZus{}tcp SRV 0 0 749 daisy 4479\PYGZus{}kpasswd.\PYGZus{}udp SRV 0 0 464 daisy 4480\end{sphinxVerbatim} 4481 4482\sphinxAtStartPar 4483Clients can also be configured with the explicit location of services 4484using the \sphinxstylestrong{kdc}, \sphinxstylestrong{master\_kdc}, \sphinxstylestrong{admin\_server}, and 4485\sphinxstylestrong{kpasswd\_server} variables in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section of 4486{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Even if some clients will be configured with 4487explicit server locations, providing SRV records will still benefit 4488unconfigured clients, and be useful for other sites. 4489 4490 4491\section{KDC Discovery} 4492\label{\detokenize{admin/realm_config:kdc-discovery}}\label{\detokenize{admin/realm_config:id1}} 4493\sphinxAtStartPar 4494As of MIT krb5 1.15, clients can also locate KDCs in DNS through URI 4495records (\index{RFC@\spxentry{RFC}!RFC 7553@\spxentry{RFC 7553}}\sphinxhref{https://tools.ietf.org/html/rfc7553.html}{\sphinxstylestrong{RFC 7553}}). Limitations with the SRV record format may 4496result in extra DNS queries in situations where a client must failover 4497to other transport types, or find a primary server. The URI record 4498can convey more information about a realm’s KDCs with a single query. 4499 4500\sphinxAtStartPar 4501The client performs a query for the following URI records: 4502\begin{itemize} 4503\item {} 4504\sphinxAtStartPar 4505\sphinxcode{\sphinxupquote{\_kerberos.REALM}} for finding KDCs. 4506 4507\item {} 4508\sphinxAtStartPar 4509\sphinxcode{\sphinxupquote{\_kerberos\sphinxhyphen{}adm.REALM}} for finding kadmin services. 4510 4511\item {} 4512\sphinxAtStartPar 4513\sphinxcode{\sphinxupquote{\_kpasswd.REALM}} for finding password services. 4514 4515\end{itemize} 4516 4517\sphinxAtStartPar 4518The URI record includes a priority, weight, and a URI string that 4519consists of case\sphinxhyphen{}insensitive colon separated fields, in the form 4520\sphinxcode{\sphinxupquote{scheme:{[}flags{]}:transport:residual}}. 4521\begin{itemize} 4522\item {} 4523\sphinxAtStartPar 4524\sphinxstyleemphasis{scheme} defines the registered URI type. It should always be 4525\sphinxcode{\sphinxupquote{krb5srv}}. 4526 4527\item {} 4528\sphinxAtStartPar 4529\sphinxstyleemphasis{flags} contains zero or more flag characters. Currently the only 4530valid flag is \sphinxcode{\sphinxupquote{m}}, which indicates that the record is for a 4531primary server. 4532 4533\item {} 4534\sphinxAtStartPar 4535\sphinxstyleemphasis{transport} defines the transport type of the residual URL or 4536address. Accepted values are \sphinxcode{\sphinxupquote{tcp}}, \sphinxcode{\sphinxupquote{udp}}, or \sphinxcode{\sphinxupquote{kkdcp}} for the 4537MS\sphinxhyphen{}KKDCP type. 4538 4539\item {} 4540\sphinxAtStartPar 4541\sphinxstyleemphasis{residual} contains the hostname, IP address, or URL to be 4542contacted using the specified transport, with an optional port 4543extension. The MS\sphinxhyphen{}KKDCP transport type uses a HTTPS URL, and can 4544include a port and/or path extension. 4545 4546\end{itemize} 4547 4548\sphinxAtStartPar 4549An example of URI records in a zone file: 4550 4551\begin{sphinxVerbatim}[commandchars=\\\{\}] 4552\PYG{n}{\PYGZus{}kerberos}\PYG{o}{.}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{URI} \PYG{l+m+mi}{10} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{n}{m}\PYG{p}{:}\PYG{n}{tcp}\PYG{p}{:}\PYG{n}{kdc1}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} 4553 \PYG{n}{URI} \PYG{l+m+mi}{20} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{n}{m}\PYG{p}{:}\PYG{n}{udp}\PYG{p}{:}\PYG{n}{kdc2}\PYG{o}{.}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com}\PYG{p}{:}\PYG{l+m+mi}{89} 4554 \PYG{n}{URI} \PYG{l+m+mi}{40} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{p}{:}\PYG{n}{udp}\PYG{p}{:}\PYG{l+m+mf}{10.10}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.23} 4555 \PYG{n}{URI} \PYG{l+m+mi}{30} \PYG{l+m+mi}{1} \PYG{n}{krb5srv}\PYG{p}{:}\PYG{p}{:}\PYG{n}{kkdcp}\PYG{p}{:}\PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{proxy}\PYG{p}{:}\PYG{l+m+mi}{89}\PYG{o}{/}\PYG{n}{auth} 4556\end{sphinxVerbatim} 4557 4558\sphinxAtStartPar 4559URI lookups are enabled by default, and can be disabled by setting 4560\sphinxstylestrong{dns\_uri\_lookup} in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section of 4561{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} to False. When enabled, URI lookups take 4562precedence over SRV lookups, falling back to SRV lookups if no URI 4563records are found. 4564 4565 4566\section{Database propagation} 4567\label{\detokenize{admin/realm_config:database-propagation}}\label{\detokenize{admin/realm_config:db-prop}} 4568\sphinxAtStartPar 4569The Kerberos database resides on the primary KDC, and must be 4570propagated regularly (usually by a cron job) to the replica KDCs. In 4571deciding how frequently the propagation should happen, you will need 4572to balance the amount of time the propagation takes against the 4573maximum reasonable amount of time a user should have to wait for a 4574password change to take effect. 4575 4576\sphinxAtStartPar 4577If the propagation time is longer than this maximum reasonable time 4578(e.g., you have a particularly large database, you have a lot of 4579replicas, or you experience frequent network delays), you may wish to 4580cut down on your propagation delay by performing the propagation in 4581parallel. To do this, have the primary KDC propagate the database to 4582one set of replicas, and then have each of these replicas propagate 4583the database to additional replicas. 4584 4585\sphinxAtStartPar 4586See also {\hyperref[\detokenize{admin/database:incr-db-prop}]{\sphinxcrossref{\DUrole{std,std-ref}{Incremental database propagation}}}} 4587 4588 4589\chapter{Database administration} 4590\label{\detokenize{admin/database:database-administration}}\label{\detokenize{admin/database::doc}} 4591\sphinxAtStartPar 4592A Kerberos database contains all of a realm’s Kerberos principals, 4593their passwords, and other administrative information about each 4594principal. For the most part, you will use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} 4595program to manipulate the Kerberos database as a whole, and the 4596{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program to make changes to the entries in the 4597database. (One notable exception is that users will use the 4598\DUrole{xref,std,std-ref}{kpasswd(1)} program to change their own passwords.) The kadmin 4599program has its own command\sphinxhyphen{}line interface, to which you type the 4600database administrating commands. 4601 4602\sphinxAtStartPar 4603{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} provides a means to create, delete, load, or dump 4604a Kerberos database. It also contains commands to roll over the 4605database master key, and to stash a copy of the key so that the 4606{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} and {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemons can use the database 4607without manual input. 4608 4609\sphinxAtStartPar 4610{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} provides for the maintenance of Kerberos principals, 4611password policies, and service key tables (keytabs). Normally it 4612operates as a network client using Kerberos authentication to 4613communicate with {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}, but there is also a variant, named 4614kadmin.local, which directly accesses the Kerberos database on the 4615local filesystem (or through LDAP). kadmin.local is necessary to set 4616up enough of the database to be able to use the remote version. 4617 4618\sphinxAtStartPar 4619kadmin can authenticate to the admin server using the service 4620principal \sphinxcode{\sphinxupquote{kadmin/admin}} or \sphinxcode{\sphinxupquote{kadmin/HOST}} (where \sphinxstyleemphasis{HOST} is the 4621hostname of the admin server). If the credentials cache contains a 4622ticket for either service principal and the \sphinxstylestrong{\sphinxhyphen{}c} ccache option is 4623specified, that ticket is used to authenticate to KADM5. Otherwise, 4624the \sphinxstylestrong{\sphinxhyphen{}p} and \sphinxstylestrong{\sphinxhyphen{}k} options are used to specify the client Kerberos 4625principal name used to authenticate. Once kadmin has determined the 4626principal name, it requests a \sphinxcode{\sphinxupquote{kadmin/admin}} Kerberos service ticket 4627from the KDC, and uses that service ticket to authenticate to KADM5. 4628 4629\sphinxAtStartPar 4630See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for the available kadmin and kadmin.local 4631commands and options. 4632 4633 4634\section{Principals} 4635\label{\detokenize{admin/database:principals}}\label{\detokenize{admin/database:id1}} 4636\sphinxAtStartPar 4637Each entry in the Kerberos database contains a Kerberos principal and 4638the attributes and policies associated with that principal. 4639 4640\sphinxAtStartPar 4641To add a principal to the database, use the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} 4642\sphinxstylestrong{add\_principal} command. User principals should usually be created 4643with the \sphinxcode{\sphinxupquote{+requires\_preauth \sphinxhyphen{}allow\_svr}} options to help mitigate 4644dictionary attacks (see {\hyperref[\detokenize{admin/dictionary:dictionary}]{\sphinxcrossref{\DUrole{std,std-ref}{Addressing dictionary attack risks}}}}): 4645 4646\begin{sphinxVerbatim}[commandchars=\\\{\}] 4647\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{alice} 4648\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 4649\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 4650\end{sphinxVerbatim} 4651 4652\sphinxAtStartPar 4653User principals which will authenticate with {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT configuration}}}} should 4654instead by created with the \sphinxcode{\sphinxupquote{\sphinxhyphen{}nokey}} option: 4655\begin{quote} 4656 4657\sphinxAtStartPar 4658kadmin: addprinc \sphinxhyphen{}nokey alice 4659\end{quote} 4660 4661\sphinxAtStartPar 4662Service principals can be created with the \sphinxcode{\sphinxupquote{\sphinxhyphen{}nokey}} option; 4663long\sphinxhyphen{}term keys will be added when a keytab is generated: 4664 4665\begin{sphinxVerbatim}[commandchars=\\\{\}] 4666\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{nokey} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 4667\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 4668\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 4669\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 4670\end{sphinxVerbatim} 4671 4672\sphinxAtStartPar 4673To modify attributes of an existing principal, use the kadmin 4674\sphinxstylestrong{modify\_principal} command: 4675 4676\begin{sphinxVerbatim}[commandchars=\\\{\}] 4677\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{expire} \PYG{n}{tomorrow} \PYG{n}{alice} 4678\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{alice@KRBTEST.COM}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{modified}\PYG{o}{.} 4679\end{sphinxVerbatim} 4680 4681\sphinxAtStartPar 4682To delete a principal, use the kadmin \sphinxstylestrong{delete\_principal} command: 4683 4684\begin{sphinxVerbatim}[commandchars=\\\{\}] 4685kadmin: delprinc alice 4686Are you sure you want to delete the principal \PYGZdq{}alice@KRBTEST.COM\PYGZdq{}? (yes/no): yes 4687Principal \PYGZdq{}alice@KRBTEST.COM\PYGZdq{} deleted. 4688Make sure that you have removed this principal from all ACLs before reusing. 4689\end{sphinxVerbatim} 4690 4691\sphinxAtStartPar 4692To change a principal’s password, use the kadmin \sphinxstylestrong{change\_password} 4693command. Password changes made through kadmin are subject to the same 4694password policies as would apply to password changes made through 4695\DUrole{xref,std,std-ref}{kpasswd(1)}. 4696 4697\sphinxAtStartPar 4698To view the attributes of a principal, use the kadmin\textasciigrave{} 4699\sphinxstylestrong{get\_principal} command. 4700 4701\sphinxAtStartPar 4702To generate a listing of principals, use the kadmin 4703\sphinxstylestrong{list\_principals} command. 4704 4705 4706\section{Policies} 4707\label{\detokenize{admin/database:policies}}\label{\detokenize{admin/database:id2}} 4708\sphinxAtStartPar 4709A policy is a set of rules governing passwords. Policies can dictate 4710minimum and maximum password lifetimes, minimum number of characters 4711and character classes a password must contain, and the number of old 4712passwords kept in the database. 4713 4714\sphinxAtStartPar 4715To add a new policy, use the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{add\_policy} command: 4716 4717\begin{sphinxVerbatim}[commandchars=\\\{\}] 4718\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addpol} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 year}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{history} \PYG{l+m+mi}{3} \PYG{n}{stduser} 4719\end{sphinxVerbatim} 4720 4721\sphinxAtStartPar 4722To modify attributes of a principal, use the kadmin \sphinxstylestrong{modify\_policy} 4723command. To delete a policy, use the kadmin \sphinxstylestrong{delete\_policy} 4724command. 4725 4726\sphinxAtStartPar 4727To associate a policy with a principal, use the kadmin 4728\sphinxstylestrong{modify\_principal} command with the \sphinxstylestrong{\sphinxhyphen{}policy} option: 4729\begin{quote} 4730 4731\sphinxAtStartPar 4732kadmin: modprinc \sphinxhyphen{}policy stduser alice 4733Principal “\sphinxhref{mailto:alice@KRBTEST.COM}{alice@KRBTEST.COM}” modified. 4734\end{quote} 4735 4736\sphinxAtStartPar 4737A principal entry may be associated with a nonexistent policy, either 4738because the policy did not exist at the time of associated or was 4739deleted afterwards. kadmin will warn when associated a principal with 4740a nonexistent policy, and will annotate the policy name with “{[}does 4741not exist{]}” in the \sphinxstylestrong{get\_principal} output. 4742 4743 4744\subsection{Updating the history key} 4745\label{\detokenize{admin/database:updating-the-history-key}}\label{\detokenize{admin/database:updating-history-key}} 4746\sphinxAtStartPar 4747If a policy specifies a number of old keys kept of two or more, the 4748stored old keys are encrypted in a history key, which is found in the 4749key data of the \sphinxcode{\sphinxupquote{kadmin/history}} principal. 4750 4751\sphinxAtStartPar 4752Currently there is no support for proper rollover of the history key, 4753but you can change the history key (for example, to use a better 4754encryption type) at the cost of invalidating currently stored old 4755keys. To change the history key, run: 4756 4757\begin{sphinxVerbatim}[commandchars=\\\{\}] 4758\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{change\PYGZus{}password} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{history} 4759\end{sphinxVerbatim} 4760 4761\sphinxAtStartPar 4762This command will fail if you specify the \sphinxstylestrong{\sphinxhyphen{}keepold} flag. Only one 4763new history key will be created, even if you specify multiple key/salt 4764combinations. 4765 4766\sphinxAtStartPar 4767In the future, we plan to migrate towards encrypting old keys in the 4768master key instead of the history key, and implementing proper 4769rollover support for stored old keys. 4770 4771 4772\section{Privileges} 4773\label{\detokenize{admin/database:privileges}}\label{\detokenize{admin/database:id3}} 4774\sphinxAtStartPar 4775Administrative privileges for the Kerberos database are stored in the 4776file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}. 4777 4778\begin{sphinxadmonition}{note}{Note:} 4779\sphinxAtStartPar 4780A common use of an admin instance is so you can grant 4781separate permissions (such as administrator access to the 4782Kerberos database) to a separate Kerberos principal. For 4783example, the user \sphinxcode{\sphinxupquote{joeadmin}} might have a principal for 4784his administrative use, called \sphinxcode{\sphinxupquote{joeadmin/admin}}. This 4785way, \sphinxcode{\sphinxupquote{joeadmin}} would obtain \sphinxcode{\sphinxupquote{joeadmin/admin}} tickets 4786only when he actually needs to use those permissions. 4787\end{sphinxadmonition} 4788 4789 4790\section{Operations on the Kerberos database} 4791\label{\detokenize{admin/database:operations-on-the-kerberos-database}}\label{\detokenize{admin/database:db-operations}} 4792\sphinxAtStartPar 4793The {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} command is the primary tool for administrating 4794the Kerberos database when using the DB2 or LMDB modules (see 4795{\hyperref[\detokenize{admin/dbtypes:dbtypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Database types}}}}). Creating a database is described in 4796{\hyperref[\detokenize{admin/install_kdc:create-db}]{\sphinxcrossref{\DUrole{std,std-ref}{Create the KDC database}}}}. 4797 4798\sphinxAtStartPar 4799To create a stash file using the master password (because the database 4800was not created with one using the \sphinxcode{\sphinxupquote{create \sphinxhyphen{}s}} flag, or after 4801restoring from a backup which did not contain the stash file), use the 4802kdb5\_util \sphinxstylestrong{stash} command: 4803 4804\begin{sphinxVerbatim}[commandchars=\\\{\}] 4805\PYGZdl{} kdb5\PYGZus{}util stash 4806kdb5\PYGZus{}util: Cannot find/read stored master key while reading master key 4807kdb5\PYGZus{}util: Warning: proceeding without master key 4808Enter KDC database master key: \PYGZlt{}= Type the KDC database master password. 4809\end{sphinxVerbatim} 4810 4811\sphinxAtStartPar 4812To destroy a database, use the kdb5\_util destroy command: 4813 4814\begin{sphinxVerbatim}[commandchars=\\\{\}] 4815\PYGZdl{} kdb5\PYGZus{}util destroy 4816Deleting KDC database stored in \PYGZsq{}/var/krb5kdc/principal\PYGZsq{}, are you sure? 4817(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes 4818OK, deleting database \PYGZsq{}/var/krb5kdc/principal\PYGZsq{}... 4819** Database \PYGZsq{}/var/krb5kdc/principal\PYGZsq{} destroyed. 4820\end{sphinxVerbatim} 4821 4822 4823\subsection{Dumping and loading a Kerberos database} 4824\label{\detokenize{admin/database:dumping-and-loading-a-kerberos-database}}\label{\detokenize{admin/database:restore-from-dump}} 4825\sphinxAtStartPar 4826To dump a Kerberos database into a text file for backup or transfer 4827purposes, use the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{dump} command on one of the 4828KDCs: 4829 4830\begin{sphinxVerbatim}[commandchars=\\\{\}] 4831\PYGZdl{} kdb5\PYGZus{}util dump dumpfile 4832 4833\PYGZdl{} kbd5\PYGZus{}util dump \PYGZhy{}verbose dumpfile 4834kadmin/admin@ATHENA.MIT.EDU 4835krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU 4836kadmin/history@ATHENA.MIT.EDU 4837K/M@ATHENA.MIT.EDU 4838kadmin/changepw@ATHENA.MIT.EDU 4839\end{sphinxVerbatim} 4840 4841\sphinxAtStartPar 4842You may specify which principals to dump, using full principal names 4843including realm: 4844 4845\begin{sphinxVerbatim}[commandchars=\\\{\}] 4846\PYGZdl{} kdb5\PYGZus{}util dump \PYGZhy{}verbose someprincs K/M@ATHENA.MIT.EDU kadmin/admin@ATHENA.MIT.EDU 4847kadmin/admin@ATHENA.MIT.EDU 4848K/M@ATHENA.MIT.EDU 4849\end{sphinxVerbatim} 4850 4851\sphinxAtStartPar 4852To restore a Kerberos database dump from a file, use the 4853{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{load} command: 4854 4855\begin{sphinxVerbatim}[commandchars=\\\{\}] 4856\PYGZdl{} kdb5\PYGZus{}util load dumpfile 4857\end{sphinxVerbatim} 4858 4859\sphinxAtStartPar 4860To update an existing database with a partial dump file containing 4861only some principals, use the \sphinxcode{\sphinxupquote{\sphinxhyphen{}update}} flag: 4862 4863\begin{sphinxVerbatim}[commandchars=\\\{\}] 4864\PYGZdl{} kdb5\PYGZus{}util load \PYGZhy{}update someprincs 4865\end{sphinxVerbatim} 4866 4867\begin{sphinxadmonition}{note}{Note:} 4868\sphinxAtStartPar 4869If the database file exists, and the \sphinxstyleemphasis{\sphinxhyphen{}update} flag was not 4870given, \sphinxstyleemphasis{kdb5\_util} will overwrite the existing database. 4871\end{sphinxadmonition} 4872 4873 4874\subsection{Updating the master key} 4875\label{\detokenize{admin/database:updating-the-master-key}}\label{\detokenize{admin/database:updating-master-key}} 4876\sphinxAtStartPar 4877Starting with release 1.7, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} allows the master key 4878to be changed using a rollover process, with minimal loss of 4879availability. To roll over the master key, follow these steps: 4880\begin{enumerate} 4881\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 4882\item {} 4883\sphinxAtStartPar 4884On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util list\_mkeys}} to view the 4885current master key version number (KVNO). If you have never rolled 4886over the master key before, this will likely be version 1: 4887 4888\begin{sphinxVerbatim}[commandchars=\\\{\}] 4889\PYGZdl{} kdb5\PYGZus{}util list\PYGZus{}mkeys 4890Master keys for Principal: K/M@KRBTEST.COM 4891KVNO: 1, Enctype: aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192, Active on: Thu Jan 01 00:00:00 UTC 1970 * 4892\end{sphinxVerbatim} 4893 4894\item {} 4895\sphinxAtStartPar 4896On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util use\_mkey 1}} to ensure that a 4897master key activation list is present in the database. This step 4898is unnecessary in release 1.11.4 or later, or if the database was 4899initially created with release 1.7 or later. 4900 4901\item {} 4902\sphinxAtStartPar 4903On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util add\_mkey \sphinxhyphen{}s}} to create a new 4904master key and write it to the stash file. Enter a secure password 4905when prompted. If this is the first time you are changing the 4906master key, the new key will have version 2. The new master key 4907will not be used until you make it active. 4908 4909\item {} 4910\sphinxAtStartPar 4911Propagate the database to all replica KDCs, either manually or by 4912waiting until the next scheduled propagation. If you do not have 4913any replica KDCs, you can skip this and the next step. 4914 4915\item {} 4916\sphinxAtStartPar 4917On each replica KDC, run \sphinxcode{\sphinxupquote{kdb5\_util list\_mkeys}} to verify that 4918the new master key is present, and then \sphinxcode{\sphinxupquote{kdb5\_util stash}} to 4919write the new master key to the replica KDC’s stash file. 4920 4921\item {} 4922\sphinxAtStartPar 4923On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util use\_mkey 2}} to begin using the 4924new master key. Replace \sphinxcode{\sphinxupquote{2}} with the version of the new master 4925key, as appropriate. You can optionally specify a date for the new 4926master key to become active; by default, it will become active 4927immediately. Prior to release 1.12, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} must be 4928restarted for this change to take full effect. 4929 4930\item {} 4931\sphinxAtStartPar 4932On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util update\_princ\_encryption}}. 4933This command will iterate over the database and re\sphinxhyphen{}encrypt all keys 4934in the new master key. If the database is large and uses DB2, the 4935primary KDC will become unavailable while this command runs, but 4936clients should fail over to replica KDCs (if any are present) 4937during this time period. In release 1.13 and later, you can 4938instead run \sphinxcode{\sphinxupquote{kdb5\_util \sphinxhyphen{}x unlockiter update\_princ\_encryption}} to 4939use unlocked iteration; this variant will take longer, but will 4940keep the database available to the KDC and kadmind while it runs. 4941 4942\item {} 4943\sphinxAtStartPar 4944Wait until the above changes have propagated to all replica KDCs 4945and until all running KDC and kadmind processes have serviced 4946requests using updated principal entries. 4947 4948\item {} 4949\sphinxAtStartPar 4950On the primary KDC, run \sphinxcode{\sphinxupquote{kdb5\_util purge\_mkeys}} to clean up the 4951old master key. 4952 4953\end{enumerate} 4954 4955 4956\section{Operations on the LDAP database} 4957\label{\detokenize{admin/database:operations-on-the-ldap-database}}\label{\detokenize{admin/database:ops-on-ldap}} 4958\sphinxAtStartPar 4959The {\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}} command is the primary tool for 4960administrating the Kerberos database when using the LDAP module. 4961Creating an LDAP Kerberos database is describe in {\hyperref[\detokenize{admin/conf_ldap:conf-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end}}}}. 4962 4963\sphinxAtStartPar 4964To view a list of realms in the LDAP database, use the kdb5\_ldap\_util 4965\sphinxstylestrong{list} command: 4966 4967\begin{sphinxVerbatim}[commandchars=\\\{\}] 4968\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util list 4969KRBTEST.COM 4970\end{sphinxVerbatim} 4971 4972\sphinxAtStartPar 4973To modify the attributes of a realm, use the kdb5\_ldap\_util \sphinxstylestrong{modify} 4974command. For example, to change the default realm’s maximum ticket 4975life: 4976 4977\begin{sphinxVerbatim}[commandchars=\\\{\}] 4978\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util modify \PYGZhy{}maxtktlife \PYGZdq{}10 hours\PYGZdq{} 4979\end{sphinxVerbatim} 4980 4981\sphinxAtStartPar 4982To display the attributes of a realm, use the kdb5\_ldap\_util \sphinxstylestrong{view} 4983command: 4984 4985\begin{sphinxVerbatim}[commandchars=\\\{\}] 4986\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util view 4987 Realm Name: KRBTEST.COM 4988 Maximum Ticket Life: 0 days 00:10:00 4989\end{sphinxVerbatim} 4990 4991\sphinxAtStartPar 4992To remove a realm from the LDAP database, destroying its contents, use 4993the kdb5\_ldap\_util \sphinxstylestrong{destroy} command: 4994 4995\begin{sphinxVerbatim}[commandchars=\\\{\}] 4996\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util destroy 4997Deleting KDC database of \PYGZsq{}KRBTEST.COM\PYGZsq{}, are you sure? 4998(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes 4999OK, deleting database of \PYGZsq{}KRBTEST.COM\PYGZsq{}... 5000** Database of \PYGZsq{}KRBTEST.COM\PYGZsq{} destroyed. 5001\end{sphinxVerbatim} 5002 5003 5004\subsection{Ticket Policy operations} 5005\label{\detokenize{admin/database:ticket-policy-operations}} 5006\sphinxAtStartPar 5007Unlike the DB2 and LMDB modules, the LDAP module supports ticket 5008policy objects, which can be associated with principals to restrict 5009maximum ticket lifetimes and set mandatory principal flags. Ticket 5010policy objects are distinct from the password policies described 5011earlier on this page, and are chiefly managed through kdb5\_ldap\_util 5012rather than kadmin. To create a new ticket policy, use the 5013kdb5\_ldap\_util \sphinxstylestrong{create\_policy} command: 5014 5015\begin{sphinxVerbatim}[commandchars=\\\{\}] 5016\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util create\PYGZus{}policy \PYGZhy{}maxrenewlife \PYGZdq{}2 days\PYGZdq{} users 5017\end{sphinxVerbatim} 5018 5019\sphinxAtStartPar 5020To associate a ticket policy with a principal, use the 5021{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{modify\_principal} (or \sphinxstylestrong{add\_principal}) command 5022with the \sphinxstylestrong{\sphinxhyphen{}x tktpolicy=}\sphinxstyleemphasis{policy} option: 5023 5024\begin{sphinxVerbatim}[commandchars=\\\{\}] 5025\PYGZdl{} kadmin.local modprinc \PYGZhy{}x tktpolicy=users alice 5026\end{sphinxVerbatim} 5027 5028\sphinxAtStartPar 5029To remove a ticket policy reference from a principal, use the same 5030command with an empty \sphinxstyleemphasis{policy}: 5031 5032\begin{sphinxVerbatim}[commandchars=\\\{\}] 5033\PYGZdl{} kadmin.local modprinc \PYGZhy{}x tktpolicy= alice 5034\end{sphinxVerbatim} 5035 5036\sphinxAtStartPar 5037To list the existing ticket policy objects, use the kdb5\_ldap\_util 5038\sphinxstylestrong{list\_policy} command: 5039 5040\begin{sphinxVerbatim}[commandchars=\\\{\}] 5041\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util list\PYGZus{}policy 5042users 5043\end{sphinxVerbatim} 5044 5045\sphinxAtStartPar 5046To modify the attributes of a ticket policy object, use the 5047kdb5\_ldap\_util \sphinxstylestrong{modify\_policy} command: 5048 5049\begin{sphinxVerbatim}[commandchars=\\\{\}] 5050\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util modify\PYGZus{}policy \PYGZhy{}allow\PYGZus{}svr +requires\PYGZus{}preauth users 5051\end{sphinxVerbatim} 5052 5053\sphinxAtStartPar 5054To view the attributes of a ticket policy object, use the 5055kdb5\_ldap\_util \sphinxstylestrong{view\_policy} command: 5056 5057\begin{sphinxVerbatim}[commandchars=\\\{\}] 5058\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util view\PYGZus{}policy users 5059 Ticket policy: users 5060 Maximum renewable life: 2 days 00:00:00 5061 Ticket flags: REQUIRES\PYGZus{}PRE\PYGZus{}AUTH DISALLOW\PYGZus{}SVR 5062\end{sphinxVerbatim} 5063 5064\sphinxAtStartPar 5065To destroy an ticket policy object, use the kdb5\_ldap\_util 5066\sphinxstylestrong{destroy\_policy} command: 5067 5068\begin{sphinxVerbatim}[commandchars=\\\{\}] 5069\PYGZdl{} kdb5\PYGZus{}ldap\PYGZus{}util destroy\PYGZus{}policy users 5070This will delete the policy object \PYGZsq{}users\PYGZsq{}, are you sure? 5071(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes 5072** policy object \PYGZsq{}users\PYGZsq{} deleted. 5073\end{sphinxVerbatim} 5074 5075 5076\section{Cross\sphinxhyphen{}realm authentication} 5077\label{\detokenize{admin/database:cross-realm-authentication}}\label{\detokenize{admin/database:xrealm-authn}} 5078\sphinxAtStartPar 5079In order for a KDC in one realm to authenticate Kerberos users in a 5080different realm, it must share a key with the KDC in the other realm. 5081In both databases, there must be krbtgt service principals for both realms. 5082For example, if you need to do cross\sphinxhyphen{}realm authentication between the realms 5083\sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} and \sphinxcode{\sphinxupquote{EXAMPLE.COM}}, you would need to add the 5084principals \sphinxcode{\sphinxupquote{krbtgt/EXAMPLE.COM@ATHENA.MIT.EDU}} and 5085\sphinxcode{\sphinxupquote{krbtgt/ATHENA.MIT.EDU@EXAMPLE.COM}} to both databases. 5086These principals must all have the same passwords, key version 5087numbers, and encryption types; this may require explicitly setting 5088the key version number with the \sphinxstylestrong{\sphinxhyphen{}kvno} option. 5089 5090\sphinxAtStartPar 5091In the ATHENA.MIT.EDU and EXAMPLE.COM cross\sphinxhyphen{}realm case, the administrators 5092would run the following commands on the KDCs in both realms: 5093 5094\begin{sphinxVerbatim}[commandchars=\\\{\}] 5095\PYG{n}{shell}\PYG{o}{\PYGZpc{}}\PYG{p}{:} \PYG{n}{kadmin}\PYG{o}{.}\PYG{n}{local} \PYG{o}{\PYGZhy{}}\PYG{n}{e} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{aes256\PYGZhy{}cts:normal}\PYG{l+s+s2}{\PYGZdq{}} 5096\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 5097\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 5098\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 5099\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 5100\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} 5101\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{EXAMPLE}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} 5102\PYG{n}{kadmin}\PYG{p}{:} 5103\end{sphinxVerbatim} 5104 5105\begin{sphinxadmonition}{note}{Note:} 5106\sphinxAtStartPar 5107Even if most principals in a realm are generally created 5108with the \sphinxstylestrong{requires\_preauth} flag enabled, this flag is not 5109desirable on cross\sphinxhyphen{}realm authentication keys because doing 5110so makes it impossible to disable preauthentication on a 5111service\sphinxhyphen{}by\sphinxhyphen{}service basis. Disabling it as in the example 5112above is recommended. 5113\end{sphinxadmonition} 5114 5115\begin{sphinxadmonition}{note}{Note:} 5116\sphinxAtStartPar 5117It is very important that these principals have good 5118passwords. MIT recommends that TGT principal passwords be 5119at least 26 characters of random ASCII text. 5120\end{sphinxadmonition} 5121 5122 5123\section{Changing the krbtgt key} 5124\label{\detokenize{admin/database:changing-the-krbtgt-key}}\label{\detokenize{admin/database:changing-krbtgt-key}} 5125\sphinxAtStartPar 5126A Kerberos Ticket Granting Ticket (TGT) is a service ticket for the 5127principal \sphinxcode{\sphinxupquote{krbtgt/REALM}}. The key for this principal is created 5128when the Kerberos database is initialized and need not be changed. 5129However, it will only have the encryption types supported by the KDC 5130at the time of the initial database creation. To allow use of newer 5131encryption types for the TGT, this key has to be changed. 5132 5133\sphinxAtStartPar 5134Changing this key using the normal {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} 5135\sphinxstylestrong{change\_password} command would invalidate any previously issued 5136TGTs. Therefore, when changing this key, normally one should use the 5137\sphinxstylestrong{\sphinxhyphen{}keepold} flag to change\_password to retain the previous key in the 5138database as well as the new key. For example: 5139 5140\begin{sphinxVerbatim}[commandchars=\\\{\}] 5141\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{change\PYGZus{}password} \PYG{o}{\PYGZhy{}}\PYG{n}{randkey} \PYG{o}{\PYGZhy{}}\PYG{n}{keepold} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 5142\end{sphinxVerbatim} 5143 5144\begin{sphinxadmonition}{warning}{Warning:} 5145\sphinxAtStartPar 5146After issuing this command, the old key is still valid 5147and is still vulnerable to (for instance) brute force 5148attacks. To completely retire an old key or encryption 5149type, run the kadmin \sphinxstylestrong{purgekeys} command to delete keys 5150with older kvnos, ideally first making sure that all 5151tickets issued with the old keys have expired. 5152\end{sphinxadmonition} 5153 5154\sphinxAtStartPar 5155Only the first krbtgt key of the newest key version is used to encrypt 5156ticket\sphinxhyphen{}granting tickets. However, the set of encryption types present 5157in the krbtgt keys is used by default to determine the session key 5158types supported by the krbtgt service (see 5159{\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}}). Because non\sphinxhyphen{}MIT Kerberos clients 5160sometimes send a limited set of encryption types when making AS 5161requests, it can be important for the krbtgt service to support 5162multiple encryption types. This can be accomplished by giving the 5163krbtgt principal multiple keys, which is usually as simple as not 5164specifying any \sphinxstylestrong{\sphinxhyphen{}e} option when changing the krbtgt key, or by 5165setting the \sphinxstylestrong{session\_enctypes} string attribute on the krbtgt 5166principal (see {\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}}). 5167 5168\sphinxAtStartPar 5169Due to a bug in releases 1.8 through 1.13, renewed and forwarded 5170tickets may not work if the original ticket was obtained prior to a 5171krbtgt key change and the modified ticket is obtained afterwards. 5172Upgrading the KDC to release 1.14 or later will correct this bug. 5173 5174 5175\section{Incremental database propagation} 5176\label{\detokenize{admin/database:incremental-database-propagation}}\label{\detokenize{admin/database:incr-db-prop}} 5177 5178\subsection{Overview} 5179\label{\detokenize{admin/database:overview}} 5180\sphinxAtStartPar 5181At some very large sites, dumping and transmitting the database can 5182take more time than is desirable for changes to propagate from the 5183primary KDC to the replica KDCs. The incremental propagation support 5184added in the 1.7 release is intended to address this. 5185 5186\sphinxAtStartPar 5187With incremental propagation enabled, all programs on the primary KDC 5188that change the database also write information about the changes to 5189an “update log” file, maintained as a circular buffer of a certain 5190size. A process on each replica KDC connects to a service on the 5191primary KDC (currently implemented in the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} server) and 5192periodically requests the changes that have been made since the last 5193check. By default, this check is done every two minutes. 5194 5195\sphinxAtStartPar 5196Incremental propagation uses the following entries in the per\sphinxhyphen{}realm 5197data in the KDC config file (See {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}): 5198 5199 5200\begin{savenotes}\sphinxattablestart 5201\centering 5202\begin{tabulary}{\linewidth}[t]{|T|T|T|} 5203\hline 5204 5205\sphinxAtStartPar 5206iprop\_enable 5207& 5208\sphinxAtStartPar 5209\sphinxstyleemphasis{boolean} 5210& 5211\sphinxAtStartPar 5212If \sphinxstyleemphasis{true}, then incremental propagation is enabled, and (as noted below) normal kprop propagation is disabled. The default is \sphinxstyleemphasis{false}. 5213\\ 5214\hline 5215\sphinxAtStartPar 5216iprop\_master\_ulogsize 5217& 5218\sphinxAtStartPar 5219\sphinxstyleemphasis{integer} 5220& 5221\sphinxAtStartPar 5222Indicates the number of entries that should be retained in the update log. The default is 1000; the maximum number is 2500. 5223\\ 5224\hline 5225\sphinxAtStartPar 5226iprop\_replica\_poll 5227& 5228\sphinxAtStartPar 5229\sphinxstyleemphasis{time interval} 5230& 5231\sphinxAtStartPar 5232Indicates how often the replica should poll the primary KDC for changes to the database. The default is two minutes. 5233\\ 5234\hline 5235\sphinxAtStartPar 5236iprop\_port 5237& 5238\sphinxAtStartPar 5239\sphinxstyleemphasis{integer} 5240& 5241\sphinxAtStartPar 5242Specifies the port number to be used for incremental propagation. This is required in both primary and replica configuration files. 5243\\ 5244\hline 5245\sphinxAtStartPar 5246iprop\_resync\_timeout 5247& 5248\sphinxAtStartPar 5249\sphinxstyleemphasis{integer} 5250& 5251\sphinxAtStartPar 5252Specifies the number of seconds to wait for a full propagation to complete. This is optional on replica configurations. Defaults to 300 seconds (5 minutes). 5253\\ 5254\hline 5255\sphinxAtStartPar 5256iprop\_logfile 5257& 5258\sphinxAtStartPar 5259\sphinxstyleemphasis{file name} 5260& 5261\sphinxAtStartPar 5262Specifies where the update log file for the realm database is to be stored. The default is to use the \sphinxstyleemphasis{database\_name} entry from the realms section of the config file {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, with \sphinxstyleemphasis{.ulog} appended. (NOTE: If database\_name isn’t specified in the realms section, perhaps because the LDAP database back end is being used, or the file name is specified in the \sphinxstyleemphasis{dbmodules} section, then the hard\sphinxhyphen{}coded default for \sphinxstyleemphasis{database\_name} is used. Determination of the \sphinxstyleemphasis{iprop\_logfile} default value will not use values from the \sphinxstyleemphasis{dbmodules} section.) 5263\\ 5264\hline 5265\end{tabulary} 5266\par 5267\sphinxattableend\end{savenotes} 5268 5269\sphinxAtStartPar 5270Both primary and replica sides must have a principal named 5271\sphinxcode{\sphinxupquote{kiprop/hostname}} (where \sphinxstyleemphasis{hostname} is the lowercase, 5272fully\sphinxhyphen{}qualified, canonical name for the host) registered in the 5273Kerberos database, and have keys for that principal stored in the 5274default keytab file ({\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}). The \sphinxcode{\sphinxupquote{kiprop/hostname}} principal may 5275have been created automatically for the primary KDC, but it must 5276always be created for replica KDCs. 5277 5278\sphinxAtStartPar 5279On the primary KDC side, the \sphinxcode{\sphinxupquote{kiprop/hostname}} principal must be 5280listed in the kadmind ACL file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}, and given the 5281\sphinxstylestrong{p} privilege (see {\hyperref[\detokenize{admin/database:privileges}]{\sphinxcrossref{\DUrole{std,std-ref}{Privileges}}}}). 5282 5283\sphinxAtStartPar 5284On the replica KDC side, {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} should be run. When 5285incremental propagation is enabled, it will connect to the kadmind on 5286the primary KDC and start requesting updates. 5287 5288\sphinxAtStartPar 5289The normal kprop mechanism is disabled by the incremental propagation 5290support. However, if the replica has been unable to fetch changes 5291from the primary KDC for too long (network problems, perhaps), the log 5292on the primary may wrap around and overwrite some of the updates that 5293the replica has not yet retrieved. In this case, the replica will 5294instruct the primary KDC to dump the current database out to a file 5295and invoke a one\sphinxhyphen{}time kprop propagation, with special options to also 5296convey the point in the update log at which the replica should resume 5297fetching incremental updates. Thus, all the keytab and ACL setup 5298previously described for kprop propagation is still needed. 5299 5300\sphinxAtStartPar 5301If an environment has a large number of replicas, it may be desirable 5302to arrange them in a hierarchy instead of having the primary serve 5303updates to every replica. To do this, run \sphinxcode{\sphinxupquote{kadmind \sphinxhyphen{}proponly}} on 5304each intermediate replica, and \sphinxcode{\sphinxupquote{kpropd \sphinxhyphen{}A upstreamhostname}} on 5305downstream replicas to direct each one to the appropriate upstream 5306replica. 5307 5308\sphinxAtStartPar 5309There are several known restrictions in the current implementation: 5310\begin{itemize} 5311\item {} 5312\sphinxAtStartPar 5313The incremental update protocol does not transport changes to policy 5314objects. Any policy changes on the primary will result in full 5315resyncs to all replicas. 5316 5317\item {} 5318\sphinxAtStartPar 5319The replica’s KDB module must support locking; it cannot be using the 5320LDAP KDB module. 5321 5322\item {} 5323\sphinxAtStartPar 5324The primary and replica must be able to initiate TCP connections in 5325both directions, without an intervening NAT. 5326 5327\end{itemize} 5328 5329 5330\subsection{Sun/MIT incremental propagation differences} 5331\label{\detokenize{admin/database:sun-mit-incremental-propagation-differences}} 5332\sphinxAtStartPar 5333Sun donated the original code for supporting incremental database 5334propagation to MIT. Some changes have been made in the MIT source 5335tree that will be visible to administrators. (These notes are based 5336on Sun’s patches. Changes to Sun’s implementation since then may not 5337be reflected here.) 5338 5339\sphinxAtStartPar 5340The Sun config file support looks for \sphinxcode{\sphinxupquote{sunw\_dbprop\_enable}}, 5341\sphinxcode{\sphinxupquote{sunw\_dbprop\_master\_ulogsize}}, and \sphinxcode{\sphinxupquote{sunw\_dbprop\_slave\_poll}}. 5342 5343\sphinxAtStartPar 5344The incremental propagation service is implemented as an ONC RPC 5345service. In the Sun implementation, the service is registered with 5346rpcbind (also known as portmapper) and the client looks up the port 5347number to contact. In the MIT implementation, where interaction with 5348some modern versions of rpcbind doesn’t always work well, the port 5349number must be specified in the config file on both the primary and 5350replica sides. 5351 5352\sphinxAtStartPar 5353The Sun implementation hard\sphinxhyphen{}codes pathnames in \sphinxcode{\sphinxupquote{/var/krb5}} for the 5354update log and the per\sphinxhyphen{}replica kprop dump files. In the MIT 5355implementation, the pathname for the update log is specified in the 5356config file, and the per\sphinxhyphen{}replica dump files are stored in 5357{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans\_hostname}}. 5358 5359 5360\chapter{Database types} 5361\label{\detokenize{admin/dbtypes:database-types}}\label{\detokenize{admin/dbtypes:dbtypes}}\label{\detokenize{admin/dbtypes::doc}} 5362\sphinxAtStartPar 5363A Kerberos database can be implemented with one of three built\sphinxhyphen{}in 5364database providers, called KDB modules. Software which incorporates 5365the MIT krb5 KDC may also provide its own KDB module. The following 5366subsections describe the three built\sphinxhyphen{}in KDB modules and the 5367configuration specific to them. 5368 5369\sphinxAtStartPar 5370The database type can be configured with the \sphinxstylestrong{db\_library} variable 5371in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm. For example: 5372 5373\begin{sphinxVerbatim}[commandchars=\\\{\}] 5374\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 5375 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 5376 \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{db2} 5377 \PYG{p}{\PYGZcb{}} 5378\end{sphinxVerbatim} 5379 5380\sphinxAtStartPar 5381If the \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} realm subsection contains a 5382\sphinxstylestrong{database\_module} setting, then the subsection within 5383\sphinxcode{\sphinxupquote{{[}dbmodules{]}}} should use that name instead of \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}}. 5384 5385\sphinxAtStartPar 5386To transition from one database type to another, stop the 5387{\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} service, use \sphinxcode{\sphinxupquote{kdb5\_util dump}} to create a dump 5388file, change the \sphinxstylestrong{db\_library} value and set any appropriate 5389configuration for the new database type, and use \sphinxcode{\sphinxupquote{kdb5\_util load}} to 5390create and populate the new database. If the new database type is 5391LDAP, create the new database using \sphinxcode{\sphinxupquote{kdb5\_ldap\_util}} and populate it 5392from the dump file using \sphinxcode{\sphinxupquote{kdb5\_util load \sphinxhyphen{}update}}. Then restart the 5393{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} services. 5394 5395 5396\section{Berkeley database module (db2)} 5397\label{\detokenize{admin/dbtypes:berkeley-database-module-db2}} 5398\sphinxAtStartPar 5399The default KDB module is \sphinxcode{\sphinxupquote{db2}}, which uses a version of the 5400Berkeley DB library. It creates four files based on the database 5401pathname. If the pathname ends with \sphinxcode{\sphinxupquote{principal}} then the four files 5402are: 5403\begin{itemize} 5404\item {} 5405\sphinxAtStartPar 5406\sphinxcode{\sphinxupquote{principal}}, containing principal entry data 5407 5408\item {} 5409\sphinxAtStartPar 5410\sphinxcode{\sphinxupquote{principal.ok}}, a lock file for the principal database 5411 5412\item {} 5413\sphinxAtStartPar 5414\sphinxcode{\sphinxupquote{principal.kadm5}}, containing policy object data 5415 5416\item {} 5417\sphinxAtStartPar 5418\sphinxcode{\sphinxupquote{principal.kadm5.lock}}, a lock file for the policy database 5419 5420\end{itemize} 5421 5422\sphinxAtStartPar 5423For large databases, the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{dump} command (perhaps 5424invoked by {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} or by {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} for incremental 5425propagation) may cause {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} to stop for a noticeable 5426period of time while it iterates over the database. This delay can be 5427avoided by disabling account lockout features so that the KDC does not 5428perform database writes (see {\hyperref[\detokenize{admin/lockout:disable-lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC performance and account lockout}}}}). Alternatively, 5429a slower form of iteration can be enabled by setting the 5430\sphinxstylestrong{unlockiter} variable to \sphinxcode{\sphinxupquote{true}}. For example: 5431 5432\begin{sphinxVerbatim}[commandchars=\\\{\}] 5433\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 5434 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 5435 \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{db2} 5436 \PYG{n}{unlockiter} \PYG{o}{=} \PYG{n}{true} 5437 \PYG{p}{\PYGZcb{}} 5438\end{sphinxVerbatim} 5439 5440\sphinxAtStartPar 5441In rare cases, a power failure or other unclean system shutdown may 5442cause inconsistencies in the internal pointers within a database file, 5443such that \sphinxcode{\sphinxupquote{kdb5\_util dump}} cannot retrieve all principal entries in 5444the database. In this situation, it may be possible to retrieve all 5445of the principal data by running \sphinxcode{\sphinxupquote{kdb5\_util dump \sphinxhyphen{}recurse}} to 5446iterate over the database using the tree pointers instead of the 5447iteration pointers. Running \sphinxcode{\sphinxupquote{kdb5\_util dump \sphinxhyphen{}rev}} to iterate over 5448the database backwards may also retrieve some of the data which is not 5449retrieved by a normal dump operation. 5450 5451 5452\section{Lightning Memory\sphinxhyphen{}Mapped Database module (klmdb)} 5453\label{\detokenize{admin/dbtypes:lightning-memory-mapped-database-module-klmdb}} 5454\sphinxAtStartPar 5455The klmdb module was added in release 1.17. It uses the LMDB library, 5456and may offer better performance and reliability than the db2 module. 5457It creates four files based on the database pathname. If the pathname 5458ends with \sphinxcode{\sphinxupquote{principal}}, then the four files are: 5459\begin{itemize} 5460\item {} 5461\sphinxAtStartPar 5462\sphinxcode{\sphinxupquote{principal.mdb}}, containing policy object data and most principal 5463entry data 5464 5465\item {} 5466\sphinxAtStartPar 5467\sphinxcode{\sphinxupquote{principal.mdb\sphinxhyphen{}lock}}, a lock file for the primary database 5468 5469\item {} 5470\sphinxAtStartPar 5471\sphinxcode{\sphinxupquote{principal.lockout.mdb}}, containing the account lockout attributes 5472(last successful authentication time, last failed authentication 5473time, and number of failed attempts) for each principal entry 5474 5475\item {} 5476\sphinxAtStartPar 5477\sphinxcode{\sphinxupquote{principal.lockout.mdb\sphinxhyphen{}lock}}, a lock file for the lockout database 5478 5479\end{itemize} 5480 5481\sphinxAtStartPar 5482Separating out the lockout attributes ensures that the KDC will never 5483block on an administrative operation such as a database dump or load. 5484It also allows the KDC to operate without write access to the primary 5485database. If both account lockout features are disabled (see 5486{\hyperref[\detokenize{admin/lockout:disable-lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC performance and account lockout}}}}), the lockout database files will be created 5487but will not subsequently be opened, and the account lockout 5488attributes will always have zero values. 5489 5490\sphinxAtStartPar 5491Because LMDB creates a memory map to the database files, it requires a 5492configured memory map size which also determines the maximum size of 5493the database. This size is applied equally to the two databases, so 5494twice the configured size will be consumed in the process address 5495space; this is primarily a limitation on 32\sphinxhyphen{}bit platforms. The 5496default value of 128 megabytes should be sufficient for several 5497hundred thousand principal entries. If the limit is reached, kadmin 5498operations will fail and the error message “Environment mapsize limit 5499reached” will appear in the kadmind log file. In this case, the 5500\sphinxstylestrong{mapsize} variable can be used to increase the map size. The 5501following example sets the map size to 512 megabytes: 5502 5503\begin{sphinxVerbatim}[commandchars=\\\{\}] 5504\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 5505 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 5506 \PYG{n}{db\PYGZus{}library} \PYG{o}{=} \PYG{n}{klmdb} 5507 \PYG{n}{mapsize} \PYG{o}{=} \PYG{l+m+mi}{512} 5508 \PYG{p}{\PYGZcb{}} 5509\end{sphinxVerbatim} 5510 5511\sphinxAtStartPar 5512LMDB has a configurable maximum number of readers. The default value 5513of 128 should be sufficient for most deployments. If you are going to 5514use a large number of KDC worker processes, it may be necessary to set 5515the \sphinxstylestrong{max\_readers} variable to a larger number. 5516 5517\sphinxAtStartPar 5518By default, LMDB synchronizes database files to disk after each write 5519transaction to ensure durability in the case of an unclean system 5520shutdown. The klmdb module always turns synchronization off for the 5521lockout database to ensure reasonable KDC performance, but leaves it 5522on for the primary database. If high throughput for administrative 5523operations (including password changes) is required, the \sphinxstylestrong{nosync} 5524variable can be set to “true” to disable synchronization for the 5525primary database. 5526 5527\sphinxAtStartPar 5528The klmdb module does not support explicit locking with the 5529{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{lock} command. 5530 5531 5532\section{LDAP module (kldap)} 5533\label{\detokenize{admin/dbtypes:ldap-module-kldap}} 5534\sphinxAtStartPar 5535The kldap module stores principal and policy data using an LDAP 5536server. To use it you must configure an LDAP server to use the 5537Kerberos schema. See {\hyperref[\detokenize{admin/conf_ldap:conf-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end}}}} for details. 5538 5539\sphinxAtStartPar 5540Because {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} is single\sphinxhyphen{}threaded, latency in LDAP database 5541accesses may limit KDC operation throughput. If the LDAP server is 5542located on the same server host as the KDC and accessed through an 5543\sphinxcode{\sphinxupquote{ldapi://}} URL, latency should be minimal. If this is not possible, 5544consider starting multiple KDC worker processes with the 5545{\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} \sphinxstylestrong{\sphinxhyphen{}w} option to enable concurrent processing of KDC 5546requests. 5547 5548\sphinxAtStartPar 5549The kldap module does not support explicit locking with the 5550{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{lock} command. 5551 5552 5553\chapter{Account lockout} 5554\label{\detokenize{admin/lockout:account-lockout}}\label{\detokenize{admin/lockout:lockout}}\label{\detokenize{admin/lockout::doc}} 5555\sphinxAtStartPar 5556As of release 1.8, the KDC can be configured to lock out principals 5557after a number of failed authentication attempts within a period of 5558time. Account lockout can make it more difficult to attack a 5559principal’s password by brute force, but also makes it easy for an 5560attacker to deny access to a principal. 5561 5562 5563\section{Configuring account lockout} 5564\label{\detokenize{admin/lockout:configuring-account-lockout}} 5565\sphinxAtStartPar 5566Account lockout only works for principals with the 5567\sphinxstylestrong{+requires\_preauth} flag set. Without this flag, the KDC cannot 5568know whether or not a client successfully decrypted the ticket it 5569issued. It is also important to set the \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flag on a 5570principal to protect its password from an off\sphinxhyphen{}line dictionary attack 5571through a TGS request. You can set these flags on a principal with 5572{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} as follows: 5573 5574\begin{sphinxVerbatim}[commandchars=\\\{\}] 5575\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{PRINCNAME} 5576\end{sphinxVerbatim} 5577 5578\sphinxAtStartPar 5579Account lockout parameters are configured via {\hyperref[\detokenize{admin/database:policies}]{\sphinxcrossref{\DUrole{std,std-ref}{policy objects}}}}. There may be an existing policy associated with user 5580principals (such as the “default” policy), or you may need to create a 5581new one and associate it with each user principal. 5582 5583\sphinxAtStartPar 5584The policy parameters related to account lockout are: 5585\begin{itemize} 5586\item {} 5587\sphinxAtStartPar 5588{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-maxfailure}]{\sphinxcrossref{\DUrole{std,std-ref}{maxfailure}}}}: the number of failed attempts 5589before the principal is locked out 5590 5591\item {} 5592\sphinxAtStartPar 5593{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-failurecountinterval}]{\sphinxcrossref{\DUrole{std,std-ref}{failurecountinterval}}}}: the 5594allowable interval between failed attempts 5595 5596\item {} 5597\sphinxAtStartPar 5598{\hyperref[\detokenize{admin/admin_commands/kadmin_local:policy-lockoutduration}]{\sphinxcrossref{\DUrole{std,std-ref}{lockoutduration}}}}: the amount of time 5599a principal is locked out for 5600 5601\end{itemize} 5602 5603\sphinxAtStartPar 5604Here is an example of setting these parameters on a new policy and 5605associating it with a principal: 5606 5607\begin{sphinxVerbatim}[commandchars=\\\{\}] 5608\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addpol} \PYG{o}{\PYGZhy{}}\PYG{n}{maxfailure} \PYG{l+m+mi}{10} \PYG{o}{\PYGZhy{}}\PYG{n}{failurecountinterval} \PYG{l+m+mi}{180} 5609 \PYG{o}{\PYGZhy{}}\PYG{n}{lockoutduration} \PYG{l+m+mi}{60} \PYG{n}{lockout\PYGZus{}policy} 5610\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{policy} \PYG{n}{lockout\PYGZus{}policy} \PYG{n}{PRINCNAME} 5611\end{sphinxVerbatim} 5612 5613 5614\section{Testing account lockout} 5615\label{\detokenize{admin/lockout:testing-account-lockout}} 5616\sphinxAtStartPar 5617To test that account lockout is working, try authenticating as the 5618principal (hopefully not one that might be in use) multiple times with 5619the wrong password. For instance, if \sphinxstylestrong{maxfailure} is set to 2, you 5620might see: 5621 5622\begin{sphinxVerbatim}[commandchars=\\\{\}] 5623\PYGZdl{} kinit user 5624Password for user@KRBTEST.COM: 5625kinit: Password incorrect while getting initial credentials 5626\PYGZdl{} kinit user 5627Password for user@KRBTEST.COM: 5628kinit: Password incorrect while getting initial credentials 5629\PYGZdl{} kinit user 5630kinit: Client\PYGZsq{}s credentials have been revoked while getting initial credentials 5631\end{sphinxVerbatim} 5632 5633 5634\section{Account lockout principal state} 5635\label{\detokenize{admin/lockout:account-lockout-principal-state}} 5636\sphinxAtStartPar 5637A principal entry keeps three pieces of state related to account 5638lockout: 5639\begin{itemize} 5640\item {} 5641\sphinxAtStartPar 5642The time of last successful authentication 5643 5644\item {} 5645\sphinxAtStartPar 5646The time of last failed authentication 5647 5648\item {} 5649\sphinxAtStartPar 5650A counter of failed attempts 5651 5652\end{itemize} 5653 5654\sphinxAtStartPar 5655The time of last successful authentication is not actually needed for 5656the account lockout system to function, but may be of administrative 5657interest. These fields can be observed with the \sphinxstylestrong{getprinc} kadmin 5658command. For example: 5659 5660\begin{sphinxVerbatim}[commandchars=\\\{\}] 5661\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{n}{user} 5662\PYG{n}{Principal}\PYG{p}{:} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} 5663\PYG{o}{.}\PYG{o}{.}\PYG{o}{.} 5664\PYG{n}{Last} \PYG{n}{successful} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} 5665\PYG{n}{Last} \PYG{n}{failed} \PYG{n}{authentication}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Dec} \PYG{l+m+mi}{03} \PYG{l+m+mi}{12}\PYG{p}{:}\PYG{l+m+mi}{30}\PYG{p}{:}\PYG{l+m+mi}{33} \PYG{n}{EST} \PYG{l+m+mi}{2012} 5666\PYG{n}{Failed} \PYG{n}{password} \PYG{n}{attempts}\PYG{p}{:} \PYG{l+m+mi}{2} 5667\PYG{o}{.}\PYG{o}{.}\PYG{o}{.} 5668\end{sphinxVerbatim} 5669 5670\sphinxAtStartPar 5671A principal which has been locked out can be administratively unlocked 5672with the \sphinxstylestrong{\sphinxhyphen{}unlock} option to the \sphinxstylestrong{modprinc} kadmin command: 5673 5674\begin{sphinxVerbatim}[commandchars=\\\{\}] 5675\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{unlock} \PYG{n}{PRINCNAME} 5676\end{sphinxVerbatim} 5677 5678\sphinxAtStartPar 5679This command will reset the number of failed attempts to 0. 5680 5681 5682\section{KDC replication and account lockout} 5683\label{\detokenize{admin/lockout:kdc-replication-and-account-lockout}} 5684\sphinxAtStartPar 5685The account lockout state of a principal is not replicated by either 5686traditional {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} or incremental propagation. Because of 5687this, the number of attempts an attacker can make within a time period 5688is multiplied by the number of KDCs. For instance, if the 5689\sphinxstylestrong{maxfailure} parameter on a policy is 10 and there are four KDCs in 5690the environment (a primary and three replicas), an attacker could make 5691as many as 40 attempts before the principal is locked out on all four 5692KDCs. 5693 5694\sphinxAtStartPar 5695An administrative unlock is propagated from the primary to the replica 5696KDCs during the next propagation. Propagation of an administrative 5697unlock will cause the counter of failed attempts on each replica to 5698reset to 1 on the next failure. 5699 5700\sphinxAtStartPar 5701If a KDC environment uses a replication strategy other than kprop or 5702incremental propagation, such as the LDAP KDB module with multi\sphinxhyphen{}master 5703LDAP replication, then account lockout state may be replicated between 5704KDCs and the concerns of this section may not apply. 5705 5706 5707\section{KDC performance and account lockout} 5708\label{\detokenize{admin/lockout:kdc-performance-and-account-lockout}}\label{\detokenize{admin/lockout:disable-lockout}} 5709\sphinxAtStartPar 5710In order to fully track account lockout state, the KDC must write to 5711the the database on each successful and failed authentication. 5712Writing to the database is generally more expensive than reading from 5713it, so these writes may have a significant impact on KDC performance. 5714As of release 1.9, it is possible to turn off account lockout state 5715tracking in order to improve performance, by setting the 5716\sphinxstylestrong{disable\_last\_success} and \sphinxstylestrong{disable\_lockout} variables in the 5717database module subsection of {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. For example: 5718 5719\begin{sphinxVerbatim}[commandchars=\\\{\}] 5720\PYG{p}{[}\PYG{n}{dbmodules}\PYG{p}{]} 5721 \PYG{n}{DB} \PYG{o}{=} \PYG{p}{\PYGZob{}} 5722 \PYG{n}{disable\PYGZus{}last\PYGZus{}success} \PYG{o}{=} \PYG{n}{true} 5723 \PYG{n}{disable\PYGZus{}lockout} \PYG{o}{=} \PYG{n}{true} 5724 \PYG{p}{\PYGZcb{}} 5725\end{sphinxVerbatim} 5726 5727\sphinxAtStartPar 5728Of the two variables, setting \sphinxstylestrong{disable\_last\_success} will usually 5729have the largest positive impact on performance, and will still allow 5730account lockout policies to operate. However, it will make it 5731impossible to observe the last successful authentication time with 5732kadmin. 5733 5734 5735\section{KDC setup and account lockout} 5736\label{\detokenize{admin/lockout:kdc-setup-and-account-lockout}} 5737\sphinxAtStartPar 5738To update the account lockout state on principals, the KDC must be 5739able to write to the principal database. For the DB2 module, no 5740special setup is required. For the LDAP module, the KDC DN must be 5741granted write access to the principal objects. If the KDC DN has only 5742read access, account lockout will not function. 5743 5744 5745\chapter{Configuring Kerberos with OpenLDAP back\sphinxhyphen{}end} 5746\label{\detokenize{admin/conf_ldap:configuring-kerberos-with-openldap-back-end}}\label{\detokenize{admin/conf_ldap:conf-ldap}}\label{\detokenize{admin/conf_ldap::doc}}\begin{enumerate} 5747\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 5748\item {} 5749\sphinxAtStartPar 5750Make sure the LDAP server is using local authentication 5751(\sphinxcode{\sphinxupquote{ldapi://}}) or TLS (\sphinxcode{\sphinxupquote{ldaps}}). See 5752\sphinxurl{https://www.openldap.org/doc/admin/tls.html} for instructions on 5753configuring TLS support in OpenLDAP. 5754 5755\item {} 5756\sphinxAtStartPar 5757Add the Kerberos schema file to the LDAP Server using the OpenLDAP 5758LDIF file from the krb5 source directory 5759(\sphinxcode{\sphinxupquote{src/plugins/kdb/ldap/libkdb\_ldap/kerberos.openldap.ldif}}). 5760The following example uses local authentication: 5761 5762\begin{sphinxVerbatim}[commandchars=\\\{\}] 5763\PYG{n}{ldapadd} \PYG{o}{\PYGZhy{}}\PYG{n}{Y} \PYG{n}{EXTERNAL} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldapi}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{o}{/} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{kerberos}\PYG{o}{.}\PYG{n}{openldap}\PYG{o}{.}\PYG{n}{ldif} 5764\end{sphinxVerbatim} 5765 5766\item {} 5767\sphinxAtStartPar 5768Choose DNs for the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} and {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} servers 5769to bind to the LDAP server, and create them if necessary. Specify 5770these DNs with the \sphinxstylestrong{ldap\_kdc\_dn} and \sphinxstylestrong{ldap\_kadmind\_dn} 5771directives in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. The kadmind DN will also be 5772used for administrative commands such as {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}. 5773 5774\sphinxAtStartPar 5775Alternatively, you may configure krb5kdc and kadmind to use SASL 5776authentication to access the LDAP server; see the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} 5777relations \sphinxstylestrong{ldap\_kdc\_sasl\_mech} and similar. 5778 5779\item {} 5780\sphinxAtStartPar 5781Specify a location for the LDAP service password file by setting 5782\sphinxstylestrong{ldap\_service\_password\_file}. Use \sphinxcode{\sphinxupquote{kdb5\_ldap\_util stashsrvpw}} 5783to stash passwords for the KDC and kadmind DNs chosen above. For 5784example: 5785 5786\begin{sphinxVerbatim}[commandchars=\\\{\}] 5787\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{n}{stashsrvpw} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{service}\PYG{o}{.}\PYG{n}{keyfile} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{krbadmin}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{example}\PYG{p}{,}\PYG{n}{dc}\PYG{o}{=}\PYG{n}{com} 5788\end{sphinxVerbatim} 5789 5790\sphinxAtStartPar 5791Skip this step if you are using SASL authentication and the 5792mechanism does not require a password. 5793 5794\item {} 5795\sphinxAtStartPar 5796Choose a DN for the global Kerberos container entry (but do not 5797create the entry at this time). Specify this DN with the 5798\sphinxstylestrong{ldap\_kerberos\_container\_dn} directive in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 5799Realm container entries will be created underneath this DN. 5800Principal entries may exist either underneath the realm container 5801(the default) or in separate trees referenced from the realm 5802container. 5803 5804\item {} 5805\sphinxAtStartPar 5806Configure the LDAP server ACLs to enable the KDC and kadmin server 5807DNs to read and write the Kerberos data. If 5808\sphinxstylestrong{disable\_last\_success} and \sphinxstylestrong{disable\_lockout} are both set to 5809true in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm, then the 5810KDC DN only requires read access to the Kerberos data. 5811 5812\sphinxAtStartPar 5813Sample access control information: 5814 5815\begin{sphinxVerbatim}[commandchars=\\\{\}] 5816\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{base}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}} 5817 \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} 5818 5819\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{base}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=Subschema}\PYG{l+s+s2}{\PYGZdq{}} 5820 \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} 5821 5822\PYG{c+c1}{\PYGZsh{} Provide access to the realm container.} 5823\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{subtree}\PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=EXAMPLE.COM,cn=krbcontainer,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} 5824 \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=kdc\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} 5825 \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=adm\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} 5826 \PYG{n}{by} \PYG{o}{*} \PYG{n}{none} 5827 5828\PYG{c+c1}{\PYGZsh{} Provide access to principals, if not underneath the realm container.} 5829\PYG{n}{access} \PYG{n}{to} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{subtree}\PYG{o}{=} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{ou=users,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} 5830 \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=kdc\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} 5831 \PYG{n}{by} \PYG{n}{dn}\PYG{o}{.}\PYG{n}{exact}\PYG{o}{=}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=adm\PYGZhy{}service,dc=example,dc=com}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{write} 5832 \PYG{n}{by} \PYG{o}{*} \PYG{n}{none} 5833 5834\PYG{n}{access} \PYG{n}{to} \PYG{o}{*} 5835 \PYG{n}{by} \PYG{o}{*} \PYG{n}{read} 5836\end{sphinxVerbatim} 5837 5838\sphinxAtStartPar 5839If the locations of the container and principals or the DNs of the 5840service objects for a realm are changed then this information 5841should be updated. 5842 5843\item {} 5844\sphinxAtStartPar 5845In {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, make sure the following relations are set 5846in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbmodules}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbmodules{]}}}}} subsection for the realm: 5847 5848\begin{sphinxVerbatim}[commandchars=\\\{\}] 5849db\PYGZus{}library (set to ``kldap``) 5850ldap\PYGZus{}kerberos\PYGZus{}container\PYGZus{}dn 5851ldap\PYGZus{}kdc\PYGZus{}dn 5852ldap\PYGZus{}kadmind\PYGZus{}dn 5853ldap\PYGZus{}service\PYGZus{}password\PYGZus{}file 5854ldap\PYGZus{}servers 5855\end{sphinxVerbatim} 5856 5857\item {} 5858\sphinxAtStartPar 5859Create the realm using {\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}: 5860\begin{quote} 5861 5862\sphinxAtStartPar 5863kdb5\_ldap\_util create \sphinxhyphen{}subtrees ou=users,dc=example,dc=com \sphinxhyphen{}s 5864\end{quote} 5865 5866\sphinxAtStartPar 5867Use the \sphinxstylestrong{\sphinxhyphen{}subtrees} option if the principals are to exist in a 5868separate subtree from the realm container. Before executing the 5869command, make sure that the subtree mentioned above 5870\sphinxcode{\sphinxupquote{(ou=users,dc=example,dc=com)}} exists. If the principals will 5871exist underneath the realm container, omit the \sphinxstylestrong{\sphinxhyphen{}subtrees} option 5872and do not worry about creating the principal subtree. 5873 5874\sphinxAtStartPar 5875For more information, refer to the section {\hyperref[\detokenize{admin/database:ops-on-ldap}]{\sphinxcrossref{\DUrole{std,std-ref}{Operations on the LDAP database}}}}. 5876 5877\sphinxAtStartPar 5878The realm object is created under the 5879\sphinxstylestrong{ldap\_kerberos\_container\_dn} specified in the configuration 5880file. This operation will also create the Kerberos container, if 5881not present already. This container can be used to store 5882information related to multiple realms. 5883 5884\item {} 5885\sphinxAtStartPar 5886Add an \sphinxcode{\sphinxupquote{eq}} index for \sphinxcode{\sphinxupquote{krbPrincipalName}} to speed up principal 5887lookup operations. See 5888\sphinxurl{https://www.openldap.org/doc/admin/tuning.html\#Indexes} for 5889details. 5890 5891\end{enumerate} 5892 5893\sphinxAtStartPar 5894With the LDAP back end it is possible to provide aliases for principal 5895entries. Currently we provide no administrative utilities for 5896creating aliases, so it must be done by direct manipulation of the 5897LDAP entries. 5898 5899\sphinxAtStartPar 5900An entry with aliases contains multiple values of the 5901\sphinxstyleemphasis{krbPrincipalName} attribute. Since LDAP attribute values are not 5902ordered, it is necessary to specify which principal name is canonical, 5903by using the \sphinxstyleemphasis{krbCanonicalName} attribute. Therefore, to create 5904aliases for an entry, first set the \sphinxstyleemphasis{krbCanonicalName} attribute of 5905the entry to the canonical principal name (which should be identical 5906to the pre\sphinxhyphen{}existing \sphinxstyleemphasis{krbPrincipalName} value), and then add additional 5907\sphinxstyleemphasis{krbPrincipalName} attributes for the aliases. 5908 5909\sphinxAtStartPar 5910Principal aliases are only returned by the KDC when the client 5911requests canonicalization. Canonicalization is normally requested for 5912service principals; for client principals, an explicit flag is often 5913required (e.g., \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}C}}) and canonicalization is only performed 5914for initial ticket requests. 5915 5916 5917\chapter{Application servers} 5918\label{\detokenize{admin/appl_servers:application-servers}}\label{\detokenize{admin/appl_servers::doc}} 5919\sphinxAtStartPar 5920If you need to install the Kerberos V5 programs on an application 5921server, please refer to the Kerberos V5 Installation Guide. Once you 5922have installed the software, you need to add that host to the Kerberos 5923database (see {\hyperref[\detokenize{admin/database:principals}]{\sphinxcrossref{\DUrole{std,std-ref}{Principals}}}}), and generate a keytab for that host, 5924that contains the host’s key. You also need to make sure the host’s 5925clock is within your maximum clock skew of the KDCs. 5926 5927 5928\section{Keytabs} 5929\label{\detokenize{admin/appl_servers:keytabs}} 5930\sphinxAtStartPar 5931A keytab is a host’s copy of its own keylist, which is analogous to a 5932user’s password. An application server that needs to authenticate 5933itself to the KDC has to have a keytab that contains its own principal 5934and key. Just as it is important for users to protect their 5935passwords, it is equally important for hosts to protect their keytabs. 5936You should always store keytab files on local disk, and make them 5937readable only by root, and you should never send a keytab file over a 5938network in the clear. Ideally, you should run the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} 5939command to extract a keytab on the host on which the keytab is to 5940reside. 5941 5942 5943\subsection{Adding principals to keytabs} 5944\label{\detokenize{admin/appl_servers:adding-principals-to-keytabs}}\label{\detokenize{admin/appl_servers:add-princ-kt}} 5945\sphinxAtStartPar 5946To generate a keytab, or to add a principal to an existing keytab, use 5947the \sphinxstylestrong{ktadd} command from kadmin. Here is a sample session, using 5948configuration files that enable only AES encryption: 5949 5950\begin{sphinxVerbatim}[commandchars=\\\{\}] 5951\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 5952\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} 5953\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} 5954\end{sphinxVerbatim} 5955 5956 5957\subsection{Removing principals from keytabs} 5958\label{\detokenize{admin/appl_servers:removing-principals-from-keytabs}} 5959\sphinxAtStartPar 5960To remove a principal from an existing keytab, use the kadmin 5961\sphinxstylestrong{ktremove} command: 5962 5963\begin{sphinxVerbatim}[commandchars=\\\{\}] 5964\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktremove} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 5965\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 5966\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 5967\end{sphinxVerbatim} 5968 5969 5970\subsection{Using a keytab to acquire client credentials} 5971\label{\detokenize{admin/appl_servers:using-a-keytab-to-acquire-client-credentials}} 5972\sphinxAtStartPar 5973While keytabs are ordinarily used to accept credentials from clients, 5974they can also be used to acquire initial credentials, allowing one 5975service to authenticate to another. 5976 5977\sphinxAtStartPar 5978To manually obtain credentials using a keytab, use the \DUrole{xref,std,std-ref}{kinit(1)} 5979\sphinxstylestrong{\sphinxhyphen{}k} option, together with the \sphinxstylestrong{\sphinxhyphen{}t} option if the keytab is not in 5980the default location. 5981 5982\sphinxAtStartPar 5983Beginning with release 1.11, GSSAPI applications can be configured to 5984automatically obtain initial credentials from a keytab as needed. The 5985recommended configuration is as follows: 5986\begin{enumerate} 5987\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 5988\item {} 5989\sphinxAtStartPar 5990Create a keytab containing a single entry for the desired client 5991identity. 5992 5993\item {} 5994\sphinxAtStartPar 5995Place the keytab in a location readable by the service, and set the 5996\sphinxstylestrong{KRB5\_CLIENT\_KTNAME} environment variable to its filename. 5997Alternatively, use the \sphinxstylestrong{default\_client\_keytab\_name} profile 5998variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}, or use the default location of 5999{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}}. 6000 6001\item {} 6002\sphinxAtStartPar 6003Set \sphinxstylestrong{KRB5CCNAME} to a filename writable by the service, which 6004will not be used for any other purpose. Do not manually obtain 6005credentials at this location. (Another credential cache type 6006besides \sphinxstylestrong{FILE} can be used if desired, as long the cache will not 6007conflict with another use. A \sphinxstylestrong{MEMORY} cache can be used if the 6008service runs as a long\sphinxhyphen{}lived process. See \DUrole{xref,std,std-ref}{ccache\_definition} 6009for details.) 6010 6011\item {} 6012\sphinxAtStartPar 6013Start the service. When it authenticates using GSSAPI, it will 6014automatically obtain credentials from the client keytab into the 6015specified credential cache, and refresh them before they expire. 6016 6017\end{enumerate} 6018 6019 6020\section{Clock Skew} 6021\label{\detokenize{admin/appl_servers:clock-skew}} 6022\sphinxAtStartPar 6023A Kerberos application server host must keep its clock synchronized or 6024it will reject authentication requests from clients. Modern operating 6025systems typically provide a facility to maintain the correct time; 6026make sure it is enabled. This is especially important on virtual 6027machines, where clocks tend to drift more rapidly than normal machine 6028clocks. 6029 6030\sphinxAtStartPar 6031The default allowable clock skew is controlled by the \sphinxstylestrong{clockskew} 6032variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. 6033 6034 6035\section{Getting DNS information correct} 6036\label{\detokenize{admin/appl_servers:getting-dns-information-correct}} 6037\sphinxAtStartPar 6038Several aspects of Kerberos rely on name service. When a hostname is 6039used to name a service, clients may canonicalize the hostname using 6040forward and possibly reverse name resolution. The result of this 6041canonicalization must match the principal entry in the host’s keytab, 6042or authentication will fail. To work with all client canonicalization 6043configurations, each host’s canonical name must be the fully\sphinxhyphen{}qualified 6044host name (including the domain), and each host’s IP address must 6045reverse\sphinxhyphen{}resolve to the canonical name. 6046 6047\sphinxAtStartPar 6048Configuration of hostnames varies by operating system. On the 6049application server itself, canonicalization will typically use the 6050\sphinxcode{\sphinxupquote{/etc/hosts}} file rather than the DNS. Ensure that the line for the 6051server’s hostname is in the following form: 6052 6053\begin{sphinxVerbatim}[commandchars=\\\{\}] 6054\PYG{n}{IP} \PYG{n}{address} \PYG{n}{fully}\PYG{o}{\PYGZhy{}}\PYG{n}{qualified} \PYG{n}{hostname} \PYG{n}{aliases} 6055\end{sphinxVerbatim} 6056 6057\sphinxAtStartPar 6058Here is a sample \sphinxcode{\sphinxupquote{/etc/hosts}} file: 6059 6060\begin{sphinxVerbatim}[commandchars=\\\{\}] 6061\PYG{c+c1}{\PYGZsh{} this is a comment} 6062\PYG{l+m+mf}{127.0}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.1} \PYG{n}{localhost} \PYG{n}{localhost}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 6063\PYG{l+m+mf}{10.0}\PYG{l+m+mf}{.0}\PYG{l+m+mf}{.6} \PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{daffodil} \PYG{n}{trillium} \PYG{n}{wake}\PYG{o}{\PYGZhy{}}\PYG{n}{robin} 6064\end{sphinxVerbatim} 6065 6066\sphinxAtStartPar 6067The output of \sphinxcode{\sphinxupquote{klist \sphinxhyphen{}k}} for this example host should look like: 6068 6069\begin{sphinxVerbatim}[commandchars=\\\{\}] 6070\PYG{n}{viola}\PYG{c+c1}{\PYGZsh{} klist \PYGZhy{}k} 6071\PYG{n}{Keytab} \PYG{n}{name}\PYG{p}{:} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} 6072\PYG{n}{KVNO} \PYG{n}{Principal} 6073\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} 6074 \PYG{l+m+mi}{2} \PYG{n}{host}\PYG{o}{/}\PYG{n}{daffodil}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 6075\end{sphinxVerbatim} 6076 6077\sphinxAtStartPar 6078If you were to ssh to this host with a fresh credentials cache (ticket 6079file), and then \DUrole{xref,std,std-ref}{klist(1)}, the output should list a service 6080principal of \sphinxcode{\sphinxupquote{host/daffodil.mit.edu@ATHENA.MIT.EDU}}. 6081 6082 6083\section{Configuring your firewall to work with Kerberos V5} 6084\label{\detokenize{admin/appl_servers:configuring-your-firewall-to-work-with-kerberos-v5}}\label{\detokenize{admin/appl_servers:conf-firewall}} 6085\sphinxAtStartPar 6086If you need off\sphinxhyphen{}site users to be able to get Kerberos tickets in your 6087realm, they must be able to get to your KDC. This requires either 6088that you have a replica KDC outside your firewall, or that you 6089configure your firewall to allow UDP requests into at least one of 6090your KDCs, on whichever port the KDC is running. (The default is port 609188; other ports may be specified in the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} 6092file.) Similarly, if you need off\sphinxhyphen{}site users to be able to change 6093their passwords in your realm, they must be able to get to your 6094Kerberos admin server on the kpasswd port (which defaults to 464). If 6095you need off\sphinxhyphen{}site users to be able to administer your Kerberos realm, 6096they must be able to get to your Kerberos admin server on the 6097administrative port (which defaults to 749). 6098 6099\sphinxAtStartPar 6100If your on\sphinxhyphen{}site users inside your firewall will need to get to KDCs in 6101other realms, you will also need to configure your firewall to allow 6102outgoing TCP and UDP requests to port 88, and to port 464 to allow 6103password changes. If your on\sphinxhyphen{}site users inside your firewall will 6104need to get to Kerberos admin servers in other realms, you will also 6105need to allow outgoing TCP and UDP requests to port 749. 6106 6107\sphinxAtStartPar 6108If any of your KDCs are outside your firewall, you will need to allow 6109kprop requests to get through to the remote KDC. {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} uses 6110the \sphinxcode{\sphinxupquote{krb5\_prop}} service on port 754 (tcp). 6111 6112\sphinxAtStartPar 6113The book \sphinxstyleemphasis{UNIX System Security}, by David Curry, is a good starting 6114point for learning to configure firewalls. 6115 6116 6117\chapter{Host configuration} 6118\label{\detokenize{admin/host_config:host-configuration}}\label{\detokenize{admin/host_config::doc}} 6119\sphinxAtStartPar 6120All hosts running Kerberos software, whether they are clients, 6121application servers, or KDCs, can be configured using 6122{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Here we describe some of the behavior changes 6123you might want to make. 6124 6125 6126\section{Default realm} 6127\label{\detokenize{admin/host_config:default-realm}} 6128\sphinxAtStartPar 6129In the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section, the \sphinxstylestrong{default\_realm} realm 6130relation sets the default Kerberos realm. For example: 6131 6132\begin{sphinxVerbatim}[commandchars=\\\{\}] 6133\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 6134 \PYG{n}{default\PYGZus{}realm} \PYG{o}{=} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 6135\end{sphinxVerbatim} 6136 6137\sphinxAtStartPar 6138The default realm affects Kerberos behavior in the following ways: 6139\begin{itemize} 6140\item {} 6141\sphinxAtStartPar 6142When a principal name is parsed from text, the default realm is used 6143if no \sphinxcode{\sphinxupquote{@REALM}} component is specified. 6144 6145\item {} 6146\sphinxAtStartPar 6147The default realm affects login authorization as described below. 6148 6149\item {} 6150\sphinxAtStartPar 6151For programs which operate on a Kerberos database, the default realm 6152is used to determine which database to operate on, unless the \sphinxstylestrong{\sphinxhyphen{}r} 6153parameter is given to specify a realm. 6154 6155\item {} 6156\sphinxAtStartPar 6157A server program may use the default realm when looking up its key 6158in a {\hyperref[\detokenize{admin/install_appl_srv:keytab-file}]{\sphinxcrossref{\DUrole{std,std-ref}{keytab file}}}}, if its realm is not 6159determined by {\hyperref[\detokenize{admin/conf_files/krb5_conf:domain-realm}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}domain\_realm{]}}}}} configuration or by the server 6160program itself. 6161 6162\item {} 6163\sphinxAtStartPar 6164If \DUrole{xref,std,std-ref}{kinit(1)} is passed the \sphinxstylestrong{\sphinxhyphen{}n} flag, it requests anonymous 6165tickets from the default realm. 6166 6167\end{itemize} 6168 6169\sphinxAtStartPar 6170In some situations, these uses of the default realm might conflict. 6171For example, it might be desirable for principal name parsing to use 6172one realm by default, but for login authorization to use a second 6173realm. In this situation, the first realm can be configured as the 6174default realm, and \sphinxstylestrong{auth\_to\_local} relations can be used as 6175described below to use the second realm for login authorization. 6176 6177 6178\section{Login authorization} 6179\label{\detokenize{admin/host_config:login-authorization}}\label{\detokenize{admin/host_config:id1}} 6180\sphinxAtStartPar 6181If a host runs a Kerberos\sphinxhyphen{}enabled login service such as OpenSSH with 6182GSSAPIAuthentication enabled, login authorization rules determine 6183whether a Kerberos principal is allowed to access a local account. 6184 6185\sphinxAtStartPar 6186By default, a Kerberos principal is allowed access to an account if 6187its realm matches the default realm and its name matches the account 6188name. (For historical reasons, access is also granted by default if 6189the name has two components and the second component matches the 6190default realm; for instance, \sphinxcode{\sphinxupquote{alice/ATHENA.MIT.EDU@ATHENA.MIT.EDU}} 6191is granted access to the \sphinxcode{\sphinxupquote{alice}} account if \sphinxcode{\sphinxupquote{ATHENA.MIT.EDU}} is 6192the default realm.) 6193 6194\sphinxAtStartPar 6195The simplest way to control local access is using \DUrole{xref,std,std-ref}{.k5login(5)} 6196files. To use these, place a \sphinxcode{\sphinxupquote{.k5login}} file in the home directory 6197of each account listing the principal names which should have login 6198access to that account. If it is not desirable to use \sphinxcode{\sphinxupquote{.k5login}} 6199files located in account home directories, the \sphinxstylestrong{k5login\_directory} 6200relation in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section can specify a directory 6201containing one file per account uname. 6202 6203\sphinxAtStartPar 6204By default, if a \sphinxcode{\sphinxupquote{.k5login}} file is present, it controls 6205authorization both positively and negatively\textendash{}any principal name 6206contained in the file is granted access and any other principal name 6207is denied access, even if it would have had access if the \sphinxcode{\sphinxupquote{.k5login}} 6208file didn’t exist. The \sphinxstylestrong{k5login\_authoritative} relation in the 6209{\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} section can be set to false to make \sphinxcode{\sphinxupquote{.k5login}} 6210files provide positive authorization only. 6211 6212\sphinxAtStartPar 6213The \sphinxstylestrong{auth\_to\_local} relation in the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section for the 6214default realm can specify pattern\sphinxhyphen{}matching rules to control login 6215authorization. For example, the following configuration allows access 6216to principals from a different realm than the default realm: 6217 6218\begin{sphinxVerbatim}[commandchars=\\\{\}] 6219[realms] 6220 DEFAULT.REALM = \PYGZob{} 6221 \PYGZsh{} Allow access to principals from OTHER.REALM. 6222 \PYGZsh{} 6223 \PYGZsh{} [1:\PYGZdl{}1@\PYGZdl{}0] matches single\PYGZhy{}component principal names and creates 6224 \PYGZsh{} a selection string containing the principal name and realm. 6225 \PYGZsh{} 6226 \PYGZsh{} (.*@OTHER\PYGZbs{}.REALM) matches against the selection string, so that 6227 \PYGZsh{} only principals in OTHER.REALM are matched. 6228 \PYGZsh{} 6229 \PYGZsh{} s/@OTHER\PYGZbs{}.REALM\PYGZdl{}// removes the realm name, leaving behind the 6230 \PYGZsh{} principal name as the account name. 6231 auth\PYGZus{}to\PYGZus{}local = RULE:[1:\PYGZdl{}1@\PYGZdl{}0](.*@OTHER\PYGZbs{}.REALM)s/@OTHER\PYGZbs{}.REALM\PYGZdl{}// 6232 6233 \PYGZsh{} Also allow principals from the default realm. Omit this line 6234 \PYGZsh{} to only allow access to principals in OTHER.REALM. 6235 auth\PYGZus{}to\PYGZus{}local = DEFAULT 6236 \PYGZcb{} 6237\end{sphinxVerbatim} 6238 6239\sphinxAtStartPar 6240The \sphinxstylestrong{auth\_to\_local\_names} subsection of the {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} section 6241for the default realm can specify explicit mappings from principal 6242names to local accounts. The key used in this subsection is the 6243principal name without realm, so it is only safe to use in a Kerberos 6244environment with a single realm or a tightly controlled set of realms. 6245An example use of \sphinxstylestrong{auth\_to\_local\_names} might be: 6246 6247\begin{sphinxVerbatim}[commandchars=\\\{\}] 6248\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 6249 \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6250 \PYG{n}{auth\PYGZus{}to\PYGZus{}local\PYGZus{}names} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6251 \PYG{c+c1}{\PYGZsh{} Careful, these match principals in any realm!} 6252 \PYG{n}{host}\PYG{o}{/}\PYG{n}{example}\PYG{o}{.}\PYG{n}{com} \PYG{o}{=} \PYG{n}{hostaccount} 6253 \PYG{n}{fred} \PYG{o}{=} \PYG{n}{localfred} 6254 \PYG{p}{\PYGZcb{}} 6255 \PYG{p}{\PYGZcb{}} 6256\end{sphinxVerbatim} 6257 6258\sphinxAtStartPar 6259Local authorization behavior can also be modified using plugin 6260modules; see \DUrole{xref,std,std-ref}{hostrealm\_plugin} for details. 6261 6262 6263\section{Plugin module configuration} 6264\label{\detokenize{admin/host_config:plugin-module-configuration}}\label{\detokenize{admin/host_config:plugin-config}} 6265\sphinxAtStartPar 6266Many aspects of Kerberos behavior, such as client preauthentication 6267and KDC service location, can be modified through the use of plugin 6268modules. For most of these behaviors, you can use the {\hyperref[\detokenize{admin/conf_files/krb5_conf:plugins}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}plugins{]}}}}} 6269section of krb5.conf to register third\sphinxhyphen{}party modules, and to switch 6270off registered or built\sphinxhyphen{}in modules. 6271 6272\sphinxAtStartPar 6273A plugin module takes the form of a Unix shared object 6274(\sphinxcode{\sphinxupquote{modname.so}}) or Windows DLL (\sphinxcode{\sphinxupquote{modname.dll}}). If you have 6275installed a third\sphinxhyphen{}party plugin module and want to register it, you do 6276so using the \sphinxstylestrong{module} relation in the appropriate subsection of the 6277{[}plugins{]} section. The value for \sphinxstylestrong{module} must give the module name 6278and the path to the module, separated by a colon. The module name 6279will often be the same as the shared object’s name, but in unusual 6280cases (such as a shared object which implements multiple modules for 6281the same interface) it might not be. For example, to register a 6282client preauthentication module named \sphinxcode{\sphinxupquote{mypreauth}} installed at 6283\sphinxcode{\sphinxupquote{/path/to/mypreauth.so}}, you could write: 6284 6285\begin{sphinxVerbatim}[commandchars=\\\{\}] 6286\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} 6287 \PYG{n}{clpreauth} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6288 \PYG{n}{module} \PYG{o}{=} \PYG{n}{mypreauth}\PYG{p}{:}\PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{mypreauth}\PYG{o}{.}\PYG{n}{so} 6289 \PYG{p}{\PYGZcb{}} 6290\end{sphinxVerbatim} 6291 6292\sphinxAtStartPar 6293Many of the pluggable behaviors in MIT krb5 contain built\sphinxhyphen{}in modules 6294which can be switched off. You can disable a built\sphinxhyphen{}in module (or one 6295you have registered) using the \sphinxstylestrong{disable} directive in the 6296appropriate subsection of the {[}plugins{]} section. For example, to 6297disable the use of .k5identity files to select credential caches, you 6298could write: 6299 6300\begin{sphinxVerbatim}[commandchars=\\\{\}] 6301\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} 6302 \PYG{n}{ccselect} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6303 \PYG{n}{disable} \PYG{o}{=} \PYG{n}{k5identity} 6304 \PYG{p}{\PYGZcb{}} 6305\end{sphinxVerbatim} 6306 6307\sphinxAtStartPar 6308If you want to disable multiple modules, specify the \sphinxstylestrong{disable} 6309directive multiple times, giving one module to disable each time. 6310 6311\sphinxAtStartPar 6312Alternatively, you can explicitly specify which modules you want to be 6313enabled for that behavior using the \sphinxstylestrong{enable\_only} directive. For 6314example, to make {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} check password quality using only a 6315module you have registered, and no other mechanism, you could write: 6316 6317\begin{sphinxVerbatim}[commandchars=\\\{\}] 6318\PYG{p}{[}\PYG{n}{plugins}\PYG{p}{]} 6319 \PYG{n}{pwqual} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6320 \PYG{n}{module} \PYG{o}{=} \PYG{n}{mymodule}\PYG{p}{:}\PYG{o}{/}\PYG{n}{path}\PYG{o}{/}\PYG{n}{to}\PYG{o}{/}\PYG{n}{mymodule}\PYG{o}{.}\PYG{n}{so} 6321 \PYG{n}{enable\PYGZus{}only} \PYG{o}{=} \PYG{n}{mymodule} 6322 \PYG{p}{\PYGZcb{}} 6323\end{sphinxVerbatim} 6324 6325\sphinxAtStartPar 6326Again, if you want to specify multiple modules, specify the 6327\sphinxstylestrong{enable\_only} directive multiple times, giving one module to enable 6328each time. 6329 6330\sphinxAtStartPar 6331Some Kerberos interfaces use different mechanisms to register plugin 6332modules. 6333 6334 6335\subsection{KDC location modules} 6336\label{\detokenize{admin/host_config:kdc-location-modules}} 6337\sphinxAtStartPar 6338For historical reasons, modules to control how KDC servers are located 6339are registered simply by placing the shared object or DLL into the 6340“libkrb5” subdirectory of the krb5 plugin directory, which defaults to 6341{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins}}. For example, Samba’s winbind krb5 6342locator plugin would be registered by placing its shared object in 6343{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins/libkrb5/winbind\_krb5\_locator.so}}. 6344 6345 6346\subsection{GSSAPI mechanism modules} 6347\label{\detokenize{admin/host_config:gssapi-mechanism-modules}}\label{\detokenize{admin/host_config:gssapi-plugin-config}} 6348\sphinxAtStartPar 6349GSSAPI mechanism modules are registered using the file 6350{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech}} or configuration files in the 6351{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech.d}} directory with a \sphinxcode{\sphinxupquote{.conf}} 6352suffix. Each line in these files has the form: 6353 6354\begin{sphinxVerbatim}[commandchars=\\\{\}] 6355\PYG{n}{name} \PYG{n}{oid} \PYG{n}{pathname} \PYG{p}{[}\PYG{n}{options}\PYG{p}{]} \PYG{o}{\PYGZlt{}}\PYG{n+nb}{type}\PYG{o}{\PYGZgt{}} 6356\end{sphinxVerbatim} 6357 6358\sphinxAtStartPar 6359Only the name, oid, and pathname are required. \sphinxstyleemphasis{name} is the 6360mechanism name, which may be used for debugging or logging purposes. 6361\sphinxstyleemphasis{oid} is the object identifier of the GSSAPI mechanism to be 6362registered. \sphinxstyleemphasis{pathname} is a path to the module shared object or DLL. 6363\sphinxstyleemphasis{options} (if present) are options provided to the plugin module, 6364surrounded in square brackets. \sphinxstyleemphasis{type} (if present) can be used to 6365indicate a special type of module. Currently the only special module 6366type is “interposer”, for a module designed to intercept calls to 6367other mechanisms. 6368 6369\sphinxAtStartPar 6370If the environment variable \sphinxstylestrong{GSS\_MECH\_CONFIG} is set, its value is 6371used as the sole mechanism configuration filename. 6372 6373 6374\subsection{Configuration profile modules} 6375\label{\detokenize{admin/host_config:configuration-profile-modules}}\label{\detokenize{admin/host_config:profile-plugin-config}} 6376\sphinxAtStartPar 6377A configuration profile module replaces the information source for 6378{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} itself. To use a profile module, begin krb5.conf 6379with the line: 6380 6381\begin{sphinxVerbatim}[commandchars=\\\{\}] 6382\PYG{n}{module} \PYG{n}{PATHNAME}\PYG{p}{:}\PYG{n}{STRING} 6383\end{sphinxVerbatim} 6384 6385\sphinxAtStartPar 6386where \sphinxstyleemphasis{PATHNAME} is a path to the module shared object or DLL, and 6387\sphinxstyleemphasis{STRING} is a string to provide to the module. The module will then 6388take over, and the rest of krb5.conf will be ignored. 6389 6390 6391\chapter{Backups of secure hosts} 6392\label{\detokenize{admin/backup_host:backups-of-secure-hosts}}\label{\detokenize{admin/backup_host::doc}} 6393\sphinxAtStartPar 6394When you back up a secure host, you should exclude the host’s keytab 6395file from the backup. If someone obtained a copy of the keytab from a 6396backup, that person could make any host masquerade as the host whose 6397keytab was compromised. In many configurations, knowledge of the 6398host’s keytab also allows root access to the host. This could be 6399particularly dangerous if the compromised keytab was from one of your 6400KDCs. If the machine has a disk crash and the keytab file is lost, it 6401is easy to generate another keytab file. (See {\hyperref[\detokenize{admin/appl_servers:add-princ-kt}]{\sphinxcrossref{\DUrole{std,std-ref}{Adding principals to keytabs}}}}.) 6402If you are unable to exclude particular files from backups, you should 6403ensure that the backups are kept as secure as the host’s root 6404password. 6405 6406 6407\section{Backing up the Kerberos database} 6408\label{\detokenize{admin/backup_host:backing-up-the-kerberos-database}} 6409\sphinxAtStartPar 6410As with any file, it is possible that your Kerberos database could 6411become corrupted. If this happens on one of the replica KDCs, you 6412might never notice, since the next automatic propagation of the 6413database would install a fresh copy. However, if it happens to the 6414primary KDC, the corrupted database would be propagated to all of the 6415replicas during the next propagation. For this reason, MIT recommends 6416that you back up your Kerberos database regularly. Because the primary 6417KDC is continuously dumping the database to a file in order to 6418propagate it to the replica KDCs, it is a simple matter to have a cron 6419job periodically copy the dump file to a secure machine elsewhere on 6420your network. (Of course, it is important to make the host where 6421these backups are stored as secure as your KDCs, and to encrypt its 6422transmission across your network.) Then if your database becomes 6423corrupted, you can load the most recent dump onto the primary KDC. 6424(See {\hyperref[\detokenize{admin/database:restore-from-dump}]{\sphinxcrossref{\DUrole{std,std-ref}{Dumping and loading a Kerberos database}}}}.) 6425 6426 6427\chapter{PKINIT configuration} 6428\label{\detokenize{admin/pkinit:pkinit-configuration}}\label{\detokenize{admin/pkinit:pkinit}}\label{\detokenize{admin/pkinit::doc}} 6429\sphinxAtStartPar 6430PKINIT is a preauthentication mechanism for Kerberos 5 which uses 6431X.509 certificates to authenticate the KDC to clients and vice versa. 6432PKINIT can also be used to enable anonymity support, allowing clients 6433to communicate securely with the KDC or with application servers 6434without authenticating as a particular client principal. 6435 6436 6437\section{Creating certificates} 6438\label{\detokenize{admin/pkinit:creating-certificates}} 6439\sphinxAtStartPar 6440PKINIT requires an X.509 certificate for the KDC and one for each 6441client principal which will authenticate using PKINIT. For anonymous 6442PKINIT, a KDC certificate is required, but client certificates are 6443not. A commercially issued server certificate can be used for the KDC 6444certificate, but generally cannot be used for client certificates. 6445 6446\sphinxAtStartPar 6447The instruction in this section describe how to establish a 6448certificate authority and create standard PKINIT certificates. Skip 6449this section if you are using a commercially issued server certificate 6450as the KDC certificate for anonymous PKINIT, or if you are configuring 6451a client to use an Active Directory KDC. 6452 6453 6454\subsection{Generating a certificate authority certificate} 6455\label{\detokenize{admin/pkinit:generating-a-certificate-authority-certificate}} 6456\sphinxAtStartPar 6457You can establish a new certificate authority (CA) for use with a 6458PKINIT deployment with the commands: 6459 6460\begin{sphinxVerbatim}[commandchars=\\\{\}] 6461\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} 6462\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{x509} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{3650} 6463\end{sphinxVerbatim} 6464 6465\sphinxAtStartPar 6466The second command will ask for the values of several certificate 6467fields. These fields can be set to any values. You can adjust the 6468expiration time of the CA certificate by changing the number after 6469\sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. Since the CA certificate must be deployed to client 6470machines each time it changes, it should normally have an expiration 6471time far in the future; however, expiration times after 2037 may cause 6472interoperability issues in rare circumstances. 6473 6474\sphinxAtStartPar 6475The result of these commands will be two files, cakey.pem and 6476cacert.pem. cakey.pem will contain a 2048\sphinxhyphen{}bit RSA private key, which 6477must be carefully protected. cacert.pem will contain the CA 6478certificate, which must be placed in the filesystems of the KDC and 6479each client host. cakey.pem will be required to create KDC and client 6480certificates. 6481 6482 6483\subsection{Generating a KDC certificate} 6484\label{\detokenize{admin/pkinit:generating-a-kdc-certificate}} 6485\sphinxAtStartPar 6486A KDC certificate for use with PKINIT is required to have some unusual 6487fields, which makes generating them with OpenSSL somewhat complicated. 6488First, you will need a file containing the following: 6489 6490\begin{sphinxVerbatim}[commandchars=\\\{\}] 6491[kdc\PYGZus{}cert] 6492basicConstraints=CA:FALSE 6493keyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement 6494extendedKeyUsage=1.3.6.1.5.2.3.5 6495subjectKeyIdentifier=hash 6496authorityKeyIdentifier=keyid,issuer 6497issuerAltName=issuer:copy 6498subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc\PYGZus{}princ\PYGZus{}name 6499 6500[kdc\PYGZus{}princ\PYGZus{}name] 6501realm=EXP:0,GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} 6502principal\PYGZus{}name=EXP:1,SEQUENCE:kdc\PYGZus{}principal\PYGZus{}seq 6503 6504[kdc\PYGZus{}principal\PYGZus{}seq] 6505name\PYGZus{}type=EXP:0,INTEGER:2 6506name\PYGZus{}string=EXP:1,SEQUENCE:kdc\PYGZus{}principals 6507 6508[kdc\PYGZus{}principals] 6509princ1=GeneralString:krbtgt 6510princ2=GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} 6511\end{sphinxVerbatim} 6512 6513\sphinxAtStartPar 6514If the above contents are placed in extensions.kdc, you can generate 6515and sign a KDC certificate with the following commands: 6516 6517\begin{sphinxVerbatim}[commandchars=\\\{\}] 6518\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} 6519\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} 6520\PYG{n}{env} \PYG{n}{REALM}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}REALMNAME} \PYG{n}{openssl} \PYG{n}{x509} \PYG{o}{\PYGZhy{}}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{o+ow}{in} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} \PYGZbs{} 6521 \PYG{o}{\PYGZhy{}}\PYG{n}{CAkey} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{CA} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{365} \PYGZbs{} 6522 \PYG{o}{\PYGZhy{}}\PYG{n}{extfile} \PYG{n}{extensions}\PYG{o}{.}\PYG{n}{kdc} \PYG{o}{\PYGZhy{}}\PYG{n}{extensions} \PYG{n}{kdc\PYGZus{}cert} \PYG{o}{\PYGZhy{}}\PYG{n}{CAcreateserial} 6523\PYG{n}{rm} \PYG{n}{kdc}\PYG{o}{.}\PYG{n}{req} 6524\end{sphinxVerbatim} 6525 6526\sphinxAtStartPar 6527The second command will ask for the values of certificate fields, 6528which can be set to any values. In the third command, substitute your 6529KDC’s realm name for YOUR\_REALMNAME. You can adjust the certificate’s 6530expiration date by changing the number after \sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. Remember to 6531create a new KDC certificate before the old one expires. 6532 6533\sphinxAtStartPar 6534The result of this operation will be in two files, kdckey.pem and 6535kdc.pem. Both files must be placed in the KDC’s filesystem. 6536kdckey.pem, which contains the KDC’s private key, must be carefully 6537protected. 6538 6539\sphinxAtStartPar 6540If you examine the KDC certificate with \sphinxcode{\sphinxupquote{openssl x509 \sphinxhyphen{}in kdc.pem 6541\sphinxhyphen{}text \sphinxhyphen{}noout}}, OpenSSL will not know how to display the KDC principal 6542name in the Subject Alternative Name extension, so it will appear as 6543\sphinxcode{\sphinxupquote{othername:\textless{}unsupported\textgreater{}}}. This is normal and does not mean 6544anything is wrong with the KDC certificate. 6545 6546 6547\subsection{Generating client certificates} 6548\label{\detokenize{admin/pkinit:generating-client-certificates}} 6549\sphinxAtStartPar 6550PKINIT client certificates also must have some unusual certificate 6551fields. To generate a client certificate with OpenSSL for a 6552single\sphinxhyphen{}component principal name, you will need an extensions file 6553(different from the KDC extensions file above) containing: 6554 6555\begin{sphinxVerbatim}[commandchars=\\\{\}] 6556[client\PYGZus{}cert] 6557basicConstraints=CA:FALSE 6558keyUsage=digitalSignature,keyEncipherment,keyAgreement 6559extendedKeyUsage=1.3.6.1.5.2.3.4 6560subjectKeyIdentifier=hash 6561authorityKeyIdentifier=keyid,issuer 6562issuerAltName=issuer:copy 6563subjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ\PYGZus{}name 6564 6565[princ\PYGZus{}name] 6566realm=EXP:0,GeneralString:\PYGZdl{}\PYGZob{}ENV::REALM\PYGZcb{} 6567principal\PYGZus{}name=EXP:1,SEQUENCE:principal\PYGZus{}seq 6568 6569[principal\PYGZus{}seq] 6570name\PYGZus{}type=EXP:0,INTEGER:1 6571name\PYGZus{}string=EXP:1,SEQUENCE:principals 6572 6573[principals] 6574princ1=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT\PYGZcb{} 6575\end{sphinxVerbatim} 6576 6577\sphinxAtStartPar 6578If the above contents are placed in extensions.client, you can 6579generate and sign a client certificate with the following commands: 6580 6581\begin{sphinxVerbatim}[commandchars=\\\{\}] 6582\PYG{n}{openssl} \PYG{n}{genrsa} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} \PYG{l+m+mi}{2048} 6583\PYG{n}{openssl} \PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{n}{new} \PYG{o}{\PYGZhy{}}\PYG{n}{key} \PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} 6584\PYG{n}{env} \PYG{n}{REALM}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}REALMNAME} \PYG{n}{CLIENT}\PYG{o}{=}\PYG{n}{YOUR\PYGZus{}PRINCNAME} \PYG{n}{openssl} \PYG{n}{x509} \PYGZbs{} 6585 \PYG{o}{\PYGZhy{}}\PYG{n}{CAkey} \PYG{n}{cakey}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{CA} \PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} \PYG{o}{\PYGZhy{}}\PYG{n}{req} \PYG{o}{\PYGZhy{}}\PYG{o+ow}{in} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} \PYGZbs{} 6586 \PYG{o}{\PYGZhy{}}\PYG{n}{extensions} \PYG{n}{client\PYGZus{}cert} \PYG{o}{\PYGZhy{}}\PYG{n}{extfile} \PYG{n}{extensions}\PYG{o}{.}\PYG{n}{client} \PYGZbs{} 6587 \PYG{o}{\PYGZhy{}}\PYG{n}{days} \PYG{l+m+mi}{365} \PYG{o}{\PYGZhy{}}\PYG{n}{out} \PYG{n}{client}\PYG{o}{.}\PYG{n}{pem} 6588\PYG{n}{rm} \PYG{n}{client}\PYG{o}{.}\PYG{n}{req} 6589\end{sphinxVerbatim} 6590 6591\sphinxAtStartPar 6592Normally, the first two commands should be run on the client host, and 6593the resulting client.req file transferred to the certificate authority 6594host for the third command. As in the previous steps, the second 6595command will ask for the values of certificate fields, which can be 6596set to any values. In the third command, substitute your realm’s name 6597for YOUR\_REALMNAME and the client’s principal name (without realm) for 6598YOUR\_PRINCNAME. You can adjust the certificate’s expiration date by 6599changing the number after \sphinxcode{\sphinxupquote{\sphinxhyphen{}days}}. 6600 6601\sphinxAtStartPar 6602The result of this operation will be two files, clientkey.pem and 6603client.pem. Both files must be present on the client’s host; 6604clientkey.pem, which contains the client’s private key, must be 6605protected from access by others. 6606 6607\sphinxAtStartPar 6608As in the KDC certificate, OpenSSL will display the client principal 6609name as \sphinxcode{\sphinxupquote{othername:\textless{}unsupported\textgreater{}}} in the Subject Alternative Name 6610extension of a PKINIT client certificate. 6611 6612\sphinxAtStartPar 6613If the client principal name contains more than one component 6614(e.g. \sphinxcode{\sphinxupquote{host/example.com@REALM}}), the \sphinxcode{\sphinxupquote{{[}principals{]}}} section of 6615\sphinxcode{\sphinxupquote{extensions.client}} must be altered to contain multiple entries. 6616(Simply setting \sphinxcode{\sphinxupquote{CLIENT}} to \sphinxcode{\sphinxupquote{host/example.com}} would generate a 6617certificate for \sphinxcode{\sphinxupquote{host\textbackslash{}/example.com@REALM}} which would not match the 6618multi\sphinxhyphen{}component principal name.) For a two\sphinxhyphen{}component principal, the 6619section should read: 6620 6621\begin{sphinxVerbatim}[commandchars=\\\{\}] 6622[principals] 6623princ1=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT1\PYGZcb{} 6624princ2=GeneralString:\PYGZdl{}\PYGZob{}ENV::CLIENT2\PYGZcb{} 6625\end{sphinxVerbatim} 6626 6627\sphinxAtStartPar 6628The environment variables \sphinxcode{\sphinxupquote{CLIENT1}} and \sphinxcode{\sphinxupquote{CLIENT2}} must then be set 6629to the first and second components when running \sphinxcode{\sphinxupquote{openssl x509}}. 6630 6631 6632\section{Configuring the KDC} 6633\label{\detokenize{admin/pkinit:configuring-the-kdc}} 6634\sphinxAtStartPar 6635The KDC must have filesystem access to the KDC certificate (kdc.pem) 6636and the KDC private key (kdckey.pem). Configure the following 6637relation in the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file, either in the 6638{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} section or in a {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection (with 6639appropriate pathnames): 6640 6641\begin{sphinxVerbatim}[commandchars=\\\{\}] 6642\PYG{n}{pkinit\PYGZus{}identity} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{pem}\PYG{p}{,}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{kdckey}\PYG{o}{.}\PYG{n}{pem} 6643\end{sphinxVerbatim} 6644 6645\sphinxAtStartPar 6646If any clients will authenticate using regular (as opposed to 6647anonymous) PKINIT, the KDC must also have filesystem access to the CA 6648certificate (cacert.pem), and the following configuration (with the 6649appropriate pathname): 6650 6651\begin{sphinxVerbatim}[commandchars=\\\{\}] 6652\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{var}\PYG{o}{/}\PYG{n}{lib}\PYG{o}{/}\PYG{n}{krb5kdc}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} 6653\end{sphinxVerbatim} 6654 6655\sphinxAtStartPar 6656Because of the larger size of requests and responses using PKINIT, you 6657may also need to allow TCP access to the KDC: 6658 6659\begin{sphinxVerbatim}[commandchars=\\\{\}] 6660\PYG{n}{kdc\PYGZus{}tcp\PYGZus{}listen} \PYG{o}{=} \PYG{l+m+mi}{88} 6661\end{sphinxVerbatim} 6662 6663\sphinxAtStartPar 6664Restart the {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} daemon to pick up the configuration 6665changes. 6666 6667\sphinxAtStartPar 6668The principal entry for each PKINIT\sphinxhyphen{}using client must be configured to 6669require preauthentication. Ensure this with the command: 6670 6671\begin{sphinxVerbatim}[commandchars=\\\{\}] 6672\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{modprinc +requires\PYGZus{}preauth YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} 6673\end{sphinxVerbatim} 6674 6675\sphinxAtStartPar 6676Starting with release 1.12, it is possible to remove the long\sphinxhyphen{}term 6677keys of a principal entry, which can save some space in the database 6678and help to clarify some PKINIT\sphinxhyphen{}related error conditions by not asking 6679for a password: 6680 6681\begin{sphinxVerbatim}[commandchars=\\\{\}] 6682\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{purgekeys \PYGZhy{}all YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} 6683\end{sphinxVerbatim} 6684 6685\sphinxAtStartPar 6686These principal options can also be specified at principal creation 6687time as follows: 6688 6689\begin{sphinxVerbatim}[commandchars=\\\{\}] 6690\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{add\PYGZus{}principal +requires\PYGZus{}preauth \PYGZhy{}nokey YOUR\PYGZus{}PRINCNAME}\PYG{l+s+s1}{\PYGZsq{}} 6691\end{sphinxVerbatim} 6692 6693\sphinxAtStartPar 6694By default, the KDC requires PKINIT client certificates to have the 6695standard Extended Key Usage and Subject Alternative Name attributes 6696for PKINIT. Starting in release 1.16, it is possible to authorize 6697client certificates based on the subject or other criteria instead of 6698the standard PKINIT Subject Alternative Name, by setting the 6699\sphinxstylestrong{pkinit\_cert\_match} string attribute on each client principal entry. 6700For example: 6701 6702\begin{sphinxVerbatim}[commandchars=\\\{\}] 6703\PYG{n}{kadmin} \PYG{n}{set\PYGZus{}string} \PYG{n}{user}\PYG{n+nd}{@REALM} \PYG{n}{pkinit\PYGZus{}cert\PYGZus{}match} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZlt{}SUBJECT\PYGZgt{}CN=user@REALM\PYGZdl{}}\PYG{l+s+s2}{\PYGZdq{}} 6704\end{sphinxVerbatim} 6705 6706\sphinxAtStartPar 6707The \sphinxstylestrong{pkinit\_cert\_match} string attribute follows the syntax used by 6708the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} \sphinxstylestrong{pkinit\_cert\_match} relation. To allow the 6709use of non\sphinxhyphen{}PKINIT client certificates, it will also be necessary to 6710disable key usage checking using the \sphinxstylestrong{pkinit\_eku\_checking} relation; 6711for example: 6712 6713\begin{sphinxVerbatim}[commandchars=\\\{\}] 6714\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} 6715 \PYG{n}{pkinit\PYGZus{}eku\PYGZus{}checking} \PYG{o}{=} \PYG{n}{none} 6716\end{sphinxVerbatim} 6717 6718 6719\section{Configuring the clients} 6720\label{\detokenize{admin/pkinit:configuring-the-clients}} 6721\sphinxAtStartPar 6722Client hosts must be configured to trust the issuing authority for the 6723KDC certificate. For a newly established certificate authority, the 6724client host must have filesystem access to the CA certificate 6725(cacert.pem) and the following relation in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} in the 6726appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection (with appropriate pathnames): 6727 6728\begin{sphinxVerbatim}[commandchars=\\\{\}] 6729\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} 6730\end{sphinxVerbatim} 6731 6732\sphinxAtStartPar 6733If the KDC certificate is a commercially issued server certificate, 6734the issuing certificate is most likely included in a system directory. 6735You can specify it by filename as above, or specify the whole 6736directory like so: 6737 6738\begin{sphinxVerbatim}[commandchars=\\\{\}] 6739\PYG{n}{pkinit\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{DIR}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{ssl}\PYG{o}{/}\PYG{n}{certs} 6740\end{sphinxVerbatim} 6741 6742\sphinxAtStartPar 6743A commercially issued server certificate will usually not have the 6744standard PKINIT principal name or Extended Key Usage extensions, so 6745the following additional configuration is required: 6746 6747\begin{sphinxVerbatim}[commandchars=\\\{\}] 6748\PYG{n}{pkinit\PYGZus{}eku\PYGZus{}checking} \PYG{o}{=} \PYG{n}{kpServerAuth} 6749\PYG{n}{pkinit\PYGZus{}kdc\PYGZus{}hostname} \PYG{o}{=} \PYG{n}{hostname}\PYG{o}{.}\PYG{n}{of}\PYG{o}{.}\PYG{n}{kdc}\PYG{o}{.}\PYG{n}{certificate} 6750\end{sphinxVerbatim} 6751 6752\sphinxAtStartPar 6753Multiple \sphinxstylestrong{pkinit\_kdc\_hostname} relations can be configured to 6754recognize multiple KDC certificates. If the KDC is an Active 6755Directory domain controller, setting \sphinxstylestrong{pkinit\_kdc\_hostname} is 6756necessary, but it should not be necessary to set 6757\sphinxstylestrong{pkinit\_eku\_checking}. 6758 6759\sphinxAtStartPar 6760To perform regular (as opposed to anonymous) PKINIT authentication, a 6761client host must have filesystem access to a client certificate 6762(client.pem), and the corresponding private key (clientkey.pem). 6763Configure the following relations in the client host’s 6764{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in the appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection 6765(with appropriate pathnames): 6766 6767\begin{sphinxVerbatim}[commandchars=\\\{\}] 6768\PYG{n}{pkinit\PYGZus{}identities} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{client}\PYG{o}{.}\PYG{n}{pem}\PYG{p}{,}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{clientkey}\PYG{o}{.}\PYG{n}{pem} 6769\end{sphinxVerbatim} 6770 6771\sphinxAtStartPar 6772If the KDC and client are properly configured, it should now be 6773possible to run \sphinxcode{\sphinxupquote{kinit username}} without entering a password. 6774 6775 6776\section{Anonymous PKINIT} 6777\label{\detokenize{admin/pkinit:anonymous-pkinit}}\label{\detokenize{admin/pkinit:id1}} 6778\sphinxAtStartPar 6779Anonymity support in Kerberos allows a client to obtain a ticket 6780without authenticating as any particular principal. Such a ticket can 6781be used as a FAST armor ticket, or to securely communicate with an 6782application server anonymously. 6783 6784\sphinxAtStartPar 6785To configure anonymity support, you must generate or otherwise procure 6786a KDC certificate and configure the KDC host, but you do not need to 6787generate any client certificates. On the KDC, you must set the 6788\sphinxstylestrong{pkinit\_identity} variable to provide the KDC certificate, but do 6789not need to set the \sphinxstylestrong{pkinit\_anchors} variable or store the issuing 6790certificate if you won’t have any client certificates to verify. On 6791client hosts, you must set the \sphinxstylestrong{pkinit\_anchors} variable (and 6792possibly \sphinxstylestrong{pkinit\_kdc\_hostname} and \sphinxstylestrong{pkinit\_eku\_checking}) in order 6793to trust the issuing authority for the KDC certificate, but do not 6794need to set the \sphinxstylestrong{pkinit\_identities} variable. 6795 6796\sphinxAtStartPar 6797Anonymity support is not enabled by default. To enable it, you must 6798create the principal \sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS}} using the command: 6799 6800\begin{sphinxVerbatim}[commandchars=\\\{\}] 6801\PYG{n}{kadmin} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{addprinc \PYGZhy{}randkey WELLKNOWN/ANONYMOUS}\PYG{l+s+s1}{\PYGZsq{}} 6802\end{sphinxVerbatim} 6803 6804\sphinxAtStartPar 6805Some Kerberos deployments include application servers which lack 6806proper access control, and grant some level of access to any user who 6807can authenticate. In such an environment, enabling anonymity support 6808on the KDC would present a security issue. If you need to enable 6809anonymity support for TGTs (for use as FAST armor tickets) without 6810enabling anonymous authentication to application servers, you can set 6811the variable \sphinxstylestrong{restrict\_anonymous\_to\_tgt} to \sphinxcode{\sphinxupquote{true}} in the 6812appropriate {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the KDC’s 6813{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. 6814 6815\sphinxAtStartPar 6816To obtain anonymous credentials on a client, run \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}n}}, or 6817\sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}n @REALMNAME}} to specify a realm. The resulting tickets 6818will have the client name \sphinxcode{\sphinxupquote{WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS}}. 6819 6820 6821\section{Freshness tokens} 6822\label{\detokenize{admin/pkinit:freshness-tokens}} 6823\sphinxAtStartPar 6824Freshness tokens can ensure that the client has recently had access to 6825its certificate private key. If freshness tokens are not required by 6826the KDC, a client program with temporary possession of the private key 6827can compose requests for future timestamps and use them later. 6828 6829\sphinxAtStartPar 6830In release 1.17 and later, freshness tokens are supported by the 6831client and are sent by the KDC when the client indicates support for 6832them. Because not all clients support freshness tokens yet, they are 6833not required by default. To check if freshness tokens are supported 6834by a realm’s clients, look in the KDC logs for the lines: 6835 6836\begin{sphinxVerbatim}[commandchars=\\\{\}] 6837\PYG{n}{PKINIT}\PYG{p}{:} \PYG{n}{freshness} \PYG{n}{token} \PYG{n}{received} \PYG{k+kn}{from} \PYG{o}{\PYGZlt{}}\PYG{n}{client} \PYG{n}{principal}\PYG{o}{\PYGZgt{}} 6838\PYG{n}{PKINIT}\PYG{p}{:} \PYG{n}{no} \PYG{n}{freshness} \PYG{n}{token} \PYG{n}{received} \PYG{k+kn}{from} \PYG{o}{\PYGZlt{}}\PYG{n}{client} \PYG{n}{principal}\PYG{o}{\PYGZgt{}} 6839\end{sphinxVerbatim} 6840 6841\sphinxAtStartPar 6842To require freshness tokens for all clients in a realm (except for 6843clients authenticating anonymously), set the 6844\sphinxstylestrong{pkinit\_require\_freshness} variable to \sphinxcode{\sphinxupquote{true}} in the appropriate 6845{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the KDC’s {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. To 6846test that this option is in effect, run \sphinxcode{\sphinxupquote{kinit \sphinxhyphen{}X disable\_freshness}} 6847and verify that authentication is unsuccessful. 6848 6849 6850\chapter{OTP Preauthentication} 6851\label{\detokenize{admin/otp:otp-preauthentication}}\label{\detokenize{admin/otp:otp-preauth}}\label{\detokenize{admin/otp::doc}} 6852\sphinxAtStartPar 6853OTP is a preauthentication mechanism for Kerberos 5 which uses One 6854Time Passwords (OTP) to authenticate the client to the KDC. The OTP 6855is passed to the KDC over an encrypted FAST channel in clear\sphinxhyphen{}text. 6856The KDC uses the password along with per\sphinxhyphen{}user configuration to proxy 6857the request to a third\sphinxhyphen{}party RADIUS system. This enables 6858out\sphinxhyphen{}of\sphinxhyphen{}the\sphinxhyphen{}box compatibility with a large number of already widely 6859deployed proprietary systems. 6860 6861\sphinxAtStartPar 6862Additionally, our implementation of the OTP system allows for the 6863passing of RADIUS requests over a UNIX domain stream socket. This 6864permits the use of a local companion daemon which can handle the 6865details of authentication. 6866 6867 6868\section{Defining token types} 6869\label{\detokenize{admin/otp:defining-token-types}} 6870\sphinxAtStartPar 6871Token types are defined in either {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} or 6872{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} according to the following format: 6873 6874\begin{sphinxVerbatim}[commandchars=\\\{\}] 6875\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} 6876 \PYG{o}{\PYGZlt{}}\PYG{n}{name}\PYG{o}{\PYGZgt{}} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6877 \PYG{n}{server} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{host}\PYG{p}{:}\PYG{n}{port} \PYG{o+ow}{or} \PYG{n}{filename}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{see} \PYG{n}{below}\PYG{p}{)} 6878 \PYG{n}{secret} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{filename}\PYG{o}{\PYGZgt{}} 6879 \PYG{n}{timeout} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{integer}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{l+m+mi}{5} \PYG{p}{[}\PYG{n}{seconds}\PYG{p}{]}\PYG{p}{)} 6880 \PYG{n}{retries} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{integer}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{l+m+mi}{3}\PYG{p}{)} 6881 \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{boolean}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{true}\PYG{p}{)} 6882 \PYG{n}{indicator} \PYG{o}{=} \PYG{o}{\PYGZlt{}}\PYG{n}{string}\PYG{o}{\PYGZgt{}} \PYG{p}{(}\PYG{n}{default}\PYG{p}{:} \PYG{n}{none}\PYG{p}{)} 6883 \PYG{p}{\PYGZcb{}} 6884\end{sphinxVerbatim} 6885 6886\sphinxAtStartPar 6887If the server field begins with ‘/’, it will be interpreted as a UNIX 6888socket. Otherwise, it is assumed to be in the format host:port. When 6889a UNIX domain socket is specified, the secret field is optional and an 6890empty secret is used by default. If the server field is not 6891specified, it defaults to {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{RUNSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/\textless{}name\textgreater{}.socket}}. 6892 6893\sphinxAtStartPar 6894When forwarding the request over RADIUS, by default the principal is 6895used in the User\sphinxhyphen{}Name attribute of the RADIUS packet. The strip\_realm 6896parameter controls whether the principal is forwarded with or without 6897the realm portion. 6898 6899\sphinxAtStartPar 6900If an indicator field is present, tickets issued using this token type 6901will be annotated with the specified authentication indicator (see 6902{\hyperref[\detokenize{admin/auth_indicator:auth-indicator}]{\sphinxcrossref{\DUrole{std,std-ref}{Authentication indicators}}}}). This key may be specified multiple times to 6903add multiple indicators. 6904 6905 6906\section{The default token type} 6907\label{\detokenize{admin/otp:the-default-token-type}} 6908\sphinxAtStartPar 6909A default token type is used internally when no token type is specified for a 6910given user. It is defined as follows: 6911 6912\begin{sphinxVerbatim}[commandchars=\\\{\}] 6913\PYG{p}{[}\PYG{n}{otp}\PYG{p}{]} 6914 \PYG{n}{DEFAULT} \PYG{o}{=} \PYG{p}{\PYGZob{}} 6915 \PYG{n}{strip\PYGZus{}realm} \PYG{o}{=} \PYG{n}{false} 6916 \PYG{p}{\PYGZcb{}} 6917\end{sphinxVerbatim} 6918 6919\sphinxAtStartPar 6920The administrator may override the internal \sphinxcode{\sphinxupquote{DEFAULT}} token type 6921simply by defining a configuration with the same name. 6922 6923 6924\section{Token instance configuration} 6925\label{\detokenize{admin/otp:token-instance-configuration}} 6926\sphinxAtStartPar 6927To enable OTP for a client principal, the administrator must define 6928the \sphinxstylestrong{otp} string attribute for that principal. (See 6929{\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}}.) The \sphinxstylestrong{otp} user string is a JSON string of the 6930format: 6931 6932\begin{sphinxVerbatim}[commandchars=\\\{\}] 6933[\PYGZob{} 6934 \PYGZdq{}type\PYGZdq{}: \PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}}, 6935 \PYGZdq{}username\PYGZdq{}: \PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}}, 6936 \PYGZdq{}indicators\PYGZdq{}: [\PYG{n+nt}{\PYGZlt{}string}\PYG{n+nt}{\PYGZgt{}}, ...] 6937 \PYGZcb{}, ...] 6938\end{sphinxVerbatim} 6939 6940\sphinxAtStartPar 6941This is an array of token objects. Both fields of token objects are 6942optional. The \sphinxstylestrong{type} field names the token type of this token; if 6943not specified, it defaults to \sphinxcode{\sphinxupquote{DEFAULT}}. The \sphinxstylestrong{username} field 6944specifies the value to be sent in the User\sphinxhyphen{}Name RADIUS attribute. If 6945not specified, the principal name is sent, with or without realm as 6946defined in the token type. The \sphinxstylestrong{indicators} field specifies a list 6947of authentication indicators to annotate tickets with, overriding any 6948indicators specified in the token type. 6949 6950\sphinxAtStartPar 6951For ease of configuration, an empty array (\sphinxcode{\sphinxupquote{{[}{]}}}) is treated as 6952equivalent to one DEFAULT token (\sphinxcode{\sphinxupquote{{[}\{\}{]}}}). 6953 6954 6955\section{Other considerations} 6956\label{\detokenize{admin/otp:other-considerations}}\begin{enumerate} 6957\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 6958\item {} 6959\sphinxAtStartPar 6960FAST is required for OTP to work. 6961 6962\end{enumerate} 6963 6964 6965\chapter{SPAKE Preauthentication} 6966\label{\detokenize{admin/spake:spake-preauthentication}}\label{\detokenize{admin/spake:spake}}\label{\detokenize{admin/spake::doc}} 6967\sphinxAtStartPar 6968SPAKE preauthentication (added in release 1.17) uses public key 6969cryptography techniques to protect against {\hyperref[\detokenize{admin/dictionary:dictionary}]{\sphinxcrossref{\DUrole{std,std-ref}{password dictionary 6970attacks}}}}. Unlike {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}}, it does not 6971require any additional infrastructure such as certificates; it simply 6972needs to be turned on. Using SPAKE preauthentication may modestly 6973increase the CPU and network load on the KDC. 6974 6975\sphinxAtStartPar 6976SPAKE preauthentication can use one of four elliptic curve groups for 6977its password\sphinxhyphen{}authenticated key exchange. The recommended group is 6978\sphinxcode{\sphinxupquote{edwards25519}}; three NIST curves (\sphinxcode{\sphinxupquote{P\sphinxhyphen{}256}}, \sphinxcode{\sphinxupquote{P\sphinxhyphen{}384}}, and 6979\sphinxcode{\sphinxupquote{P\sphinxhyphen{}521}}) are also supported. 6980 6981\sphinxAtStartPar 6982By default, SPAKE with the \sphinxcode{\sphinxupquote{edwards25519}} group is enabled on 6983clients, but the KDC does not offer SPAKE by default. To turn it on, 6984set the \sphinxstylestrong{spake\_preauth\_groups} variable in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} to a 6985list of allowed groups. This variable affects both the client and the 6986KDC. Simply setting it to \sphinxcode{\sphinxupquote{edwards25519}} is recommended: 6987 6988\begin{sphinxVerbatim}[commandchars=\\\{\}] 6989\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 6990 \PYG{n}{spake\PYGZus{}preauth\PYGZus{}groups} \PYG{o}{=} \PYG{n}{edwards25519} 6991\end{sphinxVerbatim} 6992 6993\sphinxAtStartPar 6994Set the \sphinxstylestrong{+requires\_preauth} and \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flags on client 6995principal entries, as you would for any preauthentication mechanism: 6996 6997\begin{sphinxVerbatim}[commandchars=\\\{\}] 6998\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{modprinc} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{PRINCNAME} 6999\end{sphinxVerbatim} 7000 7001\sphinxAtStartPar 7002Clients which do not implement SPAKE preauthentication will fall back 7003to encrypted timestamp. 7004 7005\sphinxAtStartPar 7006An active attacker can force a fallback to encrypted timestamp by 7007modifying the initial KDC response, defeating the protection against 7008dictionary attacks. To prevent this fallback on clients which do 7009implement SPAKE preauthentication, set the 7010\sphinxstylestrong{disable\_encrypted\_timestamp} variable to \sphinxcode{\sphinxupquote{true}} in the 7011{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection for realms whose KDCs offer SPAKE 7012preauthentication. 7013 7014\sphinxAtStartPar 7015By default, SPAKE preauthentication requires an extra network round 7016trip to the KDC during initial authentication. If most of the clients 7017in a realm support SPAKE, this extra round trip can be eliminated 7018using an optimistic challenge, by setting the 7019\sphinxstylestrong{spake\_preauth\_kdc\_challenge} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} to a 7020single group name: 7021 7022\begin{sphinxVerbatim}[commandchars=\\\{\}] 7023\PYG{p}{[}\PYG{n}{kdcdefaults}\PYG{p}{]} 7024 \PYG{n}{spake\PYGZus{}preauth\PYGZus{}kdc\PYGZus{}challenge} \PYG{o}{=} \PYG{n}{edwards25519} 7025\end{sphinxVerbatim} 7026 7027\sphinxAtStartPar 7028Using optimistic challenge will cause the KDC to do extra work for 7029initial authentication requests that do not result in SPAKE 7030preauthentication, but will save work when SPAKE preauthentication is 7031used. 7032 7033 7034\chapter{Addressing dictionary attack risks} 7035\label{\detokenize{admin/dictionary:addressing-dictionary-attack-risks}}\label{\detokenize{admin/dictionary:dictionary}}\label{\detokenize{admin/dictionary::doc}} 7036\sphinxAtStartPar 7037Kerberos initial authentication is normally secured using the client 7038principal’s long\sphinxhyphen{}term key, which for users is generally derived from a 7039password. Using a pasword\sphinxhyphen{}derived long\sphinxhyphen{}term key carries the risk of a 7040dictionary attack, where an attacker tries a sequence of possible 7041passwords, possibly requiring much less effort than would be required 7042to try all possible values of the key. Even if {\hyperref[\detokenize{admin/database:policies}]{\sphinxcrossref{\DUrole{std,std-ref}{password policy 7043objects}}}} are used to force users not to pick trivial 7044passwords, dictionary attacks can sometimes be successful against a 7045significant fraction of the users in a realm. Dictionary attacks are 7046not a concern for principals using random keys. 7047 7048\sphinxAtStartPar 7049A dictionary attack may be online or offline. An online dictionary 7050attack is performed by trying each password in a separate request to 7051the KDC, and is therefore visible to the KDC and also limited in speed 7052by the KDC’s processing power and the network capacity between the 7053client and the KDC. Online dictionary attacks can be mitigated using 7054{\hyperref[\detokenize{admin/lockout:lockout}]{\sphinxcrossref{\DUrole{std,std-ref}{account lockout}}}}. This measure is not totally 7055satisfactory, as it makes it easy for an attacker to deny access to a 7056client principal. 7057 7058\sphinxAtStartPar 7059An offline dictionary attack is performed by obtaining a ciphertext 7060generated using the password\sphinxhyphen{}derived key, and trying each password 7061against the ciphertext. This category of attack is invisible to the 7062KDC and can be performed much faster than an online attack. The 7063attack will generally take much longer with more recent encryption 7064types (particularly the ones based on AES), because those encryption 7065types use a much more expensive string\sphinxhyphen{}to\sphinxhyphen{}key function. However, the 7066best defense is to deny the attacker access to a useful ciphertext. 7067The required defensive measures depend on the attacker’s level of 7068network access. 7069 7070\sphinxAtStartPar 7071An off\sphinxhyphen{}path attacker has no access to packets sent between legitimate 7072users and the KDC. An off\sphinxhyphen{}path attacker could gain access to an 7073attackable ciphertext either by making an AS request for a client 7074principal which does not have the \sphinxstylestrong{+requires\_preauth} flag, or by 7075making a TGS request (after authenticating as a different user) for a 7076server principal which does not have the \sphinxstylestrong{\sphinxhyphen{}allow\_svr} flag. To 7077address off\sphinxhyphen{}path attackers, a KDC administrator should set those flags 7078on principals with password\sphinxhyphen{}derived keys: 7079 7080\begin{sphinxVerbatim}[commandchars=\\\{\}] 7081\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{add\PYGZus{}principal} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}svr} \PYG{n}{princname} 7082\end{sphinxVerbatim} 7083 7084\sphinxAtStartPar 7085An attacker with passive network access (one who can monitor packets 7086sent between legitimate users and the KDC, but cannot change them or 7087insert their own packets) can gain access to an attackable ciphertext 7088by observing an authentication by a user using the most common form of 7089preauthentication, encrypted timestamp. Any of the following methods 7090can prevent dictionary attacks by attackers with passive network 7091access: 7092\begin{itemize} 7093\item {} 7094\sphinxAtStartPar 7095Enabling {\hyperref[\detokenize{admin/spake:spake}]{\sphinxcrossref{\DUrole{std,std-ref}{SPAKE preauthentication}}}} (added in release 70961.17) on the KDC, and ensuring that all clients are able to support 7097it. 7098 7099\item {} 7100\sphinxAtStartPar 7101Using an {\hyperref[\detokenize{admin/https:https}]{\sphinxcrossref{\DUrole{std,std-ref}{HTTPS proxy}}}} for communication with the KDC, 7102if the attacker cannot monitor communication between the proxy 7103server and the KDC. 7104 7105\item {} 7106\sphinxAtStartPar 7107Using FAST, protecting the initial authentication with either a 7108random key (such as a host key) or with {\hyperref[\detokenize{admin/pkinit:anonymous-pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{anonymous PKINIT}}}}. 7109 7110\end{itemize} 7111 7112\sphinxAtStartPar 7113An attacker with active network access (one who can inject or modify 7114packets sent between legitimate users and the KDC) can try to fool the 7115client software into sending an attackable ciphertext using an 7116encryption type and salt string of the attacker’s choosing. Any of the 7117following methods can prevent dictionary attacks by active attackers: 7118\begin{itemize} 7119\item {} 7120\sphinxAtStartPar 7121Enabling SPAKE preauthentication and setting the 7122\sphinxstylestrong{disable\_encrypted\_timestamp} variable to \sphinxcode{\sphinxupquote{true}} in the 7123{\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection of the client configuration. 7124 7125\item {} 7126\sphinxAtStartPar 7127Using an HTTPS proxy as described above, configured in the client’s 7128krb5.conf realm configuration. If {\hyperref[\detokenize{admin/realm_config:kdc-discovery}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC discovery}}}} is used to locate a proxy server, an active 7129attacker may be able to use DNS spoofing to cause the client to use 7130a different HTTPS server or to not use HTTPS. 7131 7132\item {} 7133\sphinxAtStartPar 7134Using FAST as described above. 7135 7136\end{itemize} 7137 7138\sphinxAtStartPar 7139If {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}} or {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP}}}} are used for 7140initial authentication, the principal’s long\sphinxhyphen{}term keys are not used 7141and dictionary attacks are usually not a concern. 7142 7143 7144\chapter{Principal names and DNS} 7145\label{\detokenize{admin/princ_dns:principal-names-and-dns}}\label{\detokenize{admin/princ_dns::doc}} 7146\sphinxAtStartPar 7147Kerberos clients can do DNS lookups to canonicalize service principal 7148names. This can cause difficulties when setting up Kerberos 7149application servers, especially when the client’s name for the service 7150is different from what the service thinks its name is. 7151 7152 7153\section{Service principal names} 7154\label{\detokenize{admin/princ_dns:service-principal-names}} 7155\sphinxAtStartPar 7156A frequently used kind of principal name is the host\sphinxhyphen{}based service 7157principal name. This kind of principal name has two components: a 7158service name and a hostname. For example, \sphinxcode{\sphinxupquote{imap/imap.example.com}} 7159is the principal name of the “imap” service on the host 7160“imap.example.com”. Other possible service names for the first 7161component include “host” (remote login services such as ssh), “HTTP”, 7162and “nfs” (Network File System). 7163 7164\sphinxAtStartPar 7165Service administrators often publish well\sphinxhyphen{}known hostname aliases that 7166they would prefer users to use instead of the canonical name of the 7167service host. This gives service administrators more flexibility in 7168deploying services. For example, a shell login server might be named 7169“long\sphinxhyphen{}vanity\sphinxhyphen{}hostname.example.com”, but users will naturally prefer to 7170type something like “login.example.com”. Hostname aliases also allow 7171for administrators to set up load balancing for some sorts of services 7172based on rotating \sphinxcode{\sphinxupquote{CNAME}} records in DNS. 7173 7174 7175\section{Service principal canonicalization} 7176\label{\detokenize{admin/princ_dns:service-principal-canonicalization}} 7177\sphinxAtStartPar 7178In the MIT krb5 client library, canonicalization of host\sphinxhyphen{}based service 7179principals is controlled by the \sphinxstylestrong{dns\_canonicalize\_hostname}, 7180\sphinxstylestrong{rnds}, and \sphinxstylestrong{qualify\_shortname} variables in {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}}. 7181 7182\sphinxAtStartPar 7183If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{true}} (the default 7184value), the client performs forward resolution by looking up the IPv4 7185and/or IPv6 addresses of the hostname using \sphinxcode{\sphinxupquote{getaddrinfo()}}. This 7186process will typically add a domain suffix to the hostname if needed, 7187and follow CNAME records in the DNS. If \sphinxstylestrong{rdns} is also set to 7188\sphinxcode{\sphinxupquote{true}} (the default), the client will then perform a reverse lookup 7189of the first returned Internet address using \sphinxcode{\sphinxupquote{getnameinfo()}}, 7190finding the name associated with the PTR record. 7191 7192\sphinxAtStartPar 7193If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{false}}, the hostname is 7194not canonicalized using DNS. If the hostname has only one component 7195(i.e. it contains no “.” characters), the host’s primary DNS search 7196domain will be appended, if there is one. The \sphinxstylestrong{qualify\_shortname} 7197variable can be used to override or disable this suffix. 7198 7199\sphinxAtStartPar 7200If \sphinxstylestrong{dns\_canonicalize\_hostname} is set to \sphinxcode{\sphinxupquote{fallback}} (added in 7201release 1.18), the hostname is initially treated according to the 7202rules for \sphinxcode{\sphinxupquote{dns\_canonicalize\_hostname=false}}. If a ticket request 7203fails because the service principal is unknown, the hostname will be 7204canonicalized according to the rules for 7205\sphinxcode{\sphinxupquote{dns\_canonicalize\_hostname=true}} and the request will be retried. 7206 7207\sphinxAtStartPar 7208In all cases, the hostname is converted to lowercase, and any trailing 7209dot is removed. 7210 7211 7212\section{Reverse DNS mismatches} 7213\label{\detokenize{admin/princ_dns:reverse-dns-mismatches}} 7214\sphinxAtStartPar 7215Sometimes, an enterprise will have control over its forward DNS but 7216not its reverse DNS. The reverse DNS is sometimes under the control 7217of the Internet service provider of the enterprise, and the enterprise 7218may not have much influence in setting up reverse DNS records for its 7219address space. If there are difficulties with getting forward and 7220reverse DNS to match, it is best to set \sphinxcode{\sphinxupquote{rdns = false}} on client 7221machines. 7222 7223 7224\section{Overriding application behavior} 7225\label{\detokenize{admin/princ_dns:overriding-application-behavior}} 7226\sphinxAtStartPar 7227Applications can choose to use a default hostname component in their 7228service principal name when accepting authentication, which avoids 7229some sorts of hostname mismatches. Because not all relevant 7230applications do this yet, using the {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} setting: 7231 7232\begin{sphinxVerbatim}[commandchars=\\\{\}] 7233\PYG{p}{[}\PYG{n}{libdefaults}\PYG{p}{]} 7234 \PYG{n}{ignore\PYGZus{}acceptor\PYGZus{}hostname} \PYG{o}{=} \PYG{n}{true} 7235\end{sphinxVerbatim} 7236 7237\sphinxAtStartPar 7238will allow the Kerberos library to override the application’s choice 7239of service principal hostname and will allow a server program to 7240accept incoming authentications using any key in its keytab that 7241matches the service name and realm name (if given). This setting 7242defaults to “false” and is available in releases krb5\sphinxhyphen{}1.10 and later. 7243 7244 7245\section{Provisioning keytabs} 7246\label{\detokenize{admin/princ_dns:provisioning-keytabs}} 7247\sphinxAtStartPar 7248One service principal entry that should be in the keytab is a 7249principal whose hostname component is the canonical hostname that 7250\sphinxcode{\sphinxupquote{getaddrinfo()}} reports for all known aliases for the host. If the 7251reverse DNS information does not match this canonical hostname, an 7252additional service principal entry should be in the keytab for this 7253different hostname. 7254 7255 7256\section{Specific application advice} 7257\label{\detokenize{admin/princ_dns:specific-application-advice}} 7258 7259\subsection{Secure shell (ssh)} 7260\label{\detokenize{admin/princ_dns:secure-shell-ssh}} 7261\sphinxAtStartPar 7262Setting \sphinxcode{\sphinxupquote{GSSAPIStrictAcceptorCheck = no}} in the configuration file 7263of modern versions of the openssh daemon will allow the daemon to try 7264any key in its keytab when accepting a connection, rather than looking 7265for the keytab entry that matches the host’s own idea of its name 7266(typically the name that \sphinxcode{\sphinxupquote{gethostname()}} returns). This requires 7267krb5\sphinxhyphen{}1.10 or later. 7268 7269 7270\subsection{OpenLDAP (ldapsearch, etc.)} 7271\label{\detokenize{admin/princ_dns:openldap-ldapsearch-etc}} 7272\sphinxAtStartPar 7273OpenLDAP’s SASL implementation performs reverse DNS lookup in order to 7274canonicalize service principal names, even if \sphinxstylestrong{rdns} is set to 7275\sphinxcode{\sphinxupquote{false}} in the Kerberos configuration. To disable this behavior, 7276add \sphinxcode{\sphinxupquote{SASL\_NOCANON on}} to \sphinxcode{\sphinxupquote{ldap.conf}}, or set the 7277\sphinxcode{\sphinxupquote{LDAPSASL\_NOCANON}} environment variable. 7278 7279 7280\chapter{Encryption types} 7281\label{\detokenize{admin/enctypes:encryption-types}}\label{\detokenize{admin/enctypes:enctypes}}\label{\detokenize{admin/enctypes::doc}} 7282\sphinxAtStartPar 7283Kerberos can use a variety of cipher algorithms to protect data. A 7284Kerberos \sphinxstylestrong{encryption type} (also known as an \sphinxstylestrong{enctype}) is a 7285specific combination of a cipher algorithm with an integrity algorithm 7286to provide both confidentiality and integrity to data. 7287 7288 7289\section{Enctypes in requests} 7290\label{\detokenize{admin/enctypes:enctypes-in-requests}} 7291\sphinxAtStartPar 7292Clients make two types of requests (KDC\sphinxhyphen{}REQ) to the KDC: AS\sphinxhyphen{}REQs and 7293TGS\sphinxhyphen{}REQs. The client uses the AS\sphinxhyphen{}REQ to obtain initial tickets 7294(typically a Ticket\sphinxhyphen{}Granting Ticket (TGT)), and uses the TGS\sphinxhyphen{}REQ to 7295obtain service tickets. 7296 7297\sphinxAtStartPar 7298The KDC uses three different keys when issuing a ticket to a client: 7299\begin{itemize} 7300\item {} 7301\sphinxAtStartPar 7302The long\sphinxhyphen{}term key of the service: the KDC uses this to encrypt the 7303actual service ticket. The KDC only uses the first long\sphinxhyphen{}term key in 7304the most recent kvno for this purpose. 7305 7306\item {} 7307\sphinxAtStartPar 7308The session key: the KDC randomly chooses this key and places one 7309copy inside the ticket and the other copy inside the encrypted part 7310of the reply. 7311 7312\item {} 7313\sphinxAtStartPar 7314The reply\sphinxhyphen{}encrypting key: the KDC uses this to encrypt the reply it 7315sends to the client. For AS replies, this is a long\sphinxhyphen{}term key of the 7316client principal. For TGS replies, this is either the session key of the 7317authenticating ticket, or a subsession key. 7318 7319\end{itemize} 7320 7321\sphinxAtStartPar 7322Each of these keys is of a specific enctype. 7323 7324\sphinxAtStartPar 7325Each request type allows the client to submit a list of enctypes that 7326it is willing to accept. For the AS\sphinxhyphen{}REQ, this list affects both the 7327session key selection and the reply\sphinxhyphen{}encrypting key selection. For the 7328TGS\sphinxhyphen{}REQ, this list only affects the session key selection. 7329 7330 7331\section{Session key selection} 7332\label{\detokenize{admin/enctypes:session-key-selection}}\label{\detokenize{admin/enctypes:id1}} 7333\sphinxAtStartPar 7334The KDC chooses the session key enctype by taking the intersection of 7335its \sphinxstylestrong{permitted\_enctypes} list, the list of long\sphinxhyphen{}term keys for the 7336most recent kvno of the service, and the client’s requested list of 7337enctypes. Starting in krb5\sphinxhyphen{}1.21, all services are assumed to support 7338aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96; also, des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 and arcfour\sphinxhyphen{}hmac session 7339keys will not be issued by default. 7340 7341\sphinxAtStartPar 7342Starting in krb5\sphinxhyphen{}1.11, it is possible to set a string attribute on a 7343service principal to control what session key enctypes the KDC may 7344issue for service tickets for that principal, overriding the service’s 7345long\sphinxhyphen{}term keys and the assumption of aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 support. 7346See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:set-string}]{\sphinxcrossref{\DUrole{std,std-ref}{set\_string}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for details. 7347 7348 7349\section{Choosing enctypes for a service} 7350\label{\detokenize{admin/enctypes:choosing-enctypes-for-a-service}} 7351\sphinxAtStartPar 7352Generally, a service should have a key of the strongest 7353enctype that both it and the KDC support. If the KDC is running a 7354release earlier than krb5\sphinxhyphen{}1.11, it is also useful to generate an 7355additional key for each enctype that the service can support. The KDC 7356will only use the first key in the list of long\sphinxhyphen{}term keys for encrypting 7357the service ticket, but the additional long\sphinxhyphen{}term keys indicate the 7358other enctypes that the service supports. 7359 7360\sphinxAtStartPar 7361As noted above, starting with release krb5\sphinxhyphen{}1.11, there are additional 7362configuration settings that control session key enctype selection 7363independently of the set of long\sphinxhyphen{}term keys that the KDC has stored for 7364a service principal. 7365 7366 7367\section{Configuration variables} 7368\label{\detokenize{admin/enctypes:configuration-variables}} 7369\sphinxAtStartPar 7370The following \sphinxcode{\sphinxupquote{{[}libdefaults{]}}} settings in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} will 7371affect how enctypes are chosen. 7372\begin{description} 7373\item[{\sphinxstylestrong{allow\_weak\_crypto}}] \leavevmode 7374\sphinxAtStartPar 7375defaults to \sphinxstyleemphasis{false} starting with krb5\sphinxhyphen{}1.8. When \sphinxstyleemphasis{false}, removes 7376weak enctypes from \sphinxstylestrong{permitted\_enctypes}, 7377\sphinxstylestrong{default\_tkt\_enctypes}, and \sphinxstylestrong{default\_tgs\_enctypes}. Do not 7378set this to \sphinxstyleemphasis{true} unless the use of weak enctypes is an 7379acceptable risk for your environment and the weak enctypes are 7380required for backward compatibility. 7381 7382\item[{\sphinxstylestrong{allow\_des3}}] \leavevmode 7383\sphinxAtStartPar 7384was added in release 1.21 and defaults to \sphinxstyleemphasis{false}. Unless this 7385flag is set to \sphinxstyleemphasis{true}, the KDC will not issue tickets with 7386des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 session keys. In a future release, this flag will 7387control whether des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 is permitted in similar fashion to 7388weak enctypes. 7389 7390\item[{\sphinxstylestrong{allow\_rc4}}] \leavevmode 7391\sphinxAtStartPar 7392was added in release 1.21 and defaults to \sphinxstyleemphasis{false}. Unless this 7393flag is set to \sphinxstyleemphasis{true}, the KDC will not issue tickets with 7394arcfour\sphinxhyphen{}hmac session keys. In a future release, this flag will 7395control whether arcfour\sphinxhyphen{}hmac is permitted in similar fashion to 7396weak enctypes. 7397 7398\item[{\sphinxstylestrong{permitted\_enctypes}}] \leavevmode 7399\sphinxAtStartPar 7400controls the set of enctypes that a service will permit for 7401session keys and for ticket and authenticator encryption. The KDC 7402and other programs that access the Kerberos database will ignore 7403keys of non\sphinxhyphen{}permitted enctypes. Starting in release 1.18, this 7404setting also acts as the default for \sphinxstylestrong{default\_tkt\_enctypes} and 7405\sphinxstylestrong{default\_tgs\_enctypes}. 7406 7407\item[{\sphinxstylestrong{default\_tkt\_enctypes}}] \leavevmode 7408\sphinxAtStartPar 7409controls the default set of enctypes that the Kerberos client 7410library requests when making an AS\sphinxhyphen{}REQ. Do not set this unless 7411required for specific backward compatibility purposes; stale 7412values of this setting can prevent clients from taking advantage 7413of new stronger enctypes when the libraries are upgraded. 7414 7415\item[{\sphinxstylestrong{default\_tgs\_enctypes}}] \leavevmode 7416\sphinxAtStartPar 7417controls the default set of enctypes that the Kerberos client 7418library requests when making a TGS\sphinxhyphen{}REQ. Do not set this unless 7419required for specific backward compatibility purposes; stale 7420values of this setting can prevent clients from taking advantage 7421of new stronger enctypes when the libraries are upgraded. 7422 7423\end{description} 7424 7425\sphinxAtStartPar 7426The following per\sphinxhyphen{}realm setting in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} affects the 7427generation of long\sphinxhyphen{}term keys. 7428\begin{description} 7429\item[{\sphinxstylestrong{supported\_enctypes}}] \leavevmode 7430\sphinxAtStartPar 7431controls the default set of enctype\sphinxhyphen{}salttype pairs that {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} 7432will use for generating long\sphinxhyphen{}term keys, either randomly or from 7433passwords 7434 7435\end{description} 7436 7437 7438\section{Enctype compatibility} 7439\label{\detokenize{admin/enctypes:enctype-compatibility}} 7440\sphinxAtStartPar 7441See {\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} for additional information about enctypes. 7442 7443 7444\begin{savenotes}\sphinxattablestart 7445\centering 7446\begin{tabulary}{\linewidth}[t]{|T|T|T|T|} 7447\hline 7448\sphinxstyletheadfamily 7449\sphinxAtStartPar 7450enctype 7451&\sphinxstyletheadfamily 7452\sphinxAtStartPar 7453weak? 7454&\sphinxstyletheadfamily 7455\sphinxAtStartPar 7456krb5 7457&\sphinxstyletheadfamily 7458\sphinxAtStartPar 7459Windows 7460\\ 7461\hline 7462\sphinxAtStartPar 7463des\sphinxhyphen{}cbc\sphinxhyphen{}crc 7464& 7465\sphinxAtStartPar 7466weak 7467& 7468\sphinxAtStartPar 7469\textless{}1.18 7470& 7471\sphinxAtStartPar 7472\textgreater{}=2000 7473\\ 7474\hline 7475\sphinxAtStartPar 7476des\sphinxhyphen{}cbc\sphinxhyphen{}md4 7477& 7478\sphinxAtStartPar 7479weak 7480& 7481\sphinxAtStartPar 7482\textless{}1.18 7483& 7484\sphinxAtStartPar 7485? 7486\\ 7487\hline 7488\sphinxAtStartPar 7489des\sphinxhyphen{}cbc\sphinxhyphen{}md5 7490& 7491\sphinxAtStartPar 7492weak 7493& 7494\sphinxAtStartPar 7495\textless{}1.18 7496& 7497\sphinxAtStartPar 7498\textgreater{}=2000 7499\\ 7500\hline 7501\sphinxAtStartPar 7502des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 7503& 7504\sphinxAtStartPar 7505deprecated 7506& 7507\sphinxAtStartPar 7508\textgreater{}=1.1 7509& 7510\sphinxAtStartPar 7511none 7512\\ 7513\hline 7514\sphinxAtStartPar 7515arcfour\sphinxhyphen{}hmac 7516& 7517\sphinxAtStartPar 7518deprecated 7519& 7520\sphinxAtStartPar 7521\textgreater{}=1.3 7522& 7523\sphinxAtStartPar 7524\textgreater{}=2000 7525\\ 7526\hline 7527\sphinxAtStartPar 7528arcfour\sphinxhyphen{}hmac\sphinxhyphen{}exp 7529& 7530\sphinxAtStartPar 7531weak 7532& 7533\sphinxAtStartPar 7534\textgreater{}=1.3 7535& 7536\sphinxAtStartPar 7537\textgreater{}=2000 7538\\ 7539\hline 7540\sphinxAtStartPar 7541aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 7542&& 7543\sphinxAtStartPar 7544\textgreater{}=1.3 7545& 7546\sphinxAtStartPar 7547\textgreater{}=Vista 7548\\ 7549\hline 7550\sphinxAtStartPar 7551aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 7552&& 7553\sphinxAtStartPar 7554\textgreater{}=1.3 7555& 7556\sphinxAtStartPar 7557\textgreater{}=Vista 7558\\ 7559\hline 7560\sphinxAtStartPar 7561aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 7562&& 7563\sphinxAtStartPar 7564\textgreater{}=1.15 7565& 7566\sphinxAtStartPar 7567none 7568\\ 7569\hline 7570\sphinxAtStartPar 7571aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 7572&& 7573\sphinxAtStartPar 7574\textgreater{}=1.15 7575& 7576\sphinxAtStartPar 7577none 7578\\ 7579\hline 7580\sphinxAtStartPar 7581camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac 7582&& 7583\sphinxAtStartPar 7584\textgreater{}=1.9 7585& 7586\sphinxAtStartPar 7587none 7588\\ 7589\hline 7590\sphinxAtStartPar 7591camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac 7592&& 7593\sphinxAtStartPar 7594\textgreater{}=1.9 7595& 7596\sphinxAtStartPar 7597none 7598\\ 7599\hline 7600\end{tabulary} 7601\par 7602\sphinxattableend\end{savenotes} 7603 7604\sphinxAtStartPar 7605krb5 releases 1.18 and later do not support single\sphinxhyphen{}DES. krb5 releases 76061.8 and later disable the single\sphinxhyphen{}DES enctypes by default. Microsoft 7607Windows releases Windows 7 and later disable single\sphinxhyphen{}DES enctypes by 7608default. 7609 7610\sphinxAtStartPar 7611krb5 releases 1.17 and later flag deprecated encryption types 7612(including \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} and \sphinxcode{\sphinxupquote{arcfour\sphinxhyphen{}hmac}}) in KDC logs and 7613kadmin output. krb5 release 1.19 issues a warning during initial 7614authentication if \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} is used. Future releases will 7615disable \sphinxcode{\sphinxupquote{des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1}} by default and eventually remove support for 7616it. 7617 7618 7619\section{Migrating away from older encryption types} 7620\label{\detokenize{admin/enctypes:migrating-away-from-older-encryption-types}} 7621\sphinxAtStartPar 7622Administrator intervention may be required to migrate a realm away 7623from legacy encryption types, especially if the realm was created 7624using krb5 release 1.2 or earlier. This migration should be performed 7625before upgrading to krb5 versions which disable or remove support for 7626legacy encryption types. 7627 7628\sphinxAtStartPar 7629If there is a \sphinxstylestrong{supported\_enctypes} setting in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} on 7630the KDC, make sure that it does not include weak or deprecated 7631encryption types. This will ensure that newly created keys do not use 7632those encryption types by default. 7633 7634\sphinxAtStartPar 7635Check the \sphinxcode{\sphinxupquote{krbtgt/REALM}} principal using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} 7636\sphinxstylestrong{getprinc} command. If it lists a weak or deprecated encryption 7637type as the first key, it must be migrated using the procedure in 7638{\hyperref[\detokenize{admin/database:changing-krbtgt-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Changing the krbtgt key}}}}. 7639 7640\sphinxAtStartPar 7641Check the \sphinxcode{\sphinxupquote{kadmin/history}} principal, which should have only one key 7642entry. If it uses a weak or deprecated encryption type, it should be 7643upgraded following the notes in {\hyperref[\detokenize{admin/database:updating-history-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Updating the history key}}}}. 7644 7645\sphinxAtStartPar 7646Check the other kadmin principals: kadmin/changepw, kadmin/admin, and 7647any kadmin/hostname principals that may exist. These principals can 7648be upgraded with \sphinxstylestrong{change\_password \sphinxhyphen{}randkey} in kadmin. 7649 7650\sphinxAtStartPar 7651Check the \sphinxcode{\sphinxupquote{K/M}} entry. If it uses a weak or deprecated encryption 7652type, it should be upgraded following the procedure in 7653{\hyperref[\detokenize{admin/database:updating-master-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Updating the master key}}}}. 7654 7655\sphinxAtStartPar 7656User and service principals using legacy encryption types can be 7657enumerated with the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} \sphinxstylestrong{tabdump keyinfo} command. 7658 7659\sphinxAtStartPar 7660Service principals can be migrated with a keytab rotation on the 7661service host, which can be accomplished using the {\hyperref[\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{k5srvutil}}}} 7662\sphinxstylestrong{change} and \sphinxstylestrong{delold} commands. Allow enough time for existing 7663tickets to expire between the change and delold operations. 7664 7665\sphinxAtStartPar 7666User principals with password\sphinxhyphen{}based keys can be migrated with a 7667password change. The realm administrator can set a password 7668expiration date using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{modify\_principal 7669\sphinxhyphen{}pwexpire} command to force a password change. 7670 7671\sphinxAtStartPar 7672If a legacy encryption type has not yet been disabled by default in 7673the version of krb5 running on the KDC, it can be disabled 7674administratively with the \sphinxstylestrong{permitted\_enctypes} variable. For 7675example, setting \sphinxstylestrong{permitted\_enctypes} to \sphinxcode{\sphinxupquote{DEFAULT \sphinxhyphen{}des3 \sphinxhyphen{}rc4}} will 7676cause any database keys of the triple\sphinxhyphen{}DES and RC4 encryption types to 7677be ignored. 7678 7679 7680\chapter{HTTPS proxy configuration} 7681\label{\detokenize{admin/https:https-proxy-configuration}}\label{\detokenize{admin/https:https}}\label{\detokenize{admin/https::doc}} 7682\sphinxAtStartPar 7683In addition to being able to use UDP or TCP to communicate directly 7684with a KDC as is outlined in RFC4120, and with kpasswd services in a 7685similar fashion, the client libraries can attempt to use an HTTPS 7686proxy server to communicate with a KDC or kpasswd service, using the 7687protocol outlined in {[}MS\sphinxhyphen{}KKDCP{]}. 7688 7689\sphinxAtStartPar 7690Communicating with a KDC through an HTTPS proxy allows clients to 7691contact servers when network firewalls might otherwise prevent them 7692from doing so. The use of TLS also encrypts all traffic between the 7693clients and the KDC, preventing observers from conducting password 7694dictionary attacks or from observing the client and server principals 7695being authenticated, at additional computational cost to both clients 7696and servers. 7697 7698\sphinxAtStartPar 7699An HTTPS proxy server is provided as a feature in some versions of 7700Microsoft Windows Server, and a WSGI implementation named \sphinxtitleref{kdcproxy} 7701is available in the python package index. 7702 7703 7704\section{Configuring the clients} 7705\label{\detokenize{admin/https:configuring-the-clients}} 7706\sphinxAtStartPar 7707To use an HTTPS proxy, a client host must trust the CA which issued 7708that proxy’s SSL certificate. If that CA’s certificate is not in the 7709system\sphinxhyphen{}wide default set of trusted certificates, configure the 7710following relation in the client host’s {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in 7711the appropriate {\hyperref[\detokenize{admin/conf_files/krb5_conf:realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection: 7712 7713\begin{sphinxVerbatim}[commandchars=\\\{\}] 7714\PYG{n}{http\PYGZus{}anchors} \PYG{o}{=} \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{cacert}\PYG{o}{.}\PYG{n}{pem} 7715\end{sphinxVerbatim} 7716 7717\sphinxAtStartPar 7718Adjust the pathname to match the path of the file which contains a 7719copy of the CA’s certificate. The \sphinxtitleref{http\_anchors} option is documented 7720more fully in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. 7721 7722\sphinxAtStartPar 7723Configure the client to access the KDC and kpasswd service by 7724specifying their locations in its {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} file in the form 7725of HTTPS URLs for the proxy server: 7726 7727\begin{sphinxVerbatim}[commandchars=\\\{\}] 7728\PYG{n}{kdc} \PYG{o}{=} \PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{server}\PYG{o}{.}\PYG{n}{fqdn}\PYG{o}{/}\PYG{n}{KdcProxy} 7729\PYG{n}{kpasswd\PYGZus{}server} \PYG{o}{=} \PYG{n}{https}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{server}\PYG{o}{.}\PYG{n}{fqdn}\PYG{o}{/}\PYG{n}{KdcProxy} 7730\end{sphinxVerbatim} 7731 7732\sphinxAtStartPar 7733If the proxy and client are properly configured, client commands such 7734as \sphinxcode{\sphinxupquote{kinit}}, \sphinxcode{\sphinxupquote{kvno}}, and \sphinxcode{\sphinxupquote{kpasswd}} should all function normally. 7735 7736 7737\chapter{Authentication indicators} 7738\label{\detokenize{admin/auth_indicator:authentication-indicators}}\label{\detokenize{admin/auth_indicator:auth-indicator}}\label{\detokenize{admin/auth_indicator::doc}} 7739\sphinxAtStartPar 7740As of release 1.14, the KDC can be configured to annotate tickets if 7741the client authenticated using a stronger preauthentication mechanism 7742such as {\hyperref[\detokenize{admin/pkinit:pkinit}]{\sphinxcrossref{\DUrole{std,std-ref}{PKINIT}}}} or {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP}}}}. These 7743annotations are called “authentication indicators.” Service 7744principals can be configured to require particular authentication 7745indicators in order to authenticate to that service. An 7746authentication indicator value can be any string chosen by the KDC 7747administrator; there are no pre\sphinxhyphen{}set values. 7748 7749\sphinxAtStartPar 7750To use authentication indicators with PKINIT or OTP, first configure 7751the KDC to include an indicator when that preauthentication mechanism 7752is used. For PKINIT, use the \sphinxstylestrong{pkinit\_indicator} variable in 7753{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. For OTP, use the \sphinxstylestrong{indicator} variable in the 7754token type definition, or specify the indicators in the \sphinxstylestrong{otp} user 7755string as described in {\hyperref[\detokenize{admin/otp:otp-preauth}]{\sphinxcrossref{\DUrole{std,std-ref}{OTP Preauthentication}}}}. 7756 7757\sphinxAtStartPar 7758To require an indicator to be present in order to authenticate to a 7759service principal, set the \sphinxstylestrong{require\_auth} string attribute on the 7760principal to the indicator value to be required. If you wish to allow 7761one of several indicators to be accepted, you can specify multiple 7762indicator values separated by spaces. 7763 7764\sphinxAtStartPar 7765For example, a realm could be configured to set the authentication 7766indicator value “strong” when PKINIT is used to authenticate, using a 7767setting in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-realms}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}realms{]}}}}} subsection: 7768 7769\begin{sphinxVerbatim}[commandchars=\\\{\}] 7770\PYG{n}{pkinit\PYGZus{}indicator} \PYG{o}{=} \PYG{n}{strong} 7771\end{sphinxVerbatim} 7772 7773\sphinxAtStartPar 7774A service principal could be configured to require the “strong” 7775authentication indicator value: 7776 7777\begin{sphinxVerbatim}[commandchars=\\\{\}] 7778\PYGZdl{} kadmin setstr host/high.value.server require\PYGZus{}auth strong 7779Password for user/admin@KRBTEST.COM: 7780\end{sphinxVerbatim} 7781 7782\sphinxAtStartPar 7783A user who authenticates with PKINIT would be able to obtain a ticket 7784for the service principal: 7785 7786\begin{sphinxVerbatim}[commandchars=\\\{\}] 7787\PYGZdl{} kinit \PYGZhy{}X X509\PYGZus{}user\PYGZus{}identity=FILE:/my/cert.pem,/my/key.pem user 7788\PYGZdl{} kvno host/high.value.server 7789host/high.value.server@KRBTEST.COM: kvno = 1 7790\end{sphinxVerbatim} 7791 7792\sphinxAtStartPar 7793but a user who authenticates with a password would not: 7794 7795\begin{sphinxVerbatim}[commandchars=\\\{\}] 7796\PYGZdl{} kinit user 7797Password for user@KRBTEST.COM: 7798\PYGZdl{} kvno host/high.value.server 7799kvno: KDC policy rejects request while getting credentials for 7800 host/high.value.server@KRBTEST.COM 7801\end{sphinxVerbatim} 7802 7803\sphinxAtStartPar 7804GSSAPI server applications can inspect authentication indicators 7805through the \DUrole{xref,std,std-ref}{auth\sphinxhyphen{}indicators} name 7806attribute. 7807 7808 7809\chapter{Administration programs} 7810\label{\detokenize{admin/admin_commands/index:administration-programs}}\label{\detokenize{admin/admin_commands/index::doc}} 7811 7812\section{kadmin} 7813\label{\detokenize{admin/admin_commands/kadmin_local:kadmin}}\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-1}}\label{\detokenize{admin/admin_commands/kadmin_local::doc}} 7814 7815\subsection{SYNOPSIS} 7816\label{\detokenize{admin/admin_commands/kadmin_local:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-synopsis}} 7817\sphinxAtStartPar 7818\sphinxstylestrong{kadmin} 7819{[}\sphinxstylestrong{\sphinxhyphen{}O}|\sphinxstylestrong{\sphinxhyphen{}N}{]} 7820{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 7821{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}{]} 7822{[}\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}{]} 7823{[}{[}\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{cache\_name}{]}|{[}\sphinxstylestrong{\sphinxhyphen{}k} {[}\sphinxstylestrong{\sphinxhyphen{}t} \sphinxstyleemphasis{keytab}{]}{]}|\sphinxstylestrong{\sphinxhyphen{}n}{]} 7824{[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{password}{]} 7825{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{admin\_server}{[}:\sphinxstyleemphasis{port}{]}{]} 7826{[}command args…{]} 7827 7828\sphinxAtStartPar 7829\sphinxstylestrong{kadmin.local} 7830{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 7831{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}{]} 7832{[}\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}{]} 7833{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} 7834{[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt} …{]} 7835{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} 7836{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} 7837{[}command args…{]} 7838 7839 7840\subsection{DESCRIPTION} 7841\label{\detokenize{admin/admin_commands/kadmin_local:description}} 7842\sphinxAtStartPar 7843kadmin and kadmin.local are command\sphinxhyphen{}line interfaces to the Kerberos V5 7844administration system. They provide nearly identical functionalities; 7845the difference is that kadmin.local directly accesses the KDC 7846database, while kadmin performs operations using {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}. 7847Except as explicitly noted otherwise, this man page will use “kadmin” 7848to refer to both versions. kadmin provides for the maintenance of 7849Kerberos principals, password policies, and service key tables 7850(keytabs). 7851 7852\sphinxAtStartPar 7853The remote kadmin client uses Kerberos to authenticate to kadmind 7854using the service principal \sphinxcode{\sphinxupquote{kadmin/admin}} or \sphinxcode{\sphinxupquote{kadmin/ADMINHOST}} 7855(where \sphinxstyleemphasis{ADMINHOST} is the fully\sphinxhyphen{}qualified hostname of the admin 7856server). If the credentials cache contains a ticket for one of these 7857principals, and the \sphinxstylestrong{\sphinxhyphen{}c} credentials\_cache option is specified, that 7858ticket is used to authenticate to kadmind. Otherwise, the \sphinxstylestrong{\sphinxhyphen{}p} and 7859\sphinxstylestrong{\sphinxhyphen{}k} options are used to specify the client Kerberos principal name 7860used to authenticate. Once kadmin has determined the principal name, 7861it requests a service ticket from the KDC, and uses that service 7862ticket to authenticate to kadmind. 7863 7864\sphinxAtStartPar 7865Since kadmin.local directly accesses the KDC database, it usually must 7866be run directly on the primary KDC with sufficient permissions to read 7867the KDC database. If the KDC database uses the LDAP database module, 7868kadmin.local can be run on any host which can access the LDAP server. 7869 7870 7871\subsection{OPTIONS} 7872\label{\detokenize{admin/admin_commands/kadmin_local:options}}\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:kadmin-options}}\begin{description} 7873\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 7874\sphinxAtStartPar 7875Use \sphinxstyleemphasis{realm} as the default database realm. 7876 7877\item[{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal}}] \leavevmode 7878\sphinxAtStartPar 7879Use \sphinxstyleemphasis{principal} to authenticate. Otherwise, kadmin will append 7880\sphinxcode{\sphinxupquote{/admin}} to the primary principal name of the default ccache, 7881the value of the \sphinxstylestrong{USER} environment variable, or the username as 7882obtained with getpwuid, in order of preference. 7883 7884\item[{\sphinxstylestrong{\sphinxhyphen{}k}}] \leavevmode 7885\sphinxAtStartPar 7886Use a keytab to decrypt the KDC response instead of prompting for 7887a password. In this case, the default principal will be 7888\sphinxcode{\sphinxupquote{host/hostname}}. If there is no keytab specified with the 7889\sphinxstylestrong{\sphinxhyphen{}t} option, then the default keytab will be used. 7890 7891\item[{\sphinxstylestrong{\sphinxhyphen{}t} \sphinxstyleemphasis{keytab}}] \leavevmode 7892\sphinxAtStartPar 7893Use \sphinxstyleemphasis{keytab} to decrypt the KDC response. This can only be used 7894with the \sphinxstylestrong{\sphinxhyphen{}k} option. 7895 7896\item[{\sphinxstylestrong{\sphinxhyphen{}n}}] \leavevmode 7897\sphinxAtStartPar 7898Requests anonymous processing. Two types of anonymous principals 7899are supported. For fully anonymous Kerberos, configure PKINIT on 7900the KDC and configure \sphinxstylestrong{pkinit\_anchors} in the client’s 7901{\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. Then use the \sphinxstylestrong{\sphinxhyphen{}n} option with a principal 7902of the form \sphinxcode{\sphinxupquote{@REALM}} (an empty principal name followed by the 7903at\sphinxhyphen{}sign and a realm name). If permitted by the KDC, an anonymous 7904ticket will be returned. A second form of anonymous tickets is 7905supported; these realm\sphinxhyphen{}exposed tickets hide the identity of the 7906client but not the client’s realm. For this mode, use \sphinxcode{\sphinxupquote{kinit 7907\sphinxhyphen{}n}} with a normal principal name. If supported by the KDC, the 7908principal (but not realm) will be replaced by the anonymous 7909principal. As of release 1.8, the MIT Kerberos KDC only supports 7910fully anonymous operation. 7911 7912\item[{\sphinxstylestrong{\sphinxhyphen{}c} \sphinxstyleemphasis{credentials\_cache}}] \leavevmode 7913\sphinxAtStartPar 7914Use \sphinxstyleemphasis{credentials\_cache} as the credentials cache. The cache 7915should contain a service ticket for the \sphinxcode{\sphinxupquote{kadmin/admin}} or 7916\sphinxcode{\sphinxupquote{kadmin/ADMINHOST}} (where \sphinxstyleemphasis{ADMINHOST} is the fully\sphinxhyphen{}qualified 7917hostname of the admin server) service; it can be acquired with the 7918\DUrole{xref,std,std-ref}{kinit(1)} program. If this option is not specified, kadmin 7919requests a new service ticket from the KDC, and stores it in its 7920own temporary ccache. 7921 7922\item[{\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{password}}] \leavevmode 7923\sphinxAtStartPar 7924Use \sphinxstyleemphasis{password} instead of prompting for one. Use this option with 7925care, as it may expose the password to other users on the system 7926via the process list. 7927 7928\item[{\sphinxstylestrong{\sphinxhyphen{}q} \sphinxstyleemphasis{query}}] \leavevmode 7929\sphinxAtStartPar 7930Perform the specified query and then exit. 7931 7932\item[{\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}}] \leavevmode 7933\sphinxAtStartPar 7934Specifies the name of the KDC database. This option does not 7935apply to the LDAP database module. 7936 7937\item[{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{admin\_server}{[}:\sphinxstyleemphasis{port}{]}}] \leavevmode 7938\sphinxAtStartPar 7939Specifies the admin server which kadmin should contact. 7940 7941\item[{\sphinxstylestrong{\sphinxhyphen{}m}}] \leavevmode 7942\sphinxAtStartPar 7943If using kadmin.local, prompt for the database master password 7944instead of reading it from a stash file. 7945 7946\item[{\sphinxstylestrong{\sphinxhyphen{}e} “\sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt} …”}] \leavevmode 7947\sphinxAtStartPar 7948Sets the keysalt list to be used for any new keys created. See 7949{\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of possible 7950values. 7951 7952\item[{\sphinxstylestrong{\sphinxhyphen{}O}}] \leavevmode 7953\sphinxAtStartPar 7954Force use of old AUTH\_GSSAPI authentication flavor. 7955 7956\item[{\sphinxstylestrong{\sphinxhyphen{}N}}] \leavevmode 7957\sphinxAtStartPar 7958Prevent fallback to AUTH\_GSSAPI authentication flavor. 7959 7960\item[{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}}] \leavevmode 7961\sphinxAtStartPar 7962Specifies the database specific arguments. See the next section 7963for supported options. 7964 7965\end{description} 7966 7967\sphinxAtStartPar 7968Starting with release 1.14, if any command\sphinxhyphen{}line arguments remain after 7969the options, they will be treated as a single query to be executed. 7970This mode of operation is intended for scripts and behaves differently 7971from the interactive mode in several respects: 7972\begin{itemize} 7973\item {} 7974\sphinxAtStartPar 7975Query arguments are split by the shell, not by kadmin. 7976 7977\item {} 7978\sphinxAtStartPar 7979Informational and warning messages are suppressed. Error messages 7980and query output (e.g. for \sphinxstylestrong{get\_principal}) will still be 7981displayed. 7982 7983\item {} 7984\sphinxAtStartPar 7985Confirmation prompts are disabled (as if \sphinxstylestrong{\sphinxhyphen{}force} was given). 7986Password prompts will still be issued as required. 7987 7988\item {} 7989\sphinxAtStartPar 7990The exit status will be non\sphinxhyphen{}zero if the query fails. 7991 7992\end{itemize} 7993 7994\sphinxAtStartPar 7995The \sphinxstylestrong{\sphinxhyphen{}q} option does not carry these behavior differences; the query 7996will be processed as if it was entered interactively. The \sphinxstylestrong{\sphinxhyphen{}q} 7997option cannot be used in combination with a query in the remaining 7998arguments. 7999 8000 8001\subsection{DATABASE OPTIONS} 8002\label{\detokenize{admin/admin_commands/kadmin_local:database-options}}\label{\detokenize{admin/admin_commands/kadmin_local:dboptions}} 8003\sphinxAtStartPar 8004Database options can be used to override database\sphinxhyphen{}specific defaults. 8005Supported options for the DB2 module are: 8006\begin{quote} 8007\begin{description} 8008\item[{\sphinxstylestrong{\sphinxhyphen{}x dbname=}*filename*}] \leavevmode 8009\sphinxAtStartPar 8010Specifies the base filename of the DB2 database. 8011 8012\item[{\sphinxstylestrong{\sphinxhyphen{}x lockiter}}] \leavevmode 8013\sphinxAtStartPar 8014Make iteration operations hold the lock for the duration of 8015the entire operation, rather than temporarily releasing the 8016lock while handling each principal. This is the default 8017behavior, but this option exists to allow command line 8018override of a {[}dbmodules{]} setting. First introduced in 8019release 1.13. 8020 8021\item[{\sphinxstylestrong{\sphinxhyphen{}x unlockiter}}] \leavevmode 8022\sphinxAtStartPar 8023Make iteration operations unlock the database for each 8024principal, instead of holding the lock for the duration of the 8025entire operation. First introduced in release 1.13. 8026 8027\end{description} 8028\end{quote} 8029 8030\sphinxAtStartPar 8031Supported options for the LDAP module are: 8032\begin{quote} 8033\begin{description} 8034\item[{\sphinxstylestrong{\sphinxhyphen{}x host=}\sphinxstyleemphasis{ldapuri}}] \leavevmode 8035\sphinxAtStartPar 8036Specifies the LDAP server to connect to by a LDAP URI. 8037 8038\item[{\sphinxstylestrong{\sphinxhyphen{}x binddn=}\sphinxstyleemphasis{bind\_dn}}] \leavevmode 8039\sphinxAtStartPar 8040Specifies the DN used to bind to the LDAP server. 8041 8042\item[{\sphinxstylestrong{\sphinxhyphen{}x bindpwd=}\sphinxstyleemphasis{password}}] \leavevmode 8043\sphinxAtStartPar 8044Specifies the password or SASL secret used to bind to the LDAP 8045server. Using this option may expose the password to other 8046users on the system via the process list; to avoid this, 8047instead stash the password using the \sphinxstylestrong{stashsrvpw} command of 8048{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}. 8049 8050\item[{\sphinxstylestrong{\sphinxhyphen{}x sasl\_mech=}\sphinxstyleemphasis{mechanism}}] \leavevmode 8051\sphinxAtStartPar 8052Specifies the SASL mechanism used to bind to the LDAP server. 8053The bind DN is ignored if a SASL mechanism is used. New in 8054release 1.13. 8055 8056\item[{\sphinxstylestrong{\sphinxhyphen{}x sasl\_authcid=}\sphinxstyleemphasis{name}}] \leavevmode 8057\sphinxAtStartPar 8058Specifies the authentication name used when binding to the 8059LDAP server with a SASL mechanism, if the mechanism requires 8060one. New in release 1.13. 8061 8062\item[{\sphinxstylestrong{\sphinxhyphen{}x sasl\_authzid=}\sphinxstyleemphasis{name}}] \leavevmode 8063\sphinxAtStartPar 8064Specifies the authorization name used when binding to the LDAP 8065server with a SASL mechanism. New in release 1.13. 8066 8067\item[{\sphinxstylestrong{\sphinxhyphen{}x sasl\_realm=}\sphinxstyleemphasis{realm}}] \leavevmode 8068\sphinxAtStartPar 8069Specifies the realm used when binding to the LDAP server with 8070a SASL mechanism, if the mechanism uses one. New in release 80711.13. 8072 8073\item[{\sphinxstylestrong{\sphinxhyphen{}x debug=}\sphinxstyleemphasis{level}}] \leavevmode 8074\sphinxAtStartPar 8075sets the OpenLDAP client library debug level. \sphinxstyleemphasis{level} is an 8076integer to be interpreted by the library. Debugging messages 8077are printed to standard error. New in release 1.12. 8078 8079\end{description} 8080\end{quote} 8081 8082 8083\subsection{COMMANDS} 8084\label{\detokenize{admin/admin_commands/kadmin_local:commands}} 8085\sphinxAtStartPar 8086When using the remote client, available commands may be restricted 8087according to the privileges specified in the {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} file 8088on the admin server. 8089 8090 8091\subsubsection{add\_principal} 8092\label{\detokenize{admin/admin_commands/kadmin_local:add-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id1}}\begin{quote} 8093 8094\sphinxAtStartPar 8095\sphinxstylestrong{add\_principal} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{newprinc} 8096\end{quote} 8097 8098\sphinxAtStartPar 8099Creates the principal \sphinxstyleemphasis{newprinc}, prompting twice for a password. If 8100no password policy is specified with the \sphinxstylestrong{\sphinxhyphen{}policy} option, and the 8101policy named \sphinxcode{\sphinxupquote{default}} is assigned to the principal if it exists. 8102However, creating a policy named \sphinxcode{\sphinxupquote{default}} will not automatically 8103assign this policy to previously existing principals. This policy 8104assignment can be suppressed with the \sphinxstylestrong{\sphinxhyphen{}clearpolicy} option. 8105 8106\sphinxAtStartPar 8107This command requires the \sphinxstylestrong{add} privilege. 8108 8109\sphinxAtStartPar 8110Aliases: \sphinxstylestrong{addprinc}, \sphinxstylestrong{ank} 8111 8112\sphinxAtStartPar 8113Options: 8114\begin{description} 8115\item[{\sphinxstylestrong{\sphinxhyphen{}expire} \sphinxstyleemphasis{expdate}}] \leavevmode 8116\sphinxAtStartPar 8117(\DUrole{xref,std,std-ref}{getdate} string) The expiration date of the principal. 8118 8119\item[{\sphinxstylestrong{\sphinxhyphen{}pwexpire} \sphinxstyleemphasis{pwexpdate}}] \leavevmode 8120\sphinxAtStartPar 8121(\DUrole{xref,std,std-ref}{getdate} string) The password expiration date. 8122 8123\item[{\sphinxstylestrong{\sphinxhyphen{}maxlife} \sphinxstyleemphasis{maxlife}}] \leavevmode 8124\sphinxAtStartPar 8125(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) The maximum ticket life 8126for the principal. 8127 8128\item[{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{maxrenewlife}}] \leavevmode 8129\sphinxAtStartPar 8130(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) The maximum renewable 8131life of tickets for the principal. 8132 8133\item[{\sphinxstylestrong{\sphinxhyphen{}kvno} \sphinxstyleemphasis{kvno}}] \leavevmode 8134\sphinxAtStartPar 8135The initial key version number. 8136 8137\item[{\sphinxstylestrong{\sphinxhyphen{}policy} \sphinxstyleemphasis{policy}}] \leavevmode 8138\sphinxAtStartPar 8139The password policy used by this principal. If not specified, the 8140policy \sphinxcode{\sphinxupquote{default}} is used if it exists (unless \sphinxstylestrong{\sphinxhyphen{}clearpolicy} 8141is specified). 8142 8143\item[{\sphinxstylestrong{\sphinxhyphen{}clearpolicy}}] \leavevmode 8144\sphinxAtStartPar 8145Prevents any policy from being assigned when \sphinxstylestrong{\sphinxhyphen{}policy} is not 8146specified. 8147 8148\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_postdated}}] \leavevmode 8149\sphinxAtStartPar 8150\sphinxstylestrong{\sphinxhyphen{}allow\_postdated} prohibits this principal from obtaining 8151postdated tickets. \sphinxstylestrong{+allow\_postdated} clears this flag. 8152 8153\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_forwardable}}] \leavevmode 8154\sphinxAtStartPar 8155\sphinxstylestrong{\sphinxhyphen{}allow\_forwardable} prohibits this principal from obtaining 8156forwardable tickets. \sphinxstylestrong{+allow\_forwardable} clears this flag. 8157 8158\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_renewable}}] \leavevmode 8159\sphinxAtStartPar 8160\sphinxstylestrong{\sphinxhyphen{}allow\_renewable} prohibits this principal from obtaining 8161renewable tickets. \sphinxstylestrong{+allow\_renewable} clears this flag. 8162 8163\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_proxiable}}] \leavevmode 8164\sphinxAtStartPar 8165\sphinxstylestrong{\sphinxhyphen{}allow\_proxiable} prohibits this principal from obtaining 8166proxiable tickets. \sphinxstylestrong{+allow\_proxiable} clears this flag. 8167 8168\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_dup\_skey}}] \leavevmode 8169\sphinxAtStartPar 8170\sphinxstylestrong{\sphinxhyphen{}allow\_dup\_skey} disables user\sphinxhyphen{}to\sphinxhyphen{}user authentication for this 8171principal by prohibiting others from obtaining a service ticket 8172encrypted in this principal’s TGT session key. 8173\sphinxstylestrong{+allow\_dup\_skey} clears this flag. 8174 8175\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{requires\_preauth}}] \leavevmode 8176\sphinxAtStartPar 8177\sphinxstylestrong{+requires\_preauth} requires this principal to preauthenticate 8178before being allowed to kinit. \sphinxstylestrong{\sphinxhyphen{}requires\_preauth} clears this 8179flag. When \sphinxstylestrong{+requires\_preauth} is set on a service principal, 8180the KDC will only issue service tickets for that service principal 8181if the client’s initial authentication was performed using 8182preauthentication. 8183 8184\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{requires\_hwauth}}] \leavevmode 8185\sphinxAtStartPar 8186\sphinxstylestrong{+requires\_hwauth} requires this principal to preauthenticate 8187using a hardware device before being allowed to kinit. 8188\sphinxstylestrong{\sphinxhyphen{}requires\_hwauth} clears this flag. When \sphinxstylestrong{+requires\_hwauth} is 8189set on a service principal, the KDC will only issue service tickets 8190for that service principal if the client’s initial authentication was 8191performed using a hardware device to preauthenticate. 8192 8193\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{ok\_as\_delegate}}] \leavevmode 8194\sphinxAtStartPar 8195\sphinxstylestrong{+ok\_as\_delegate} sets the \sphinxstylestrong{okay as delegate} flag on tickets 8196issued with this principal as the service. Clients may use this 8197flag as a hint that credentials should be delegated when 8198authenticating to the service. \sphinxstylestrong{\sphinxhyphen{}ok\_as\_delegate} clears this 8199flag. 8200 8201\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_svr}}] \leavevmode 8202\sphinxAtStartPar 8203\sphinxstylestrong{\sphinxhyphen{}allow\_svr} prohibits the issuance of service tickets for this 8204principal. In release 1.17 and later, user\sphinxhyphen{}to\sphinxhyphen{}user service 8205tickets are still allowed unless the \sphinxstylestrong{\sphinxhyphen{}allow\_dup\_skey} flag is 8206also set. \sphinxstylestrong{+allow\_svr} clears this flag. 8207 8208\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_tgs\_req}}] \leavevmode 8209\sphinxAtStartPar 8210\sphinxstylestrong{\sphinxhyphen{}allow\_tgs\_req} specifies that a Ticket\sphinxhyphen{}Granting Service (TGS) 8211request for a service ticket for this principal is not permitted. 8212\sphinxstylestrong{+allow\_tgs\_req} clears this flag. 8213 8214\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{allow\_tix}}] \leavevmode 8215\sphinxAtStartPar 8216\sphinxstylestrong{\sphinxhyphen{}allow\_tix} forbids the issuance of any tickets for this 8217principal. \sphinxstylestrong{+allow\_tix} clears this flag. 8218 8219\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{needchange}}] \leavevmode 8220\sphinxAtStartPar 8221\sphinxstylestrong{+needchange} forces a password change on the next initial 8222authentication to this principal. \sphinxstylestrong{\sphinxhyphen{}needchange} clears this 8223flag. 8224 8225\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{password\_changing\_service}}] \leavevmode 8226\sphinxAtStartPar 8227\sphinxstylestrong{+password\_changing\_service} marks this principal as a password 8228change service principal. 8229 8230\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{ok\_to\_auth\_as\_delegate}}] \leavevmode 8231\sphinxAtStartPar 8232\sphinxstylestrong{+ok\_to\_auth\_as\_delegate} allows this principal to acquire 8233forwardable tickets to itself from arbitrary users, for use with 8234constrained delegation. 8235 8236\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{no\_auth\_data\_required}}] \leavevmode 8237\sphinxAtStartPar 8238\sphinxstylestrong{+no\_auth\_data\_required} prevents PAC or AD\sphinxhyphen{}SIGNEDPATH data from 8239being added to service tickets for the principal. 8240 8241\item[{\{\sphinxhyphen{}|+\}\sphinxstylestrong{lockdown\_keys}}] \leavevmode 8242\sphinxAtStartPar 8243\sphinxstylestrong{+lockdown\_keys} prevents keys for this principal from leaving 8244the KDC via kadmind. The chpass and extract operations are denied 8245for a principal with this attribute. The chrand operation is 8246allowed, but will not return the new keys. The delete and rename 8247operations are also denied if this attribute is set, in order to 8248prevent a malicious administrator from replacing principals like 8249krbtgt/* or kadmin/* with new principals without the attribute. 8250This attribute can be set via the network protocol, but can only 8251be removed using kadmin.local. 8252 8253\item[{\sphinxstylestrong{\sphinxhyphen{}randkey}}] \leavevmode 8254\sphinxAtStartPar 8255Sets the key of the principal to a random value. 8256 8257\item[{\sphinxstylestrong{\sphinxhyphen{}nokey}}] \leavevmode 8258\sphinxAtStartPar 8259Causes the principal to be created with no key. New in release 82601.12. 8261 8262\item[{\sphinxstylestrong{\sphinxhyphen{}pw} \sphinxstyleemphasis{password}}] \leavevmode 8263\sphinxAtStartPar 8264Sets the password of the principal to the specified string and 8265does not prompt for a password. Note: using this option in a 8266shell script may expose the password to other users on the system 8267via the process list. 8268 8269\item[{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…}] \leavevmode 8270\sphinxAtStartPar 8271Uses the specified keysalt list for setting the keys of the 8272principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a 8273list of possible values. 8274 8275\item[{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_princ\_args}}] \leavevmode 8276\sphinxAtStartPar 8277Indicates database\sphinxhyphen{}specific options. The options for the LDAP 8278database module are: 8279\begin{description} 8280\item[{\sphinxstylestrong{\sphinxhyphen{}x dn=}\sphinxstyleemphasis{dn}}] \leavevmode 8281\sphinxAtStartPar 8282Specifies the LDAP object that will contain the Kerberos 8283principal being created. 8284 8285\item[{\sphinxstylestrong{\sphinxhyphen{}x linkdn=}\sphinxstyleemphasis{dn}}] \leavevmode 8286\sphinxAtStartPar 8287Specifies the LDAP object to which the newly created Kerberos 8288principal object will point. 8289 8290\item[{\sphinxstylestrong{\sphinxhyphen{}x containerdn=}\sphinxstyleemphasis{container\_dn}}] \leavevmode 8291\sphinxAtStartPar 8292Specifies the container object under which the Kerberos 8293principal is to be created. 8294 8295\item[{\sphinxstylestrong{\sphinxhyphen{}x tktpolicy=}\sphinxstyleemphasis{policy}}] \leavevmode 8296\sphinxAtStartPar 8297Associates a ticket policy to the Kerberos principal. 8298 8299\end{description} 8300 8301\begin{sphinxadmonition}{note}{Note:}\begin{itemize} 8302\item {} 8303\sphinxAtStartPar 8304The \sphinxstylestrong{containerdn} and \sphinxstylestrong{linkdn} options cannot be 8305specified with the \sphinxstylestrong{dn} option. 8306 8307\item {} 8308\sphinxAtStartPar 8309If the \sphinxstyleemphasis{dn} or \sphinxstyleemphasis{containerdn} options are not specified while 8310adding the principal, the principals are created under the 8311principal container configured in the realm or the realm 8312container. 8313 8314\item {} 8315\sphinxAtStartPar 8316\sphinxstyleemphasis{dn} and \sphinxstyleemphasis{containerdn} should be within the subtrees or 8317principal container configured in the realm. 8318 8319\end{itemize} 8320\end{sphinxadmonition} 8321 8322\end{description} 8323 8324\sphinxAtStartPar 8325Example: 8326 8327\begin{sphinxVerbatim}[commandchars=\\\{\}] 8328\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{addprinc} \PYG{n}{jennifer} 8329\PYG{n}{No} \PYG{n}{policy} \PYG{n}{specified} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{jennifer@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{;} 8330\PYG{n}{defaulting} \PYG{n}{to} \PYG{n}{no} \PYG{n}{policy}\PYG{o}{.} 8331\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} 8332\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{jennifer}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{p}{:} 8333\PYG{n}{Principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{jennifer@ATHENA.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{created}\PYG{o}{.} 8334\PYG{n}{kadmin}\PYG{p}{:} 8335\end{sphinxVerbatim} 8336 8337 8338\subsubsection{modify\_principal} 8339\label{\detokenize{admin/admin_commands/kadmin_local:modify-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id2}}\begin{quote} 8340 8341\sphinxAtStartPar 8342\sphinxstylestrong{modify\_principal} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{principal} 8343\end{quote} 8344 8345\sphinxAtStartPar 8346Modifies the specified principal, changing the fields as specified. 8347The options to \sphinxstylestrong{add\_principal} also apply to this command, except 8348for the \sphinxstylestrong{\sphinxhyphen{}randkey}, \sphinxstylestrong{\sphinxhyphen{}pw}, and \sphinxstylestrong{\sphinxhyphen{}e} options. In addition, the 8349option \sphinxstylestrong{\sphinxhyphen{}clearpolicy} will clear the current policy of a principal. 8350 8351\sphinxAtStartPar 8352This command requires the \sphinxstyleemphasis{modify} privilege. 8353 8354\sphinxAtStartPar 8355Alias: \sphinxstylestrong{modprinc} 8356 8357\sphinxAtStartPar 8358Options (in addition to the \sphinxstylestrong{addprinc} options): 8359\begin{description} 8360\item[{\sphinxstylestrong{\sphinxhyphen{}unlock}}] \leavevmode 8361\sphinxAtStartPar 8362Unlocks a locked principal (one which has received too many failed 8363authentication attempts without enough time between them according 8364to its password policy) so that it can successfully authenticate. 8365 8366\end{description} 8367 8368 8369\subsubsection{rename\_principal} 8370\label{\detokenize{admin/admin_commands/kadmin_local:rename-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id3}}\begin{quote} 8371 8372\sphinxAtStartPar 8373\sphinxstylestrong{rename\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{old\_principal} \sphinxstyleemphasis{new\_principal} 8374\end{quote} 8375 8376\sphinxAtStartPar 8377Renames the specified \sphinxstyleemphasis{old\_principal} to \sphinxstyleemphasis{new\_principal}. This 8378command prompts for confirmation, unless the \sphinxstylestrong{\sphinxhyphen{}force} option is 8379given. 8380 8381\sphinxAtStartPar 8382This command requires the \sphinxstylestrong{add} and \sphinxstylestrong{delete} privileges. 8383 8384\sphinxAtStartPar 8385Alias: \sphinxstylestrong{renprinc} 8386 8387 8388\subsubsection{delete\_principal} 8389\label{\detokenize{admin/admin_commands/kadmin_local:delete-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id4}}\begin{quote} 8390 8391\sphinxAtStartPar 8392\sphinxstylestrong{delete\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{principal} 8393\end{quote} 8394 8395\sphinxAtStartPar 8396Deletes the specified \sphinxstyleemphasis{principal} from the database. This command 8397prompts for deletion, unless the \sphinxstylestrong{\sphinxhyphen{}force} option is given. 8398 8399\sphinxAtStartPar 8400This command requires the \sphinxstylestrong{delete} privilege. 8401 8402\sphinxAtStartPar 8403Alias: \sphinxstylestrong{delprinc} 8404 8405 8406\subsubsection{change\_password} 8407\label{\detokenize{admin/admin_commands/kadmin_local:change-password}}\label{\detokenize{admin/admin_commands/kadmin_local:id5}}\begin{quote} 8408 8409\sphinxAtStartPar 8410\sphinxstylestrong{change\_password} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{principal} 8411\end{quote} 8412 8413\sphinxAtStartPar 8414Changes the password of \sphinxstyleemphasis{principal}. Prompts for a new password if 8415neither \sphinxstylestrong{\sphinxhyphen{}randkey} or \sphinxstylestrong{\sphinxhyphen{}pw} is specified. 8416 8417\sphinxAtStartPar 8418This command requires the \sphinxstylestrong{changepw} privilege, or that the 8419principal running the program is the same as the principal being 8420changed. 8421 8422\sphinxAtStartPar 8423Alias: \sphinxstylestrong{cpw} 8424 8425\sphinxAtStartPar 8426The following options are available: 8427\begin{description} 8428\item[{\sphinxstylestrong{\sphinxhyphen{}randkey}}] \leavevmode 8429\sphinxAtStartPar 8430Sets the key of the principal to a random value. 8431 8432\item[{\sphinxstylestrong{\sphinxhyphen{}pw} \sphinxstyleemphasis{password}}] \leavevmode 8433\sphinxAtStartPar 8434Set the password to the specified string. Using this option in a 8435script may expose the password to other users on the system via 8436the process list. 8437 8438\item[{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…}] \leavevmode 8439\sphinxAtStartPar 8440Uses the specified keysalt list for setting the keys of the 8441principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a 8442list of possible values. 8443 8444\item[{\sphinxstylestrong{\sphinxhyphen{}keepold}}] \leavevmode 8445\sphinxAtStartPar 8446Keeps the existing keys in the database. This flag is usually not 8447necessary except perhaps for \sphinxcode{\sphinxupquote{krbtgt}} principals. 8448 8449\end{description} 8450 8451\sphinxAtStartPar 8452Example: 8453 8454\begin{sphinxVerbatim}[commandchars=\\\{\}] 8455\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{cpw} \PYG{n}{systest} 8456\PYG{n}{Enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 8457\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 8458\PYG{n}{Password} \PYG{k}{for} \PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{changed}\PYG{o}{.} 8459\PYG{n}{kadmin}\PYG{p}{:} 8460\end{sphinxVerbatim} 8461 8462 8463\subsubsection{purgekeys} 8464\label{\detokenize{admin/admin_commands/kadmin_local:purgekeys}}\label{\detokenize{admin/admin_commands/kadmin_local:id6}}\begin{quote} 8465 8466\sphinxAtStartPar 8467\sphinxstylestrong{purgekeys} {[}\sphinxstylestrong{\sphinxhyphen{}all}|\sphinxstylestrong{\sphinxhyphen{}keepkvno} \sphinxstyleemphasis{oldest\_kvno\_to\_keep}{]} \sphinxstyleemphasis{principal} 8468\end{quote} 8469 8470\sphinxAtStartPar 8471Purges previously retained old keys (e.g., from \sphinxstylestrong{change\_password 8472\sphinxhyphen{}keepold}) from \sphinxstyleemphasis{principal}. If \sphinxstylestrong{\sphinxhyphen{}keepkvno} is specified, then 8473only purges keys with kvnos lower than \sphinxstyleemphasis{oldest\_kvno\_to\_keep}. If 8474\sphinxstylestrong{\sphinxhyphen{}all} is specified, then all keys are purged. The \sphinxstylestrong{\sphinxhyphen{}all} option 8475is new in release 1.12. 8476 8477\sphinxAtStartPar 8478This command requires the \sphinxstylestrong{modify} privilege. 8479 8480 8481\subsubsection{get\_principal} 8482\label{\detokenize{admin/admin_commands/kadmin_local:get-principal}}\label{\detokenize{admin/admin_commands/kadmin_local:id7}}\begin{quote} 8483 8484\sphinxAtStartPar 8485\sphinxstylestrong{get\_principal} {[}\sphinxstylestrong{\sphinxhyphen{}terse}{]} \sphinxstyleemphasis{principal} 8486\end{quote} 8487 8488\sphinxAtStartPar 8489Gets the attributes of principal. With the \sphinxstylestrong{\sphinxhyphen{}terse} option, outputs 8490fields as quoted tab\sphinxhyphen{}separated strings. 8491 8492\sphinxAtStartPar 8493This command requires the \sphinxstylestrong{inquire} privilege, or that the principal 8494running the the program to be the same as the one being listed. 8495 8496\sphinxAtStartPar 8497Alias: \sphinxstylestrong{getprinc} 8498 8499\sphinxAtStartPar 8500Examples: 8501 8502\begin{sphinxVerbatim}[commandchars=\\\{\}] 8503\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin} 8504\PYG{n}{Principal}\PYG{p}{:} \PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} 8505\PYG{n}{Expiration} \PYG{n}{date}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} 8506\PYG{n}{Last} \PYG{n}{password} \PYG{n}{change}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Aug} \PYG{l+m+mi}{12} \PYG{l+m+mi}{14}\PYG{p}{:}\PYG{l+m+mi}{16}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{EDT} \PYG{l+m+mi}{1996} 8507\PYG{n}{Password} \PYG{n}{expiration} \PYG{n}{date}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} 8508\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 8509\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{7} \PYG{n}{days} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 8510\PYG{n}{Last} \PYG{n}{modified}\PYG{p}{:} \PYG{n}{Mon} \PYG{n}{Aug} \PYG{l+m+mi}{12} \PYG{l+m+mi}{14}\PYG{p}{:}\PYG{l+m+mi}{16}\PYG{p}{:}\PYG{l+m+mi}{47} \PYG{n}{EDT} \PYG{l+m+mi}{1996} \PYG{p}{(}\PYG{n}{bjaspan}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{)} 8511\PYG{n}{Last} \PYG{n}{successful} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} 8512\PYG{n}{Last} \PYG{n}{failed} \PYG{n}{authentication}\PYG{p}{:} \PYG{p}{[}\PYG{n}{never}\PYG{p}{]} 8513\PYG{n}{Failed} \PYG{n}{password} \PYG{n}{attempts}\PYG{p}{:} \PYG{l+m+mi}{0} 8514\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} 8515\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha384}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{192} 8516\PYG{n}{MKey}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1} 8517\PYG{n}{Attributes}\PYG{p}{:} 8518\PYG{n}{Policy}\PYG{p}{:} \PYG{p}{[}\PYG{n}{none}\PYG{p}{]} 8519 8520\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{getprinc} \PYG{o}{\PYGZhy{}}\PYG{n}{terse} \PYG{n}{systest} 8521\PYG{n}{systest}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{l+m+mi}{3} \PYG{l+m+mi}{86400} \PYG{l+m+mi}{604800} \PYG{l+m+mi}{1} 8522\PYG{l+m+mi}{785926535} \PYG{l+m+mi}{753241234} \PYG{l+m+mi}{785900000} 8523\PYG{n}{tlyu}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{l+m+mi}{786100034} \PYG{l+m+mi}{0} \PYG{l+m+mi}{0} 8524\PYG{n}{kadmin}\PYG{p}{:} 8525\end{sphinxVerbatim} 8526 8527 8528\subsubsection{list\_principals} 8529\label{\detokenize{admin/admin_commands/kadmin_local:list-principals}}\label{\detokenize{admin/admin_commands/kadmin_local:id8}}\begin{quote} 8530 8531\sphinxAtStartPar 8532\sphinxstylestrong{list\_principals} {[}\sphinxstyleemphasis{expression}{]} 8533\end{quote} 8534 8535\sphinxAtStartPar 8536Retrieves all or some principal names. \sphinxstyleemphasis{expression} is a shell\sphinxhyphen{}style 8537glob expression that can contain the wild\sphinxhyphen{}card characters \sphinxcode{\sphinxupquote{?}}, 8538\sphinxcode{\sphinxupquote{*}}, and \sphinxcode{\sphinxupquote{{[}{]}}}. All principal names matching the expression are 8539printed. If no expression is provided, all principal names are 8540printed. If the expression does not contain an \sphinxcode{\sphinxupquote{@}} character, an 8541\sphinxcode{\sphinxupquote{@}} character followed by the local realm is appended to the 8542expression. 8543 8544\sphinxAtStartPar 8545This command requires the \sphinxstylestrong{list} privilege. 8546 8547\sphinxAtStartPar 8548Alias: \sphinxstylestrong{listprincs}, \sphinxstylestrong{get\_principals}, \sphinxstylestrong{getprincs} 8549 8550\sphinxAtStartPar 8551Example: 8552 8553\begin{sphinxVerbatim}[commandchars=\\\{\}] 8554\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listprincs} \PYG{n}{test}\PYG{o}{*} 8555\PYG{n}{test3}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} 8556\PYG{n}{test2}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} 8557\PYG{n}{test1}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} 8558\PYG{n}{testuser}\PYG{n+nd}{@SECURE}\PYG{o}{\PYGZhy{}}\PYG{n}{TEST}\PYG{o}{.}\PYG{n}{OV}\PYG{o}{.}\PYG{n}{COM} 8559\PYG{n}{kadmin}\PYG{p}{:} 8560\end{sphinxVerbatim} 8561 8562 8563\subsubsection{get\_strings} 8564\label{\detokenize{admin/admin_commands/kadmin_local:get-strings}}\label{\detokenize{admin/admin_commands/kadmin_local:id9}}\begin{quote} 8565 8566\sphinxAtStartPar 8567\sphinxstylestrong{get\_strings} \sphinxstyleemphasis{principal} 8568\end{quote} 8569 8570\sphinxAtStartPar 8571Displays string attributes on \sphinxstyleemphasis{principal}. 8572 8573\sphinxAtStartPar 8574This command requires the \sphinxstylestrong{inquire} privilege. 8575 8576\sphinxAtStartPar 8577Alias: \sphinxstylestrong{getstrs} 8578 8579 8580\subsubsection{set\_string} 8581\label{\detokenize{admin/admin_commands/kadmin_local:set-string}}\label{\detokenize{admin/admin_commands/kadmin_local:id10}}\begin{quote} 8582 8583\sphinxAtStartPar 8584\sphinxstylestrong{set\_string} \sphinxstyleemphasis{principal} \sphinxstyleemphasis{name} \sphinxstyleemphasis{value} 8585\end{quote} 8586 8587\sphinxAtStartPar 8588Sets a string attribute on \sphinxstyleemphasis{principal}. String attributes are used to 8589supply per\sphinxhyphen{}principal configuration to the KDC and some KDC plugin 8590modules. The following string attribute names are recognized by the 8591KDC: 8592\begin{description} 8593\item[{\sphinxstylestrong{require\_auth}}] \leavevmode 8594\sphinxAtStartPar 8595Specifies an authentication indicator which is required to 8596authenticate to the principal as a service. Multiple indicators 8597can be specified, separated by spaces; in this case any of the 8598specified indicators will be accepted. (New in release 1.14.) 8599 8600\item[{\sphinxstylestrong{session\_enctypes}}] \leavevmode 8601\sphinxAtStartPar 8602Specifies the encryption types supported for session keys when the 8603principal is authenticated to as a server. See 8604{\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the 8605accepted values. 8606 8607\item[{\sphinxstylestrong{otp}}] \leavevmode 8608\sphinxAtStartPar 8609Enables One Time Passwords (OTP) preauthentication for a client 8610\sphinxstyleemphasis{principal}. The \sphinxstyleemphasis{value} is a JSON string representing an array 8611of objects, each having optional \sphinxcode{\sphinxupquote{type}} and \sphinxcode{\sphinxupquote{username}} fields. 8612 8613\item[{\sphinxstylestrong{pkinit\_cert\_match}}] \leavevmode 8614\sphinxAtStartPar 8615Specifies a matching expression that defines the certificate 8616attributes required for the client certificate used by the 8617principal during PKINIT authentication. The matching expression 8618is in the same format as those used by the \sphinxstylestrong{pkinit\_cert\_match} 8619option in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. (New in release 1.16.) 8620 8621\item[{\sphinxstylestrong{pac\_privsvr\_enctype}}] \leavevmode 8622\sphinxAtStartPar 8623Forces the encryption type of the PAC KDC checksum buffers to the 8624specified encryption type for tickets issued to this server, by 8625deriving a key from the local krbtgt key if it is of a different 8626encryption type. It may be necessary to set this value to 8627“aes256\sphinxhyphen{}sha1” on the cross\sphinxhyphen{}realm krbtgt entry for an Active 8628Directory realm when using aes\sphinxhyphen{}sha2 keys on the local krbtgt 8629entry. 8630 8631\end{description} 8632 8633\sphinxAtStartPar 8634This command requires the \sphinxstylestrong{modify} privilege. 8635 8636\sphinxAtStartPar 8637Alias: \sphinxstylestrong{setstr} 8638 8639\sphinxAtStartPar 8640Example: 8641 8642\begin{sphinxVerbatim}[commandchars=\\\{\}] 8643\PYG{n}{set\PYGZus{}string} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{session\PYGZus{}enctypes} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts} 8644\PYG{n}{set\PYGZus{}string} \PYG{n}{user}\PYG{n+nd}{@FOO}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{otp} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{[}\PYG{l+s+s2}{\PYGZob{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{type}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{:}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{hotp}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{,}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{username}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{:}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{al}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{\PYGZcb{}]}\PYG{l+s+s2}{\PYGZdq{}} 8645\end{sphinxVerbatim} 8646 8647 8648\subsubsection{del\_string} 8649\label{\detokenize{admin/admin_commands/kadmin_local:del-string}}\label{\detokenize{admin/admin_commands/kadmin_local:id11}}\begin{quote} 8650 8651\sphinxAtStartPar 8652\sphinxstylestrong{del\_string} \sphinxstyleemphasis{principal} \sphinxstyleemphasis{key} 8653\end{quote} 8654 8655\sphinxAtStartPar 8656Deletes a string attribute from \sphinxstyleemphasis{principal}. 8657 8658\sphinxAtStartPar 8659This command requires the \sphinxstylestrong{delete} privilege. 8660 8661\sphinxAtStartPar 8662Alias: \sphinxstylestrong{delstr} 8663 8664 8665\subsubsection{add\_policy} 8666\label{\detokenize{admin/admin_commands/kadmin_local:add-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id12}}\begin{quote} 8667 8668\sphinxAtStartPar 8669\sphinxstylestrong{add\_policy} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{policy} 8670\end{quote} 8671 8672\sphinxAtStartPar 8673Adds a password policy named \sphinxstyleemphasis{policy} to the database. 8674 8675\sphinxAtStartPar 8676This command requires the \sphinxstylestrong{add} privilege. 8677 8678\sphinxAtStartPar 8679Alias: \sphinxstylestrong{addpol} 8680 8681\sphinxAtStartPar 8682The following options are available: 8683\begin{description} 8684\item[{\sphinxstylestrong{\sphinxhyphen{}maxlife} \sphinxstyleemphasis{time}}] \leavevmode 8685\sphinxAtStartPar 8686(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the maximum 8687lifetime of a password. 8688 8689\item[{\sphinxstylestrong{\sphinxhyphen{}minlife} \sphinxstyleemphasis{time}}] \leavevmode 8690\sphinxAtStartPar 8691(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the minimum 8692lifetime of a password. 8693 8694\item[{\sphinxstylestrong{\sphinxhyphen{}minlength} \sphinxstyleemphasis{length}}] \leavevmode 8695\sphinxAtStartPar 8696Sets the minimum length of a password. 8697 8698\item[{\sphinxstylestrong{\sphinxhyphen{}minclasses} \sphinxstyleemphasis{number}}] \leavevmode 8699\sphinxAtStartPar 8700Sets the minimum number of character classes required in a 8701password. The five character classes are lower case, upper case, 8702numbers, punctuation, and whitespace/unprintable characters. 8703 8704\item[{\sphinxstylestrong{\sphinxhyphen{}history} \sphinxstyleemphasis{number}}] \leavevmode 8705\sphinxAtStartPar 8706Sets the number of past keys kept for a principal. This option is 8707not supported with the LDAP KDC database module. 8708 8709\end{description} 8710\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-maxfailure}}\begin{description} 8711\item[{\sphinxstylestrong{\sphinxhyphen{}maxfailure} \sphinxstyleemphasis{maxnumber}}] \leavevmode 8712\sphinxAtStartPar 8713Sets the number of authentication failures before the principal is 8714locked. Authentication failures are only tracked for principals 8715which require preauthentication. The counter of failed attempts 8716resets to 0 after a successful attempt to authenticate. A 8717\sphinxstyleemphasis{maxnumber} value of 0 (the default) disables lockout. 8718 8719\end{description} 8720\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-failurecountinterval}}\begin{description} 8721\item[{\sphinxstylestrong{\sphinxhyphen{}failurecountinterval} \sphinxstyleemphasis{failuretime}}] \leavevmode 8722\sphinxAtStartPar 8723(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the allowable time 8724between authentication failures. If an authentication failure 8725happens after \sphinxstyleemphasis{failuretime} has elapsed since the previous 8726failure, the number of authentication failures is reset to 1. A 8727\sphinxstyleemphasis{failuretime} value of 0 (the default) means forever. 8728 8729\end{description} 8730\phantomsection\label{\detokenize{admin/admin_commands/kadmin_local:policy-lockoutduration}}\begin{description} 8731\item[{\sphinxstylestrong{\sphinxhyphen{}lockoutduration} \sphinxstyleemphasis{lockouttime}}] \leavevmode 8732\sphinxAtStartPar 8733(\DUrole{xref,std,std-ref}{duration} or \DUrole{xref,std,std-ref}{getdate} string) Sets the duration for 8734which the principal is locked from authenticating if too many 8735authentication failures occur without the specified failure count 8736interval elapsing. A duration of 0 (the default) means the 8737principal remains locked out until it is administratively unlocked 8738with \sphinxcode{\sphinxupquote{modprinc \sphinxhyphen{}unlock}}. 8739 8740\item[{\sphinxstylestrong{\sphinxhyphen{}allowedkeysalts}}] \leavevmode 8741\sphinxAtStartPar 8742Specifies the key/salt tuples supported for long\sphinxhyphen{}term keys when 8743setting or changing a principal’s password/keys. See 8744{\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of the 8745accepted values, but note that key/salt tuples must be separated 8746with commas (‘,’) only. To clear the allowed key/salt policy use 8747a value of ‘\sphinxhyphen{}‘. 8748 8749\end{description} 8750 8751\sphinxAtStartPar 8752Example: 8753 8754\begin{sphinxVerbatim}[commandchars=\\\{\}] 8755\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{add\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{maxlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{2 days}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{minlength} \PYG{l+m+mi}{5} \PYG{n}{guests} 8756\PYG{n}{kadmin}\PYG{p}{:} 8757\end{sphinxVerbatim} 8758 8759 8760\subsubsection{modify\_policy} 8761\label{\detokenize{admin/admin_commands/kadmin_local:modify-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id13}}\begin{quote} 8762 8763\sphinxAtStartPar 8764\sphinxstylestrong{modify\_policy} {[}\sphinxstyleemphasis{options}{]} \sphinxstyleemphasis{policy} 8765\end{quote} 8766 8767\sphinxAtStartPar 8768Modifies the password policy named \sphinxstyleemphasis{policy}. Options are as described 8769for \sphinxstylestrong{add\_policy}. 8770 8771\sphinxAtStartPar 8772This command requires the \sphinxstylestrong{modify} privilege. 8773 8774\sphinxAtStartPar 8775Alias: \sphinxstylestrong{modpol} 8776 8777 8778\subsubsection{delete\_policy} 8779\label{\detokenize{admin/admin_commands/kadmin_local:delete-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id14}}\begin{quote} 8780 8781\sphinxAtStartPar 8782\sphinxstylestrong{delete\_policy} {[}\sphinxstylestrong{\sphinxhyphen{}force}{]} \sphinxstyleemphasis{policy} 8783\end{quote} 8784 8785\sphinxAtStartPar 8786Deletes the password policy named \sphinxstyleemphasis{policy}. Prompts for confirmation 8787before deletion. The command will fail if the policy is in use by any 8788principals. 8789 8790\sphinxAtStartPar 8791This command requires the \sphinxstylestrong{delete} privilege. 8792 8793\sphinxAtStartPar 8794Alias: \sphinxstylestrong{delpol} 8795 8796\sphinxAtStartPar 8797Example: 8798 8799\begin{sphinxVerbatim}[commandchars=\\\{\}] 8800kadmin: del\PYGZus{}policy guests 8801Are you sure you want to delete the policy \PYGZdq{}guests\PYGZdq{}? 8802(yes/no): yes 8803kadmin: 8804\end{sphinxVerbatim} 8805 8806 8807\subsubsection{get\_policy} 8808\label{\detokenize{admin/admin_commands/kadmin_local:get-policy}}\label{\detokenize{admin/admin_commands/kadmin_local:id15}}\begin{quote} 8809 8810\sphinxAtStartPar 8811\sphinxstylestrong{get\_policy} {[} \sphinxstylestrong{\sphinxhyphen{}terse} {]} \sphinxstyleemphasis{policy} 8812\end{quote} 8813 8814\sphinxAtStartPar 8815Displays the values of the password policy named \sphinxstyleemphasis{policy}. With the 8816\sphinxstylestrong{\sphinxhyphen{}terse} flag, outputs the fields as quoted strings separated by 8817tabs. 8818 8819\sphinxAtStartPar 8820This command requires the \sphinxstylestrong{inquire} privilege. 8821 8822\sphinxAtStartPar 8823Alias: \sphinxstylestrong{getpol} 8824 8825\sphinxAtStartPar 8826Examples: 8827 8828\begin{sphinxVerbatim}[commandchars=\\\{\}] 8829\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{get\PYGZus{}policy} \PYG{n}{admin} 8830\PYG{n}{Policy}\PYG{p}{:} \PYG{n}{admin} 8831\PYG{n}{Maximum} \PYG{n}{password} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{180} \PYG{n}{days} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 8832\PYG{n}{Minimum} \PYG{n}{password} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 8833\PYG{n}{Minimum} \PYG{n}{password} \PYG{n}{length}\PYG{p}{:} \PYG{l+m+mi}{6} 8834\PYG{n}{Minimum} \PYG{n}{number} \PYG{n}{of} \PYG{n}{password} \PYG{n}{character} \PYG{n}{classes}\PYG{p}{:} \PYG{l+m+mi}{2} 8835\PYG{n}{Number} \PYG{n}{of} \PYG{n}{old} \PYG{n}{keys} \PYG{n}{kept}\PYG{p}{:} \PYG{l+m+mi}{5} 8836\PYG{n}{Reference} \PYG{n}{count}\PYG{p}{:} \PYG{l+m+mi}{17} 8837 8838\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{get\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{terse} \PYG{n}{admin} 8839\PYG{n}{admin} \PYG{l+m+mi}{15552000} \PYG{l+m+mi}{0} \PYG{l+m+mi}{6} \PYG{l+m+mi}{2} \PYG{l+m+mi}{5} \PYG{l+m+mi}{17} 8840\PYG{n}{kadmin}\PYG{p}{:} 8841\end{sphinxVerbatim} 8842 8843\sphinxAtStartPar 8844The “Reference count” is the number of principals using that policy. 8845With the LDAP KDC database module, the reference count field is not 8846meaningful. 8847 8848 8849\subsubsection{list\_policies} 8850\label{\detokenize{admin/admin_commands/kadmin_local:list-policies}}\label{\detokenize{admin/admin_commands/kadmin_local:id16}}\begin{quote} 8851 8852\sphinxAtStartPar 8853\sphinxstylestrong{list\_policies} {[}\sphinxstyleemphasis{expression}{]} 8854\end{quote} 8855 8856\sphinxAtStartPar 8857Retrieves all or some policy names. \sphinxstyleemphasis{expression} is a shell\sphinxhyphen{}style 8858glob expression that can contain the wild\sphinxhyphen{}card characters \sphinxcode{\sphinxupquote{?}}, 8859\sphinxcode{\sphinxupquote{*}}, and \sphinxcode{\sphinxupquote{{[}{]}}}. All policy names matching the expression are 8860printed. If no expression is provided, all existing policy names are 8861printed. 8862 8863\sphinxAtStartPar 8864This command requires the \sphinxstylestrong{list} privilege. 8865 8866\sphinxAtStartPar 8867Aliases: \sphinxstylestrong{listpols}, \sphinxstylestrong{get\_policies}, \sphinxstylestrong{getpols}. 8868 8869\sphinxAtStartPar 8870Examples: 8871 8872\begin{sphinxVerbatim}[commandchars=\\\{\}] 8873\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listpols} 8874\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol} 8875\PYG{n+nb}{dict}\PYG{o}{\PYGZhy{}}\PYG{n}{only} 8876\PYG{n}{once}\PYG{o}{\PYGZhy{}}\PYG{n}{a}\PYG{o}{\PYGZhy{}}\PYG{n+nb}{min} 8877\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol}\PYG{o}{\PYGZhy{}}\PYG{n}{nopw} 8878 8879\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{listpols} \PYG{n}{t}\PYG{o}{*} 8880\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol} 8881\PYG{n}{test}\PYG{o}{\PYGZhy{}}\PYG{n}{pol}\PYG{o}{\PYGZhy{}}\PYG{n}{nopw} 8882\PYG{n}{kadmin}\PYG{p}{:} 8883\end{sphinxVerbatim} 8884 8885 8886\subsubsection{ktadd} 8887\label{\detokenize{admin/admin_commands/kadmin_local:ktadd}}\label{\detokenize{admin/admin_commands/kadmin_local:id17}}\begin{quote} 8888 8889\begin{DUlineblock}{0em} 8890\item[] \sphinxstylestrong{ktadd} {[}options{]} \sphinxstyleemphasis{principal} 8891\item[] \sphinxstylestrong{ktadd} {[}options{]} \sphinxstylestrong{\sphinxhyphen{}glob} \sphinxstyleemphasis{princ\sphinxhyphen{}exp} 8892\end{DUlineblock} 8893\end{quote} 8894 8895\sphinxAtStartPar 8896Adds a \sphinxstyleemphasis{principal}, or all principals matching \sphinxstyleemphasis{princ\sphinxhyphen{}exp}, to a 8897keytab file. Each principal’s keys are randomized in the process. 8898The rules for \sphinxstyleemphasis{princ\sphinxhyphen{}exp} are described in the \sphinxstylestrong{list\_principals} 8899command. 8900 8901\sphinxAtStartPar 8902This command requires the \sphinxstylestrong{inquire} and \sphinxstylestrong{changepw} privileges. 8903With the \sphinxstylestrong{\sphinxhyphen{}glob} form, it also requires the \sphinxstylestrong{list} privilege. 8904 8905\sphinxAtStartPar 8906The options are: 8907\begin{description} 8908\item[{\sphinxstylestrong{\sphinxhyphen{}k{[}eytab{]}} \sphinxstyleemphasis{keytab}}] \leavevmode 8909\sphinxAtStartPar 8910Use \sphinxstyleemphasis{keytab} as the keytab file. Otherwise, the default keytab is 8911used. 8912 8913\item[{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…}] \leavevmode 8914\sphinxAtStartPar 8915Uses the specified keysalt list for setting the new keys of the 8916principal. See {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{Keysalt lists}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a 8917list of possible values. 8918 8919\item[{\sphinxstylestrong{\sphinxhyphen{}q}}] \leavevmode 8920\sphinxAtStartPar 8921Display less verbose information. 8922 8923\item[{\sphinxstylestrong{\sphinxhyphen{}norandkey}}] \leavevmode 8924\sphinxAtStartPar 8925Do not randomize the keys. The keys and their version numbers stay 8926unchanged. This option cannot be specified in combination with the 8927\sphinxstylestrong{\sphinxhyphen{}e} option. 8928 8929\end{description} 8930 8931\sphinxAtStartPar 8932An entry for each of the principal’s unique encryption types is added, 8933ignoring multiple keys with the same encryption type but different 8934salt types. 8935 8936\sphinxAtStartPar 8937Alias: \sphinxstylestrong{xst} 8938 8939\sphinxAtStartPar 8940Example: 8941 8942\begin{sphinxVerbatim}[commandchars=\\\{\}] 8943\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktadd} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{\PYGZhy{}}\PYG{n}{new}\PYG{o}{\PYGZhy{}}\PYG{n}{keytab} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 8944\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} 8945 \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} 8946 \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{tmp}\PYG{o}{/}\PYG{n}{foo}\PYG{o}{\PYGZhy{}}\PYG{n}{new}\PYG{o}{\PYGZhy{}}\PYG{n}{keytab} 8947\PYG{n}{kadmin}\PYG{p}{:} 8948\end{sphinxVerbatim} 8949 8950 8951\subsubsection{ktremove} 8952\label{\detokenize{admin/admin_commands/kadmin_local:ktremove}}\label{\detokenize{admin/admin_commands/kadmin_local:id18}}\begin{quote} 8953 8954\sphinxAtStartPar 8955\sphinxstylestrong{ktremove} {[}options{]} \sphinxstyleemphasis{principal} {[}\sphinxstyleemphasis{kvno} | \sphinxstyleemphasis{all} | \sphinxstyleemphasis{old}{]} 8956\end{quote} 8957 8958\sphinxAtStartPar 8959Removes entries for the specified \sphinxstyleemphasis{principal} from a keytab. Requires 8960no permissions, since this does not require database access. 8961 8962\sphinxAtStartPar 8963If the string “all” is specified, all entries for that principal are 8964removed; if the string “old” is specified, all entries for that 8965principal except those with the highest kvno are removed. Otherwise, 8966the value specified is parsed as an integer, and all entries whose 8967kvno match that integer are removed. 8968 8969\sphinxAtStartPar 8970The options are: 8971\begin{description} 8972\item[{\sphinxstylestrong{\sphinxhyphen{}k{[}eytab{]}} \sphinxstyleemphasis{keytab}}] \leavevmode 8973\sphinxAtStartPar 8974Use \sphinxstyleemphasis{keytab} as the keytab file. Otherwise, the default keytab is 8975used. 8976 8977\item[{\sphinxstylestrong{\sphinxhyphen{}q}}] \leavevmode 8978\sphinxAtStartPar 8979Display less verbose information. 8980 8981\end{description} 8982 8983\sphinxAtStartPar 8984Alias: \sphinxstylestrong{ktrem} 8985 8986\sphinxAtStartPar 8987Example: 8988 8989\begin{sphinxVerbatim}[commandchars=\\\{\}] 8990\PYG{n}{kadmin}\PYG{p}{:} \PYG{n}{ktremove} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin} \PYG{n+nb}{all} 8991\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} 8992 \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} 8993\PYG{n}{kadmin}\PYG{p}{:} 8994\end{sphinxVerbatim} 8995 8996 8997\subsubsection{lock} 8998\label{\detokenize{admin/admin_commands/kadmin_local:lock}} 8999\sphinxAtStartPar 9000Lock database exclusively. Use with extreme caution! This command 9001only works with the DB2 KDC database module. 9002 9003 9004\subsubsection{unlock} 9005\label{\detokenize{admin/admin_commands/kadmin_local:unlock}} 9006\sphinxAtStartPar 9007Release the exclusive database lock. 9008 9009 9010\subsubsection{list\_requests} 9011\label{\detokenize{admin/admin_commands/kadmin_local:list-requests}} 9012\sphinxAtStartPar 9013Lists available for kadmin requests. 9014 9015\sphinxAtStartPar 9016Aliases: \sphinxstylestrong{lr}, \sphinxstylestrong{?} 9017 9018 9019\subsubsection{quit} 9020\label{\detokenize{admin/admin_commands/kadmin_local:quit}} 9021\sphinxAtStartPar 9022Exit program. If the database was locked, the lock is released. 9023 9024\sphinxAtStartPar 9025Aliases: \sphinxstylestrong{exit}, \sphinxstylestrong{q} 9026 9027 9028\subsection{HISTORY} 9029\label{\detokenize{admin/admin_commands/kadmin_local:history}} 9030\sphinxAtStartPar 9031The kadmin program was originally written by Tom Yu at MIT, as an 9032interface to the OpenVision Kerberos administration program. 9033 9034 9035\subsection{ENVIRONMENT} 9036\label{\detokenize{admin/admin_commands/kadmin_local:environment}} 9037\sphinxAtStartPar 9038See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 9039variables. 9040 9041 9042\subsection{SEE ALSO} 9043\label{\detokenize{admin/admin_commands/kadmin_local:see-also}} 9044\sphinxAtStartPar 9045\DUrole{xref,std,std-ref}{kpasswd(1)}, {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 9046 9047 9048\section{kadmind} 9049\label{\detokenize{admin/admin_commands/kadmind:kadmind}}\label{\detokenize{admin/admin_commands/kadmind:kadmind-8}}\label{\detokenize{admin/admin_commands/kadmind::doc}} 9050 9051\subsection{SYNOPSIS} 9052\label{\detokenize{admin/admin_commands/kadmind:synopsis}} 9053\sphinxAtStartPar 9054\sphinxstylestrong{kadmind} 9055{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} 9056{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 9057{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} 9058{[}\sphinxstylestrong{\sphinxhyphen{}nofork}{]} 9059{[}\sphinxstylestrong{\sphinxhyphen{}proponly}{]} 9060{[}\sphinxstylestrong{\sphinxhyphen{}port} \sphinxstyleemphasis{port\sphinxhyphen{}number}{]} 9061{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}{]} 9062{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_path}{]} 9063{[}\sphinxstylestrong{\sphinxhyphen{}K} \sphinxstyleemphasis{kprop\_path}{]} 9064{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kprop\_port}{]} 9065{[}\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{dump\_file}{]} 9066 9067 9068\subsection{DESCRIPTION} 9069\label{\detokenize{admin/admin_commands/kadmind:description}} 9070\sphinxAtStartPar 9071kadmind starts the Kerberos administration server. kadmind typically 9072runs on the primary Kerberos server, which stores the KDC database. 9073If the KDC database uses the LDAP module, the administration server 9074and the KDC server need not run on the same machine. kadmind accepts 9075remote requests from programs such as {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} and 9076\DUrole{xref,std,std-ref}{kpasswd(1)} to administer the information in these database. 9077 9078\sphinxAtStartPar 9079kadmind requires a number of configuration files to be set up in order 9080for it to work: 9081\begin{description} 9082\item[{{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}}] \leavevmode 9083\sphinxAtStartPar 9084The KDC configuration file contains configuration information for 9085the KDC and admin servers. kadmind uses settings in this file to 9086locate the Kerberos database, and is also affected by the 9087\sphinxstylestrong{acl\_file}, \sphinxstylestrong{dict\_file}, \sphinxstylestrong{kadmind\_port}, and iprop\sphinxhyphen{}related 9088settings. 9089 9090\item[{{\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}}] \leavevmode 9091\sphinxAtStartPar 9092kadmind’s ACL (access control list) tells it which principals are 9093allowed to perform administration actions. The pathname to the 9094ACL file can be specified with the \sphinxstylestrong{acl\_file} {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} 9095variable; by default, it is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}}. 9096 9097\end{description} 9098 9099\sphinxAtStartPar 9100After the server begins running, it puts itself in the background and 9101disassociates itself from its controlling terminal. 9102 9103\sphinxAtStartPar 9104kadmind can be configured for incremental database propagation. 9105Incremental propagation allows replica KDC servers to receive 9106principal and policy updates incrementally instead of receiving full 9107dumps of the database. This facility can be enabled in the 9108{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file with the \sphinxstylestrong{iprop\_enable} option. Incremental 9109propagation requires the principal \sphinxcode{\sphinxupquote{kiprop/PRIMARY\textbackslash{}@REALM}} (where 9110PRIMARY is the primary KDC’s canonical host name, and REALM the realm 9111name). In release 1.13, this principal is automatically created and 9112registered into the datebase. 9113 9114 9115\subsection{OPTIONS} 9116\label{\detokenize{admin/admin_commands/kadmind:options}}\begin{description} 9117\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 9118\sphinxAtStartPar 9119specifies the realm that kadmind will serve; if it is not 9120specified, the default realm of the host is used. 9121 9122\item[{\sphinxstylestrong{\sphinxhyphen{}m}}] \leavevmode 9123\sphinxAtStartPar 9124causes the master database password to be fetched from the 9125keyboard (before the server puts itself in the background, if not 9126invoked with the \sphinxstylestrong{\sphinxhyphen{}nofork} option) rather than from a file on 9127disk. 9128 9129\item[{\sphinxstylestrong{\sphinxhyphen{}nofork}}] \leavevmode 9130\sphinxAtStartPar 9131causes the server to remain in the foreground and remain 9132associated to the terminal. 9133 9134\item[{\sphinxstylestrong{\sphinxhyphen{}proponly}}] \leavevmode 9135\sphinxAtStartPar 9136causes the server to only listen and respond to Kerberos replica 9137incremental propagation polling requests. This option can be used 9138to set up a hierarchical propagation topology where a replica KDC 9139provides incremental updates to other Kerberos replicas. 9140 9141\item[{\sphinxstylestrong{\sphinxhyphen{}port} \sphinxstyleemphasis{port\sphinxhyphen{}number}}] \leavevmode 9142\sphinxAtStartPar 9143specifies the port on which the administration server listens for 9144connections. The default port is determined by the 9145\sphinxstylestrong{kadmind\_port} configuration variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9146 9147\item[{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}}] \leavevmode 9148\sphinxAtStartPar 9149specifies the file to which the PID of kadmind process should be 9150written after it starts up. This file can be used to identify 9151whether kadmind is still running and to allow init scripts to stop 9152the correct process. 9153 9154\item[{\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_path}}] \leavevmode 9155\sphinxAtStartPar 9156specifies the path to the kdb5\_util command to use when dumping the 9157KDB in response to full resync requests when iprop is enabled. 9158 9159\item[{\sphinxstylestrong{\sphinxhyphen{}K} \sphinxstyleemphasis{kprop\_path}}] \leavevmode 9160\sphinxAtStartPar 9161specifies the path to the kprop command to use to send full dumps 9162to replicas in response to full resync requests. 9163 9164\item[{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kprop\_port}}] \leavevmode 9165\sphinxAtStartPar 9166specifies the port by which the kprop process that is spawned by 9167kadmind connects to the replica kpropd, in order to transfer the 9168dump file during an iprop full resync request. 9169 9170\item[{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{dump\_file}}] \leavevmode 9171\sphinxAtStartPar 9172specifies the file path to be used for dumping the KDB in response 9173to full resync requests when iprop is enabled. 9174 9175\item[{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}}] \leavevmode 9176\sphinxAtStartPar 9177specifies database\sphinxhyphen{}specific arguments. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for supported arguments. 9178 9179\end{description} 9180 9181 9182\subsection{ENVIRONMENT} 9183\label{\detokenize{admin/admin_commands/kadmind:environment}} 9184\sphinxAtStartPar 9185See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 9186variables. 9187 9188 9189\subsection{SEE ALSO} 9190\label{\detokenize{admin/admin_commands/kadmind:see-also}} 9191\sphinxAtStartPar 9192\DUrole{xref,std,std-ref}{kpasswd(1)}, {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, 9193{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}, {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 9194 9195 9196\section{kdb5\_util} 9197\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}}\label{\detokenize{admin/admin_commands/kdb5_util::doc}} 9198 9199\subsection{SYNOPSIS} 9200\label{\detokenize{admin/admin_commands/kdb5_util:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-synopsis}} 9201\sphinxAtStartPar 9202\sphinxstylestrong{kdb5\_util} 9203{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 9204{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} 9205{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}{]} 9206{[}\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}{]} 9207{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} 9208{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} 9209{[}\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}{]} 9210{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}{]} 9211{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} 9212\sphinxstyleemphasis{command} {[}\sphinxstyleemphasis{command\_options}{]} 9213 9214 9215\subsection{DESCRIPTION} 9216\label{\detokenize{admin/admin_commands/kdb5_util:description}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-synopsis-end}} 9217\sphinxAtStartPar 9218kdb5\_util allows an administrator to perform maintenance procedures on 9219the KDC database. Databases can be created, destroyed, and dumped to 9220or loaded from ASCII files. kdb5\_util can create a Kerberos master 9221key stash file or perform live rollover of the master key. 9222 9223\sphinxAtStartPar 9224When kdb5\_util is run, it attempts to acquire the master key and open 9225the database. However, execution continues regardless of whether or 9226not kdb5\_util successfully opens the database, because the database 9227may not exist yet or the stash file may be corrupt. 9228 9229\sphinxAtStartPar 9230Note that some KDC database modules may not support all kdb5\_util 9231commands. 9232 9233 9234\subsection{COMMAND\sphinxhyphen{}LINE OPTIONS} 9235\label{\detokenize{admin/admin_commands/kdb5_util:command-line-options}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-options}}\begin{description} 9236\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 9237\sphinxAtStartPar 9238specifies the Kerberos realm of the database. 9239 9240\item[{\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}}] \leavevmode 9241\sphinxAtStartPar 9242specifies the name under which the principal database is stored; 9243by default the database is that listed in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. The 9244password policy database and lock files are also derived from this 9245value. 9246 9247\item[{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}}] \leavevmode 9248\sphinxAtStartPar 9249specifies the key type of the master key in the database. The 9250default is given by the \sphinxstylestrong{master\_key\_type} variable in 9251{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9252 9253\item[{\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}}] \leavevmode 9254\sphinxAtStartPar 9255Specifies the version number of the master key in the database; 9256the default is 1. Note that 0 is not allowed. 9257 9258\item[{\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}}] \leavevmode 9259\sphinxAtStartPar 9260principal name for the master key in the database. If not 9261specified, the name is determined by the \sphinxstylestrong{master\_key\_name} 9262variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9263 9264\item[{\sphinxstylestrong{\sphinxhyphen{}m}}] \leavevmode 9265\sphinxAtStartPar 9266specifies that the master database password should be read from 9267the keyboard rather than fetched from a file on disk. 9268 9269\item[{\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stash\_file}}] \leavevmode 9270\sphinxAtStartPar 9271specifies the stash filename of the master database password. If 9272not specified, the filename is determined by the 9273\sphinxstylestrong{key\_stash\_file} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9274 9275\item[{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}}] \leavevmode 9276\sphinxAtStartPar 9277specifies the master database password. Using this option may 9278expose the password to other users on the system via the process 9279list. 9280 9281\item[{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}}] \leavevmode 9282\sphinxAtStartPar 9283specifies database\sphinxhyphen{}specific options. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for 9284supported options. 9285 9286\end{description} 9287 9288 9289\subsection{COMMANDS} 9290\label{\detokenize{admin/admin_commands/kdb5_util:commands}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-options-end}} 9291 9292\subsubsection{create} 9293\label{\detokenize{admin/admin_commands/kdb5_util:create}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-create}}\begin{quote} 9294 9295\sphinxAtStartPar 9296\sphinxstylestrong{create} {[}\sphinxstylestrong{\sphinxhyphen{}s}{]} 9297\end{quote} 9298 9299\sphinxAtStartPar 9300Creates a new database. If the \sphinxstylestrong{\sphinxhyphen{}s} option is specified, the stash 9301file is also created. This command fails if the database already 9302exists. If the command is successful, the database is opened just as 9303if it had already existed when the program was first run. 9304 9305 9306\subsubsection{destroy} 9307\label{\detokenize{admin/admin_commands/kdb5_util:destroy}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-create-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-destroy}}\begin{quote} 9308 9309\sphinxAtStartPar 9310\sphinxstylestrong{destroy} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} 9311\end{quote} 9312 9313\sphinxAtStartPar 9314Destroys the database, first overwriting the disk sectors and then 9315unlinking the files, after prompting the user for confirmation. With 9316the \sphinxstylestrong{\sphinxhyphen{}f} argument, does not prompt the user. 9317 9318 9319\subsubsection{stash} 9320\label{\detokenize{admin/admin_commands/kdb5_util:stash}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-destroy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-stash}}\begin{quote} 9321 9322\sphinxAtStartPar 9323\sphinxstylestrong{stash} {[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{keyfile}{]} 9324\end{quote} 9325 9326\sphinxAtStartPar 9327Stores the master principal’s keys in a stash file. The \sphinxstylestrong{\sphinxhyphen{}f} 9328argument can be used to override the \sphinxstyleemphasis{keyfile} specified in 9329{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9330 9331 9332\subsubsection{dump} 9333\label{\detokenize{admin/admin_commands/kdb5_util:dump}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-stash-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-dump}}\begin{quote} 9334 9335\sphinxAtStartPar 9336\sphinxstylestrong{dump} {[}\sphinxstylestrong{\sphinxhyphen{}b7}|\sphinxstylestrong{\sphinxhyphen{}r13}|\sphinxstylestrong{\sphinxhyphen{}r18}{]} 9337{[}\sphinxstylestrong{\sphinxhyphen{}verbose}{]} {[}\sphinxstylestrong{\sphinxhyphen{}mkey\_convert}{]} {[}\sphinxstylestrong{\sphinxhyphen{}new\_mkey\_file} 9338\sphinxstyleemphasis{mkey\_file}{]} {[}\sphinxstylestrong{\sphinxhyphen{}rev}{]} {[}\sphinxstylestrong{\sphinxhyphen{}recurse}{]} {[}\sphinxstyleemphasis{filename} 9339{[}\sphinxstyleemphasis{principals}…{]}{]} 9340\end{quote} 9341 9342\sphinxAtStartPar 9343Dumps the current Kerberos and KADM5 database into an ASCII file. By 9344default, the database is dumped in current format, “kdb5\_util 9345load\_dump version 7”. If filename is not specified, or is the string 9346“\sphinxhyphen{}”, the dump is sent to standard output. Options: 9347\begin{description} 9348\item[{\sphinxstylestrong{\sphinxhyphen{}b7}}] \leavevmode 9349\sphinxAtStartPar 9350causes the dump to be in the Kerberos 5 Beta 7 format (“kdb5\_util 9351load\_dump version 4”). This was the dump format produced on 9352releases prior to 1.2.2. 9353 9354\item[{\sphinxstylestrong{\sphinxhyphen{}r13}}] \leavevmode 9355\sphinxAtStartPar 9356causes the dump to be in the Kerberos 5 1.3 format (“kdb5\_util 9357load\_dump version 5”). This was the dump format produced on 9358releases prior to 1.8. 9359 9360\item[{\sphinxstylestrong{\sphinxhyphen{}r18}}] \leavevmode 9361\sphinxAtStartPar 9362causes the dump to be in the Kerberos 5 1.8 format (“kdb5\_util 9363load\_dump version 6”). This was the dump format produced on 9364releases prior to 1.11. 9365 9366\item[{\sphinxstylestrong{\sphinxhyphen{}verbose}}] \leavevmode 9367\sphinxAtStartPar 9368causes the name of each principal and policy to be printed as it 9369is dumped. 9370 9371\item[{\sphinxstylestrong{\sphinxhyphen{}mkey\_convert}}] \leavevmode 9372\sphinxAtStartPar 9373prompts for a new master key. This new master key will be used to 9374re\sphinxhyphen{}encrypt principal key data in the dumpfile. The principal keys 9375themselves will not be changed. 9376 9377\item[{\sphinxstylestrong{\sphinxhyphen{}new\_mkey\_file} \sphinxstyleemphasis{mkey\_file}}] \leavevmode 9378\sphinxAtStartPar 9379the filename of a stash file. The master key in this stash file 9380will be used to re\sphinxhyphen{}encrypt the key data in the dumpfile. The key 9381data in the database will not be changed. 9382 9383\item[{\sphinxstylestrong{\sphinxhyphen{}rev}}] \leavevmode 9384\sphinxAtStartPar 9385dumps in reverse order. This may recover principals that do not 9386dump normally, in cases where database corruption has occurred. 9387 9388\item[{\sphinxstylestrong{\sphinxhyphen{}recurse}}] \leavevmode 9389\sphinxAtStartPar 9390causes the dump to walk the database recursively (btree only). 9391This may recover principals that do not dump normally, in cases 9392where database corruption has occurred. In cases of such 9393corruption, this option will probably retrieve more principals 9394than the \sphinxstylestrong{\sphinxhyphen{}rev} option will. 9395 9396\sphinxAtStartPar 9397\DUrole{versionmodified,changed}{Changed in version 1.15: }Release 1.15 restored the functionality of the \sphinxstylestrong{\sphinxhyphen{}recurse} 9398option. 9399 9400\sphinxAtStartPar 9401\DUrole{versionmodified,changed}{Changed in version 1.5: }The \sphinxstylestrong{\sphinxhyphen{}recurse} option ceased working until release 1.15, 9402doing a normal dump instead of a recursive traversal. 9403 9404\end{description} 9405 9406 9407\subsubsection{load} 9408\label{\detokenize{admin/admin_commands/kdb5_util:load}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-dump-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-load}}\begin{quote} 9409 9410\sphinxAtStartPar 9411\sphinxstylestrong{load} {[}\sphinxstylestrong{\sphinxhyphen{}b7}|\sphinxstylestrong{\sphinxhyphen{}r13}|\sphinxstylestrong{\sphinxhyphen{}r18}{]} {[}\sphinxstylestrong{\sphinxhyphen{}hash}{]} 9412{[}\sphinxstylestrong{\sphinxhyphen{}verbose}{]} {[}\sphinxstylestrong{\sphinxhyphen{}update}{]} \sphinxstyleemphasis{filename} 9413\end{quote} 9414 9415\sphinxAtStartPar 9416Loads a database dump from the named file into the named database. If 9417no option is given to determine the format of the dump file, the 9418format is detected automatically and handled as appropriate. Unless 9419the \sphinxstylestrong{\sphinxhyphen{}update} option is given, \sphinxstylestrong{load} creates a new database 9420containing only the data in the dump file, overwriting the contents of 9421any previously existing database. Note that when using the LDAP KDC 9422database module, the \sphinxstylestrong{\sphinxhyphen{}update} flag is required. 9423 9424\sphinxAtStartPar 9425Options: 9426\begin{description} 9427\item[{\sphinxstylestrong{\sphinxhyphen{}b7}}] \leavevmode 9428\sphinxAtStartPar 9429requires the database to be in the Kerberos 5 Beta 7 format 9430(“kdb5\_util load\_dump version 4”). This was the dump format 9431produced on releases prior to 1.2.2. 9432 9433\item[{\sphinxstylestrong{\sphinxhyphen{}r13}}] \leavevmode 9434\sphinxAtStartPar 9435requires the database to be in Kerberos 5 1.3 format (“kdb5\_util 9436load\_dump version 5”). This was the dump format produced on 9437releases prior to 1.8. 9438 9439\item[{\sphinxstylestrong{\sphinxhyphen{}r18}}] \leavevmode 9440\sphinxAtStartPar 9441requires the database to be in Kerberos 5 1.8 format (“kdb5\_util 9442load\_dump version 6”). This was the dump format produced on 9443releases prior to 1.11. 9444 9445\item[{\sphinxstylestrong{\sphinxhyphen{}hash}}] \leavevmode 9446\sphinxAtStartPar 9447stores the database in hash format, if using the DB2 database 9448type. If this option is not specified, the database will be 9449stored in btree format. This option is not recommended, as 9450databases stored in hash format are known to corrupt data and lose 9451principals. 9452 9453\item[{\sphinxstylestrong{\sphinxhyphen{}verbose}}] \leavevmode 9454\sphinxAtStartPar 9455causes the name of each principal and policy to be printed as it 9456is dumped. 9457 9458\item[{\sphinxstylestrong{\sphinxhyphen{}update}}] \leavevmode 9459\sphinxAtStartPar 9460records from the dump file are added to or updated in the existing 9461database. Otherwise, a new database is created containing only 9462what is in the dump file and the old one destroyed upon successful 9463completion. 9464 9465\end{description} 9466 9467 9468\subsubsection{ark} 9469\label{\detokenize{admin/admin_commands/kdb5_util:ark}}\label{\detokenize{admin/admin_commands/kdb5_util:kdb5-util-load-end}}\begin{quote} 9470 9471\sphinxAtStartPar 9472\sphinxstylestrong{ark} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enc}:\sphinxstyleemphasis{salt},…{]} \sphinxstyleemphasis{principal} 9473\end{quote} 9474 9475\sphinxAtStartPar 9476Adds new random keys to \sphinxstyleemphasis{principal} at the next available key version 9477number. Keys for the current highest key version number will be 9478preserved. The \sphinxstylestrong{\sphinxhyphen{}e} option specifies the list of encryption and 9479salt types to be used for the new keys. 9480 9481 9482\subsubsection{add\_mkey} 9483\label{\detokenize{admin/admin_commands/kdb5_util:add-mkey}}\begin{quote} 9484 9485\sphinxAtStartPar 9486\sphinxstylestrong{add\_mkey} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{etype}{]} {[}\sphinxstylestrong{\sphinxhyphen{}s}{]} 9487\end{quote} 9488 9489\sphinxAtStartPar 9490Adds a new master key to the master key principal, but does not mark 9491it as active. Existing master keys will remain. The \sphinxstylestrong{\sphinxhyphen{}e} option 9492specifies the encryption type of the new master key; see 9493{\hyperref[\detokenize{admin/conf_files/kdc_conf:encryption-types}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} for a list of possible 9494values. The \sphinxstylestrong{\sphinxhyphen{}s} option stashes the new master key in the stash 9495file, which will be created if it doesn’t already exist. 9496 9497\sphinxAtStartPar 9498After a new master key is added, it should be propagated to replica 9499servers via a manual or periodic invocation of {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}. Then, 9500the stash files on the replica servers should be updated with the 9501kdb5\_util \sphinxstylestrong{stash} command. Once those steps are complete, the key 9502is ready to be marked active with the kdb5\_util \sphinxstylestrong{use\_mkey} command. 9503 9504 9505\subsubsection{use\_mkey} 9506\label{\detokenize{admin/admin_commands/kdb5_util:use-mkey}}\begin{quote} 9507 9508\sphinxAtStartPar 9509\sphinxstylestrong{use\_mkey} \sphinxstyleemphasis{mkeyVNO} {[}\sphinxstyleemphasis{time}{]} 9510\end{quote} 9511 9512\sphinxAtStartPar 9513Sets the activation time of the master key specified by \sphinxstyleemphasis{mkeyVNO}. 9514Once a master key becomes active, it will be used to encrypt newly 9515created principal keys. If no \sphinxstyleemphasis{time} argument is given, the current 9516time is used, causing the specified master key version to become 9517active immediately. The format for \sphinxstyleemphasis{time} is \DUrole{xref,std,std-ref}{getdate} string. 9518 9519\sphinxAtStartPar 9520After a new master key becomes active, the kdb5\_util 9521\sphinxstylestrong{update\_princ\_encryption} command can be used to update all 9522principal keys to be encrypted in the new master key. 9523 9524 9525\subsubsection{list\_mkeys} 9526\label{\detokenize{admin/admin_commands/kdb5_util:list-mkeys}}\begin{quote} 9527 9528\sphinxAtStartPar 9529\sphinxstylestrong{list\_mkeys} 9530\end{quote} 9531 9532\sphinxAtStartPar 9533List all master keys, from most recent to earliest, in the master key 9534principal. The output will show the kvno, enctype, and salt type for 9535each mkey, similar to the output of {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} \sphinxstylestrong{getprinc}. A 9536\sphinxcode{\sphinxupquote{*}} following an mkey denotes the currently active master key. 9537 9538 9539\subsubsection{purge\_mkeys} 9540\label{\detokenize{admin/admin_commands/kdb5_util:purge-mkeys}}\begin{quote} 9541 9542\sphinxAtStartPar 9543\sphinxstylestrong{purge\_mkeys} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}v}{]} 9544\end{quote} 9545 9546\sphinxAtStartPar 9547Delete master keys from the master key principal that are not used to 9548protect any principals. This command can be used to remove old master 9549keys all principal keys are protected by a newer master key. 9550\begin{description} 9551\item[{\sphinxstylestrong{\sphinxhyphen{}f}}] \leavevmode 9552\sphinxAtStartPar 9553does not prompt for confirmation. 9554 9555\item[{\sphinxstylestrong{\sphinxhyphen{}n}}] \leavevmode 9556\sphinxAtStartPar 9557performs a dry run, showing master keys that would be purged, but 9558not actually purging any keys. 9559 9560\item[{\sphinxstylestrong{\sphinxhyphen{}v}}] \leavevmode 9561\sphinxAtStartPar 9562gives more verbose output. 9563 9564\end{description} 9565 9566 9567\subsubsection{update\_princ\_encryption} 9568\label{\detokenize{admin/admin_commands/kdb5_util:update-princ-encryption}}\begin{quote} 9569 9570\sphinxAtStartPar 9571\sphinxstylestrong{update\_princ\_encryption} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}v}{]} 9572{[}\sphinxstyleemphasis{princ\sphinxhyphen{}pattern}{]} 9573\end{quote} 9574 9575\sphinxAtStartPar 9576Update all principal records (or only those matching the 9577\sphinxstyleemphasis{princ\sphinxhyphen{}pattern} glob pattern) to re\sphinxhyphen{}encrypt the key data using the 9578active database master key, if they are encrypted using a different 9579version, and give a count at the end of the number of principals 9580updated. If the \sphinxstylestrong{\sphinxhyphen{}f} option is not given, ask for confirmation 9581before starting to make changes. The \sphinxstylestrong{\sphinxhyphen{}v} option causes each 9582principal processed to be listed, with an indication as to whether it 9583needed updating or not. The \sphinxstylestrong{\sphinxhyphen{}n} option performs a dry run, only 9584showing the actions which would have been taken. 9585 9586 9587\subsubsection{tabdump} 9588\label{\detokenize{admin/admin_commands/kdb5_util:tabdump}}\begin{quote} 9589 9590\sphinxAtStartPar 9591\sphinxstylestrong{tabdump} {[}\sphinxstylestrong{\sphinxhyphen{}H}{]} {[}\sphinxstylestrong{\sphinxhyphen{}c}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e}{]} {[}\sphinxstylestrong{\sphinxhyphen{}n}{]} {[}\sphinxstylestrong{\sphinxhyphen{}o} \sphinxstyleemphasis{outfile}{]} 9592\sphinxstyleemphasis{dumptype} 9593\end{quote} 9594 9595\sphinxAtStartPar 9596Dump selected fields of the database in a tabular format suitable for 9597reporting (e.g., using traditional Unix text processing tools) or 9598importing into relational databases. The data format is tab\sphinxhyphen{}separated 9599(default), or optionally comma\sphinxhyphen{}separated (CSV), with a fixed number of 9600columns. The output begins with a header line containing field names, 9601unless suppression is requested using the \sphinxstylestrong{\sphinxhyphen{}H} option. 9602 9603\sphinxAtStartPar 9604The \sphinxstyleemphasis{dumptype} parameter specifies the name of an output table (see 9605below). 9606 9607\sphinxAtStartPar 9608Options: 9609\begin{description} 9610\item[{\sphinxstylestrong{\sphinxhyphen{}H}}] \leavevmode 9611\sphinxAtStartPar 9612suppress writing the field names in a header line 9613 9614\item[{\sphinxstylestrong{\sphinxhyphen{}c}}] \leavevmode 9615\sphinxAtStartPar 9616use comma separated values (CSV) format, with minimal quoting, 9617instead of the default tab\sphinxhyphen{}separated (unquoted, unescaped) format 9618 9619\item[{\sphinxstylestrong{\sphinxhyphen{}e}}] \leavevmode 9620\sphinxAtStartPar 9621write empty hexadecimal string fields as empty fields instead of 9622as “\sphinxhyphen{}1”. 9623 9624\item[{\sphinxstylestrong{\sphinxhyphen{}n}}] \leavevmode 9625\sphinxAtStartPar 9626produce numeric output for fields that normally have symbolic 9627output, such as enctypes and flag names. Also requests output of 9628time stamps as decimal POSIX time\_t values. 9629 9630\item[{\sphinxstylestrong{\sphinxhyphen{}o} \sphinxstyleemphasis{outfile}}] \leavevmode 9631\sphinxAtStartPar 9632write the dump to the specified output file instead of to standard 9633output 9634 9635\end{description} 9636 9637\sphinxAtStartPar 9638Dump types: 9639\begin{description} 9640\item[{\sphinxstylestrong{keydata}}] \leavevmode 9641\sphinxAtStartPar 9642principal encryption key information, including actual key data 9643(which is still encrypted in the master key) 9644\begin{description} 9645\item[{\sphinxstylestrong{name}}] \leavevmode 9646\sphinxAtStartPar 9647principal name 9648 9649\item[{\sphinxstylestrong{keyindex}}] \leavevmode 9650\sphinxAtStartPar 9651index of this key in the principal’s key list 9652 9653\item[{\sphinxstylestrong{kvno}}] \leavevmode 9654\sphinxAtStartPar 9655key version number 9656 9657\item[{\sphinxstylestrong{enctype}}] \leavevmode 9658\sphinxAtStartPar 9659encryption type 9660 9661\item[{\sphinxstylestrong{key}}] \leavevmode 9662\sphinxAtStartPar 9663key data as a hexadecimal string 9664 9665\item[{\sphinxstylestrong{salttype}}] \leavevmode 9666\sphinxAtStartPar 9667salt type 9668 9669\item[{\sphinxstylestrong{salt}}] \leavevmode 9670\sphinxAtStartPar 9671salt data as a hexadecimal string 9672 9673\end{description} 9674 9675\item[{\sphinxstylestrong{keyinfo}}] \leavevmode 9676\sphinxAtStartPar 9677principal encryption key information (as in \sphinxstylestrong{keydata} above), 9678excluding actual key data 9679 9680\item[{\sphinxstylestrong{princ\_flags}}] \leavevmode 9681\sphinxAtStartPar 9682principal boolean attributes. Flag names print as hexadecimal 9683numbers if the \sphinxstylestrong{\sphinxhyphen{}n} option is specified, and all flag positions 9684are printed regardless of whether or not they are set. If \sphinxstylestrong{\sphinxhyphen{}n} 9685is not specified, print all known flag names for each principal, 9686but only print hexadecimal flag names if the corresponding flag is 9687set. 9688\begin{description} 9689\item[{\sphinxstylestrong{name}}] \leavevmode 9690\sphinxAtStartPar 9691principal name 9692 9693\item[{\sphinxstylestrong{flag}}] \leavevmode 9694\sphinxAtStartPar 9695flag name 9696 9697\item[{\sphinxstylestrong{value}}] \leavevmode 9698\sphinxAtStartPar 9699boolean value (0 for clear, or 1 for set) 9700 9701\end{description} 9702 9703\item[{\sphinxstylestrong{princ\_lockout}}] \leavevmode 9704\sphinxAtStartPar 9705state information used for tracking repeated password failures 9706\begin{description} 9707\item[{\sphinxstylestrong{name}}] \leavevmode 9708\sphinxAtStartPar 9709principal name 9710 9711\item[{\sphinxstylestrong{last\_success}}] \leavevmode 9712\sphinxAtStartPar 9713time stamp of most recent successful authentication 9714 9715\item[{\sphinxstylestrong{last\_failed}}] \leavevmode 9716\sphinxAtStartPar 9717time stamp of most recent failed authentication 9718 9719\item[{\sphinxstylestrong{fail\_count}}] \leavevmode 9720\sphinxAtStartPar 9721count of failed attempts 9722 9723\end{description} 9724 9725\item[{\sphinxstylestrong{princ\_meta}}] \leavevmode 9726\sphinxAtStartPar 9727principal metadata 9728\begin{description} 9729\item[{\sphinxstylestrong{name}}] \leavevmode 9730\sphinxAtStartPar 9731principal name 9732 9733\item[{\sphinxstylestrong{modby}}] \leavevmode 9734\sphinxAtStartPar 9735name of last principal to modify this principal 9736 9737\item[{\sphinxstylestrong{modtime}}] \leavevmode 9738\sphinxAtStartPar 9739timestamp of last modification 9740 9741\item[{\sphinxstylestrong{lastpwd}}] \leavevmode 9742\sphinxAtStartPar 9743timestamp of last password change 9744 9745\item[{\sphinxstylestrong{policy}}] \leavevmode 9746\sphinxAtStartPar 9747policy object name 9748 9749\item[{\sphinxstylestrong{mkvno}}] \leavevmode 9750\sphinxAtStartPar 9751key version number of the master key that encrypts this 9752principal’s key data 9753 9754\item[{\sphinxstylestrong{hist\_kvno}}] \leavevmode 9755\sphinxAtStartPar 9756key version number of the history key that encrypts the key 9757history data for this principal 9758 9759\end{description} 9760 9761\item[{\sphinxstylestrong{princ\_stringattrs}}] \leavevmode 9762\sphinxAtStartPar 9763string attributes (key/value pairs) 9764\begin{description} 9765\item[{\sphinxstylestrong{name}}] \leavevmode 9766\sphinxAtStartPar 9767principal name 9768 9769\item[{\sphinxstylestrong{key}}] \leavevmode 9770\sphinxAtStartPar 9771attribute name 9772 9773\item[{\sphinxstylestrong{value}}] \leavevmode 9774\sphinxAtStartPar 9775attribute value 9776 9777\end{description} 9778 9779\item[{\sphinxstylestrong{princ\_tktpolicy}}] \leavevmode 9780\sphinxAtStartPar 9781per\sphinxhyphen{}principal ticket policy data, including maximum ticket 9782lifetimes 9783\begin{description} 9784\item[{\sphinxstylestrong{name}}] \leavevmode 9785\sphinxAtStartPar 9786principal name 9787 9788\item[{\sphinxstylestrong{expiration}}] \leavevmode 9789\sphinxAtStartPar 9790principal expiration date 9791 9792\item[{\sphinxstylestrong{pw\_expiration}}] \leavevmode 9793\sphinxAtStartPar 9794password expiration date 9795 9796\item[{\sphinxstylestrong{max\_life}}] \leavevmode 9797\sphinxAtStartPar 9798maximum ticket lifetime 9799 9800\item[{\sphinxstylestrong{max\_renew\_life}}] \leavevmode 9801\sphinxAtStartPar 9802maximum renewable ticket lifetime 9803 9804\end{description} 9805 9806\end{description} 9807 9808\sphinxAtStartPar 9809Examples: 9810 9811\begin{sphinxVerbatim}[commandchars=\\\{\}] 9812\PYGZdl{} kdb5\PYGZus{}util tabdump \PYGZhy{}o keyinfo.txt keyinfo 9813\PYGZdl{} cat keyinfo.txt 9814name keyindex kvno enctype salttype salt 9815K/M@EXAMPLE.COM 0 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 9816foo@EXAMPLE.COM 0 1 aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 normal \PYGZhy{}1 9817bar@EXAMPLE.COM 0 1 aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 normal \PYGZhy{}1 9818\PYGZdl{} sqlite3 9819sqlite\PYGZgt{} .mode tabs 9820sqlite\PYGZgt{} .import keyinfo.txt keyinfo 9821sqlite\PYGZgt{} select * from keyinfo where enctype like \PYGZsq{}aes256\PYGZhy{}\PYGZpc{}\PYGZsq{}; 9822K/M@EXAMPLE.COM 1 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 9823sqlite\PYGZgt{} .quit 9824\PYGZdl{} awk \PYGZhy{}F\PYGZsq{}\PYGZbs{}t\PYGZsq{} \PYGZsq{}\PYGZdl{}4 \PYGZti{} /aes256\PYGZhy{}/ \PYGZob{} print \PYGZcb{}\PYGZsq{} keyinfo.txt 9825K/M@EXAMPLE.COM 1 1 aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha384\PYGZhy{}192 normal \PYGZhy{}1 9826\end{sphinxVerbatim} 9827 9828 9829\subsection{ENVIRONMENT} 9830\label{\detokenize{admin/admin_commands/kdb5_util:environment}} 9831\sphinxAtStartPar 9832See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 9833variables. 9834 9835 9836\subsection{SEE ALSO} 9837\label{\detokenize{admin/admin_commands/kdb5_util:see-also}} 9838\sphinxAtStartPar 9839{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 9840 9841 9842\section{kdb5\_ldap\_util} 9843\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util::doc}} 9844 9845\subsection{SYNOPSIS} 9846\label{\detokenize{admin/admin_commands/kdb5_ldap_util:synopsis}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-synopsis}} 9847\sphinxAtStartPar 9848\sphinxstylestrong{kdb5\_ldap\_util} 9849{[}\sphinxstylestrong{\sphinxhyphen{}D} \sphinxstyleemphasis{user\_dn} {[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{passwd}{]}{]} 9850{[}\sphinxstylestrong{\sphinxhyphen{}H} \sphinxstyleemphasis{ldapuri}{]} 9851\sphinxstylestrong{command} 9852{[}\sphinxstyleemphasis{command\_options}{]} 9853 9854 9855\subsection{DESCRIPTION} 9856\label{\detokenize{admin/admin_commands/kdb5_ldap_util:description}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-synopsis-end}} 9857\sphinxAtStartPar 9858kdb5\_ldap\_util allows an administrator to manage realms, Kerberos 9859services and ticket policies. 9860 9861 9862\subsection{COMMAND\sphinxhyphen{}LINE OPTIONS} 9863\label{\detokenize{admin/admin_commands/kdb5_ldap_util:command-line-options}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-options}}\begin{description} 9864\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 9865\sphinxAtStartPar 9866Specifies the realm to be operated on. 9867 9868\item[{\sphinxstylestrong{\sphinxhyphen{}D} \sphinxstyleemphasis{user\_dn}}] \leavevmode 9869\sphinxAtStartPar 9870Specifies the Distinguished Name (DN) of the user who has 9871sufficient rights to perform the operation on the LDAP server. 9872 9873\item[{\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{passwd}}] \leavevmode 9874\sphinxAtStartPar 9875Specifies the password of \sphinxstyleemphasis{user\_dn}. This option is not 9876recommended. 9877 9878\item[{\sphinxstylestrong{\sphinxhyphen{}H} \sphinxstyleemphasis{ldapuri}}] \leavevmode 9879\sphinxAtStartPar 9880Specifies the URI of the LDAP server. 9881 9882\end{description} 9883 9884\sphinxAtStartPar 9885By default, kdb5\_ldap\_util operates on the default realm (as specified 9886in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}) and connects and authenticates to the LDAP 9887server in the same manner as :ref:kadmind(8)\textasciigrave{} would given the 9888parameters in {\hyperref[\detokenize{admin/conf_files/kdc_conf:dbdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}dbdefaults{]}}}}} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9889 9890 9891\subsection{COMMANDS} 9892\label{\detokenize{admin/admin_commands/kdb5_ldap_util:commands}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-options-end}} 9893 9894\subsubsection{create} 9895\label{\detokenize{admin/admin_commands/kdb5_ldap_util:create}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create}}\begin{quote} 9896 9897\sphinxAtStartPar 9898\sphinxstylestrong{create} 9899{[}\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}{]} 9900{[}\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}{]} 9901{[}\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}{]} 9902{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}{]} 9903{[}\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}{]} 9904{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} 9905{[}\sphinxstylestrong{\sphinxhyphen{}m|\sphinxhyphen{}P} \sphinxstyleemphasis{password}|\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}{]} 9906{[}\sphinxstylestrong{\sphinxhyphen{}s}{]} 9907{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} 9908{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} 9909{[}\sphinxstyleemphasis{ticket\_flags}{]} 9910\end{quote} 9911 9912\sphinxAtStartPar 9913Creates realm in directory. Options: 9914\begin{description} 9915\item[{\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}}] \leavevmode 9916\sphinxAtStartPar 9917Specifies the list of subtrees containing the principals of a 9918realm. The list contains the DNs of the subtree objects separated 9919by colon (\sphinxcode{\sphinxupquote{:}}). 9920 9921\item[{\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}}] \leavevmode 9922\sphinxAtStartPar 9923Specifies the scope for searching the principals under the 9924subtree. The possible values are 1 or one (one level), 2 or sub 9925(subtrees). 9926 9927\item[{\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}}] \leavevmode 9928\sphinxAtStartPar 9929Specifies the DN of the container object in which the principals 9930of a realm will be created. If the container reference is not 9931configured for a realm, the principals will be created in the 9932realm container. 9933 9934\item[{\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{mkeytype}}] \leavevmode 9935\sphinxAtStartPar 9936Specifies the key type of the master key in the database. The 9937default is given by the \sphinxstylestrong{master\_key\_type} variable in 9938{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9939 9940\item[{\sphinxstylestrong{\sphinxhyphen{}kv} \sphinxstyleemphasis{mkeyVNO}}] \leavevmode 9941\sphinxAtStartPar 9942Specifies the version number of the master key in the database; 9943the default is 1. Note that 0 is not allowed. 9944 9945\item[{\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}}] \leavevmode 9946\sphinxAtStartPar 9947Specifies the principal name for the master key in the database. 9948If not specified, the name is determined by the 9949\sphinxstylestrong{master\_key\_name} variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. 9950 9951\item[{\sphinxstylestrong{\sphinxhyphen{}m}}] \leavevmode 9952\sphinxAtStartPar 9953Specifies that the master database password should be read from 9954the TTY rather than fetched from a file on the disk. 9955 9956\item[{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{password}}] \leavevmode 9957\sphinxAtStartPar 9958Specifies the master database password. This option is not 9959recommended. 9960 9961\item[{\sphinxstylestrong{\sphinxhyphen{}sf} \sphinxstyleemphasis{stashfilename}}] \leavevmode 9962\sphinxAtStartPar 9963Specifies the stash file of the master database password. 9964 9965\item[{\sphinxstylestrong{\sphinxhyphen{}s}}] \leavevmode 9966\sphinxAtStartPar 9967Specifies that the stash file is to be created. 9968 9969\item[{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}}] \leavevmode 9970\sphinxAtStartPar 9971(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for 9972principals in this realm. 9973 9974\item[{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}}] \leavevmode 9975\sphinxAtStartPar 9976(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of 9977tickets for principals in this realm. 9978 9979\item[{\sphinxstyleemphasis{ticket\_flags}}] \leavevmode 9980\sphinxAtStartPar 9981Specifies global ticket flags for the realm. Allowable flags are 9982documented in the description of the \sphinxstylestrong{add\_principal} command in 9983{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. 9984 9985\end{description} 9986 9987\sphinxAtStartPar 9988Example: 9989 9990\begin{sphinxVerbatim}[commandchars=\\\{\}] 9991\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 9992 \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{create} \PYG{o}{\PYGZhy{}}\PYG{n}{subtrees} \PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{sscope} \PYG{n}{SUB} 9993\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 9994\PYG{n}{Initializing} \PYG{n}{database} \PYG{k}{for} \PYG{n}{realm} \PYG{l+s+s1}{\PYGZsq{}}\PYG{l+s+s1}{ATHENA.MIT.EDU}\PYG{l+s+s1}{\PYGZsq{}} 9995\PYG{n}{You} \PYG{n}{will} \PYG{n}{be} \PYG{n}{prompted} \PYG{k}{for} \PYG{n}{the} \PYG{n}{database} \PYG{n}{Master} \PYG{n}{Password}\PYG{o}{.} 9996\PYG{n}{It} \PYG{o+ow}{is} \PYG{n}{important} \PYG{n}{that} \PYG{n}{you} \PYG{n}{NOT} \PYG{n}{FORGET} \PYG{n}{this} \PYG{n}{password}\PYG{o}{.} 9997\PYG{n}{Enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key}\PYG{p}{:} 9998\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{KDC} \PYG{n}{database} \PYG{n}{master} \PYG{n}{key} \PYG{n}{to} \PYG{n}{verify}\PYG{p}{:} 9999\end{sphinxVerbatim} 10000 10001 10002\subsubsection{modify} 10003\label{\detokenize{admin/admin_commands/kdb5_ldap_util:modify}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify}}\begin{quote} 10004 10005\sphinxAtStartPar 10006\sphinxstylestrong{modify} 10007{[}\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}{]} 10008{[}\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}{]} 10009{[}\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn}{]} 10010{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} 10011{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} 10012{[}\sphinxstyleemphasis{ticket\_flags}{]} 10013\end{quote} 10014 10015\sphinxAtStartPar 10016Modifies the attributes of a realm. Options: 10017\begin{description} 10018\item[{\sphinxstylestrong{\sphinxhyphen{}subtrees} \sphinxstyleemphasis{subtree\_dn\_list}}] \leavevmode 10019\sphinxAtStartPar 10020Specifies the list of subtrees containing the principals of a 10021realm. The list contains the DNs of the subtree objects separated 10022by colon (\sphinxcode{\sphinxupquote{:}}). This list replaces the existing list. 10023 10024\item[{\sphinxstylestrong{\sphinxhyphen{}sscope} \sphinxstyleemphasis{search\_scope}}] \leavevmode 10025\sphinxAtStartPar 10026Specifies the scope for searching the principals under the 10027subtrees. The possible values are 1 or one (one level), 2 or sub 10028(subtrees). 10029 10030\item[{\sphinxstylestrong{\sphinxhyphen{}containerref} \sphinxstyleemphasis{container\_reference\_dn} Specifies the DN of the}] \leavevmode 10031\sphinxAtStartPar 10032container object in which the principals of a realm will be 10033created. 10034 10035\item[{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}}] \leavevmode 10036\sphinxAtStartPar 10037(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for 10038principals in this realm. 10039 10040\item[{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}}] \leavevmode 10041\sphinxAtStartPar 10042(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of 10043tickets for principals in this realm. 10044 10045\item[{\sphinxstyleemphasis{ticket\_flags}}] \leavevmode 10046\sphinxAtStartPar 10047Specifies global ticket flags for the realm. Allowable flags are 10048documented in the description of the \sphinxstylestrong{add\_principal} command in 10049{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. 10050 10051\end{description} 10052 10053\sphinxAtStartPar 10054Example: 10055 10056\begin{sphinxVerbatim}[commandchars=\\\{\}] 10057\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} 10058 \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n}{modify} \PYG{o}{+}\PYG{n}{requires\PYGZus{}preauth} 10059\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10060\PYG{n}{shell}\PYG{o}{\PYGZpc{}} 10061\end{sphinxVerbatim} 10062 10063 10064\subsubsection{view} 10065\label{\detokenize{admin/admin_commands/kdb5_ldap_util:view}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view}}\begin{quote} 10066 10067\sphinxAtStartPar 10068\sphinxstylestrong{view} 10069\end{quote} 10070 10071\sphinxAtStartPar 10072Displays the attributes of a realm. 10073 10074\sphinxAtStartPar 10075Example: 10076 10077\begin{sphinxVerbatim}[commandchars=\\\{\}] 10078\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 10079 \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{view} 10080\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10081\PYG{n}{Realm} \PYG{n}{Name}\PYG{p}{:} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 10082\PYG{n}{Subtree}\PYG{p}{:} \PYG{n}{ou}\PYG{o}{=}\PYG{n}{users}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} 10083\PYG{n}{Subtree}\PYG{p}{:} \PYG{n}{ou}\PYG{o}{=}\PYG{n}{servers}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} 10084\PYG{n}{SearchScope}\PYG{p}{:} \PYG{n}{ONE} 10085\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{01}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 10086\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 10087\PYG{n}{Ticket} \PYG{n}{flags}\PYG{p}{:} \PYG{n}{DISALLOW\PYGZus{}FORWARDABLE} \PYG{n}{REQUIRES\PYGZus{}PWCHANGE} 10088\end{sphinxVerbatim} 10089 10090 10091\subsubsection{destroy} 10092\label{\detokenize{admin/admin_commands/kdb5_ldap_util:destroy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy}}\begin{quote} 10093 10094\sphinxAtStartPar 10095\sphinxstylestrong{destroy} {[}\sphinxstylestrong{\sphinxhyphen{}f}{]} 10096\end{quote} 10097 10098\sphinxAtStartPar 10099Destroys an existing realm. Options: 10100\begin{description} 10101\item[{\sphinxstylestrong{\sphinxhyphen{}f}}] \leavevmode 10102\sphinxAtStartPar 10103If specified, will not prompt the user for confirmation. 10104 10105\end{description} 10106 10107\sphinxAtStartPar 10108Example: 10109 10110\begin{sphinxVerbatim}[commandchars=\\\{\}] 10111shell\PYGZpc{} kdb5\PYGZus{}ldap\PYGZus{}util \PYGZhy{}r ATHENA.MIT.EDU \PYGZhy{}D cn=admin,o=org \PYGZhy{}H 10112 ldaps://ldap\PYGZhy{}server1.mit.edu destroy 10113Password for \PYGZdq{}cn=admin,o=org\PYGZdq{}: 10114Deleting KDC database of \PYGZsq{}ATHENA.MIT.EDU\PYGZsq{}, are you sure? 10115(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes 10116OK, deleting database of \PYGZsq{}ATHENA.MIT.EDU\PYGZsq{}... 10117shell\PYGZpc{} 10118\end{sphinxVerbatim} 10119 10120 10121\subsubsection{list} 10122\label{\detokenize{admin/admin_commands/kdb5_ldap_util:list}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list}}\begin{quote} 10123 10124\sphinxAtStartPar 10125\sphinxstylestrong{list} 10126\end{quote} 10127 10128\sphinxAtStartPar 10129Lists the names of realms under the container. 10130 10131\sphinxAtStartPar 10132Example: 10133 10134\begin{sphinxVerbatim}[commandchars=\\\{\}] 10135\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} 10136 \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{n+nb}{list} 10137\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10138\PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 10139\PYG{n}{OPENLDAP}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 10140\PYG{n}{MEDIA}\PYG{o}{\PYGZhy{}}\PYG{n}{LAB}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 10141\PYG{n}{shell}\PYG{o}{\PYGZpc{}} 10142\end{sphinxVerbatim} 10143 10144 10145\subsubsection{stashsrvpw} 10146\label{\detokenize{admin/admin_commands/kdb5_ldap_util:stashsrvpw}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-stashsrvpw}}\begin{quote} 10147 10148\sphinxAtStartPar 10149\sphinxstylestrong{stashsrvpw} 10150{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}{]} 10151\sphinxstyleemphasis{name} 10152\end{quote} 10153 10154\sphinxAtStartPar 10155Allows an administrator to store the password for service object in a 10156file so that KDC and Administration server can use it to authenticate 10157to the LDAP server. Options: 10158\begin{description} 10159\item[{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}}] \leavevmode 10160\sphinxAtStartPar 10161Specifies the complete path of the service password file. By 10162default, \sphinxcode{\sphinxupquote{/usr/local/var/service\_passwd}} is used. 10163 10164\item[{\sphinxstyleemphasis{name}}] \leavevmode 10165\sphinxAtStartPar 10166Specifies the name of the object whose password is to be stored. 10167If {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}} or {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} are configured for 10168simple binding, this should be the distinguished name it will 10169use as given by the \sphinxstylestrong{ldap\_kdc\_dn} or \sphinxstylestrong{ldap\_kadmind\_dn} 10170variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. If the KDC or kadmind is 10171configured for SASL binding, this should be the authentication 10172name it will use as given by the \sphinxstylestrong{ldap\_kdc\_sasl\_authcid} or 10173\sphinxstylestrong{ldap\_kadmind\_sasl\_authcid} variable. 10174 10175\end{description} 10176 10177\sphinxAtStartPar 10178Example: 10179 10180\begin{sphinxVerbatim}[commandchars=\\\{\}] 10181\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{n}{stashsrvpw} \PYG{o}{\PYGZhy{}}\PYG{n}{f} \PYG{o}{/}\PYG{n}{home}\PYG{o}{/}\PYG{n}{andrew}\PYG{o}{/}\PYG{n}{conf\PYGZus{}keyfile} 10182 \PYG{n}{cn}\PYG{o}{=}\PYG{n}{service}\PYG{o}{\PYGZhy{}}\PYG{n}{kdc}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} 10183\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=service\PYGZhy{}kdc,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10184\PYG{n}{Re}\PYG{o}{\PYGZhy{}}\PYG{n}{enter} \PYG{n}{password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=service\PYGZhy{}kdc,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10185\end{sphinxVerbatim} 10186 10187 10188\subsubsection{create\_policy} 10189\label{\detokenize{admin/admin_commands/kdb5_ldap_util:create-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-stashsrvpw-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-policy}}\begin{quote} 10190 10191\sphinxAtStartPar 10192\sphinxstylestrong{create\_policy} 10193{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} 10194{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} 10195{[}\sphinxstyleemphasis{ticket\_flags}{]} 10196\sphinxstyleemphasis{policy\_name} 10197\end{quote} 10198 10199\sphinxAtStartPar 10200Creates a ticket policy in the directory. Options: 10201\begin{description} 10202\item[{\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}}] \leavevmode 10203\sphinxAtStartPar 10204(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum ticket life for 10205principals. 10206 10207\item[{\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}}] \leavevmode 10208\sphinxAtStartPar 10209(\DUrole{xref,std,std-ref}{getdate} string) Specifies maximum renewable life of 10210tickets for principals. 10211 10212\item[{\sphinxstyleemphasis{ticket\_flags}}] \leavevmode 10213\sphinxAtStartPar 10214Specifies the ticket flags. If this option is not specified, by 10215default, no restriction will be set by the policy. Allowable 10216flags are documented in the description of the \sphinxstylestrong{add\_principal} 10217command in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. 10218 10219\item[{\sphinxstyleemphasis{policy\_name}}] \leavevmode 10220\sphinxAtStartPar 10221Specifies the name of the ticket policy. 10222 10223\end{description} 10224 10225\sphinxAtStartPar 10226Example: 10227 10228\begin{sphinxVerbatim}[commandchars=\\\{\}] 10229\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 10230 \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{create\PYGZus{}policy} \PYG{o}{\PYGZhy{}}\PYG{n}{maxtktlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 day}\PYG{l+s+s2}{\PYGZdq{}} 10231 \PYG{o}{\PYGZhy{}}\PYG{n}{maxrenewlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{1 week}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}postdated} \PYG{o}{+}\PYG{n}{needchange} 10232 \PYG{o}{\PYGZhy{}}\PYG{n}{allow\PYGZus{}forwardable} \PYG{n}{tktpolicy} 10233\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10234\end{sphinxVerbatim} 10235 10236 10237\subsubsection{modify\_policy} 10238\label{\detokenize{admin/admin_commands/kdb5_ldap_util:modify-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-create-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-policy}}\begin{quote} 10239 10240\sphinxAtStartPar 10241\sphinxstylestrong{modify\_policy} 10242{[}\sphinxstylestrong{\sphinxhyphen{}maxtktlife} \sphinxstyleemphasis{max\_ticket\_life}{]} 10243{[}\sphinxstylestrong{\sphinxhyphen{}maxrenewlife} \sphinxstyleemphasis{max\_renewable\_ticket\_life}{]} 10244{[}\sphinxstyleemphasis{ticket\_flags}{]} 10245\sphinxstyleemphasis{policy\_name} 10246\end{quote} 10247 10248\sphinxAtStartPar 10249Modifies the attributes of a ticket policy. Options are same as for 10250\sphinxstylestrong{create\_policy}. 10251 10252\sphinxAtStartPar 10253Example: 10254 10255\begin{sphinxVerbatim}[commandchars=\\\{\}] 10256\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} 10257 \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{modify\PYGZus{}policy} 10258 \PYG{o}{\PYGZhy{}}\PYG{n}{maxtktlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{60 minutes}\PYG{l+s+s2}{\PYGZdq{}} \PYG{o}{\PYGZhy{}}\PYG{n}{maxrenewlife} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{10 hours}\PYG{l+s+s2}{\PYGZdq{}} 10259 \PYG{o}{+}\PYG{n}{allow\PYGZus{}postdated} \PYG{o}{\PYGZhy{}}\PYG{n}{requires\PYGZus{}preauth} \PYG{n}{tktpolicy} 10260\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10261\end{sphinxVerbatim} 10262 10263 10264\subsubsection{view\_policy} 10265\label{\detokenize{admin/admin_commands/kdb5_ldap_util:view-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-modify-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-policy}}\begin{quote} 10266 10267\sphinxAtStartPar 10268\sphinxstylestrong{view\_policy} 10269\sphinxstyleemphasis{policy\_name} 10270\end{quote} 10271 10272\sphinxAtStartPar 10273Displays the attributes of the named ticket policy. 10274 10275\sphinxAtStartPar 10276Example: 10277 10278\begin{sphinxVerbatim}[commandchars=\\\{\}] 10279\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 10280 \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{view\PYGZus{}policy} \PYG{n}{tktpolicy} 10281\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10282\PYG{n}{Ticket} \PYG{n}{policy}\PYG{p}{:} \PYG{n}{tktpolicy} 10283\PYG{n}{Maximum} \PYG{n}{ticket} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{01}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 10284\PYG{n}{Maximum} \PYG{n}{renewable} \PYG{n}{life}\PYG{p}{:} \PYG{l+m+mi}{0} \PYG{n}{days} \PYG{l+m+mi}{10}\PYG{p}{:}\PYG{l+m+mi}{00}\PYG{p}{:}\PYG{l+m+mi}{00} 10285\PYG{n}{Ticket} \PYG{n}{flags}\PYG{p}{:} \PYG{n}{DISALLOW\PYGZus{}FORWARDABLE} \PYG{n}{REQUIRES\PYGZus{}PWCHANGE} 10286\end{sphinxVerbatim} 10287 10288 10289\subsubsection{destroy\_policy} 10290\label{\detokenize{admin/admin_commands/kdb5_ldap_util:destroy-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-view-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-policy}}\begin{quote} 10291 10292\sphinxAtStartPar 10293\sphinxstylestrong{destroy\_policy} 10294{[}\sphinxstylestrong{\sphinxhyphen{}force}{]} 10295\sphinxstyleemphasis{policy\_name} 10296\end{quote} 10297 10298\sphinxAtStartPar 10299Destroys an existing ticket policy. Options: 10300\begin{description} 10301\item[{\sphinxstylestrong{\sphinxhyphen{}force}}] \leavevmode 10302\sphinxAtStartPar 10303Forces the deletion of the policy object. If not specified, the 10304user will be prompted for confirmation before deleting the policy. 10305 10306\item[{\sphinxstyleemphasis{policy\_name}}] \leavevmode 10307\sphinxAtStartPar 10308Specifies the name of the ticket policy. 10309 10310\end{description} 10311 10312\sphinxAtStartPar 10313Example: 10314 10315\begin{sphinxVerbatim}[commandchars=\\\{\}] 10316kdb5\PYGZus{}ldap\PYGZus{}util \PYGZhy{}D cn=admin,o=org \PYGZhy{}H ldaps://ldap\PYGZhy{}server1.mit.edu 10317 \PYGZhy{}r ATHENA.MIT.EDU destroy\PYGZus{}policy tktpolicy 10318Password for \PYGZdq{}cn=admin,o=org\PYGZdq{}: 10319This will delete the policy object \PYGZsq{}tktpolicy\PYGZsq{}, are you sure? 10320(type \PYGZsq{}yes\PYGZsq{} to confirm)? yes 10321** policy object \PYGZsq{}tktpolicy\PYGZsq{} deleted. 10322\end{sphinxVerbatim} 10323 10324 10325\subsubsection{list\_policy} 10326\label{\detokenize{admin/admin_commands/kdb5_ldap_util:list-policy}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-destroy-policy-end}}\phantomsection\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-policy}}\begin{quote} 10327 10328\sphinxAtStartPar 10329\sphinxstylestrong{list\_policy} 10330\end{quote} 10331 10332\sphinxAtStartPar 10333Lists ticket policies. 10334 10335\sphinxAtStartPar 10336Example: 10337 10338\begin{sphinxVerbatim}[commandchars=\\\{\}] 10339\PYG{n}{kdb5\PYGZus{}ldap\PYGZus{}util} \PYG{o}{\PYGZhy{}}\PYG{n}{D} \PYG{n}{cn}\PYG{o}{=}\PYG{n}{admin}\PYG{p}{,}\PYG{n}{o}\PYG{o}{=}\PYG{n}{org} \PYG{o}{\PYGZhy{}}\PYG{n}{H} \PYG{n}{ldaps}\PYG{p}{:}\PYG{o}{/}\PYG{o}{/}\PYG{n}{ldap}\PYG{o}{\PYGZhy{}}\PYG{n}{server1}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu} 10340 \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{n}{list\PYGZus{}policy} 10341\PYG{n}{Password} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{cn=admin,o=org}\PYG{l+s+s2}{\PYGZdq{}}\PYG{p}{:} 10342\PYG{n}{tktpolicy} 10343\PYG{n}{tmppolicy} 10344\PYG{n}{userpolicy} 10345\end{sphinxVerbatim} 10346 10347 10348\subsection{ENVIRONMENT} 10349\label{\detokenize{admin/admin_commands/kdb5_ldap_util:environment}}\label{\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-list-policy-end}} 10350\sphinxAtStartPar 10351See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10352variables. 10353 10354 10355\subsection{SEE ALSO} 10356\label{\detokenize{admin/admin_commands/kdb5_ldap_util:see-also}} 10357\sphinxAtStartPar 10358{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 10359 10360 10361\section{krb5kdc} 10362\label{\detokenize{admin/admin_commands/krb5kdc:krb5kdc}}\label{\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}}\label{\detokenize{admin/admin_commands/krb5kdc::doc}} 10363 10364\subsection{SYNOPSIS} 10365\label{\detokenize{admin/admin_commands/krb5kdc:synopsis}} 10366\sphinxAtStartPar 10367\sphinxstylestrong{krb5kdc} 10368{[}\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}{]} 10369{[}\sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname}{]} 10370{[}\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytype}{]} 10371{[}\sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname}{]} 10372{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{portnum}{]} 10373{[}\sphinxstylestrong{\sphinxhyphen{}m}{]} 10374{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 10375{[}\sphinxstylestrong{\sphinxhyphen{}n}{]} 10376{[}\sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{numworkers}{]} 10377{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file}{]} 10378{[}\sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{time\_offset}{]} 10379 10380 10381\subsection{DESCRIPTION} 10382\label{\detokenize{admin/admin_commands/krb5kdc:description}} 10383\sphinxAtStartPar 10384krb5kdc is the Kerberos version 5 Authentication Service and Key 10385Distribution Center (AS/KDC). 10386 10387 10388\subsection{OPTIONS} 10389\label{\detokenize{admin/admin_commands/krb5kdc:options}} 10390\sphinxAtStartPar 10391The \sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm} option specifies the realm for which the server 10392should provide service. This option may be specified multiple times 10393to serve multiple realms. If no \sphinxstylestrong{\sphinxhyphen{}r} option is given, the default 10394realm (as specified in {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}) will be served. 10395 10396\sphinxAtStartPar 10397The \sphinxstylestrong{\sphinxhyphen{}d} \sphinxstyleemphasis{dbname} option specifies the name under which the 10398principal database can be found. This option does not apply to the 10399LDAP database. 10400 10401\sphinxAtStartPar 10402The \sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{keytype} option specifies the key type of the master key 10403to be entered manually as a password when \sphinxstylestrong{\sphinxhyphen{}m} is given; the default 10404is \sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}}. 10405 10406\sphinxAtStartPar 10407The \sphinxstylestrong{\sphinxhyphen{}M} \sphinxstyleemphasis{mkeyname} option specifies the principal name for the 10408master key in the database (usually \sphinxcode{\sphinxupquote{K/M}} in the KDC’s realm). 10409 10410\sphinxAtStartPar 10411The \sphinxstylestrong{\sphinxhyphen{}m} option specifies that the master database password should 10412be fetched from the keyboard rather than from a stash file. 10413 10414\sphinxAtStartPar 10415The \sphinxstylestrong{\sphinxhyphen{}n} option specifies that the KDC does not put itself in the 10416background and does not disassociate itself from the terminal. 10417 10418\sphinxAtStartPar 10419The \sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{pid\_file} option tells the KDC to write its PID into 10420\sphinxstyleemphasis{pid\_file} after it starts up. This can be used to identify whether 10421the KDC is still running and to allow init scripts to stop the correct 10422process. 10423 10424\sphinxAtStartPar 10425The \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{portnum} option specifies the default UDP and TCP port 10426numbers which the KDC should listen on for Kerberos version 5 10427requests, as a comma\sphinxhyphen{}separated list. This value overrides the port 10428numbers specified in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdcdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}kdcdefaults{]}}}}} section of 10429{\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, but may be overridden by realm\sphinxhyphen{}specific values. 10430If no value is given from any source, the default port is 88. 10431 10432\sphinxAtStartPar 10433The \sphinxstylestrong{\sphinxhyphen{}w} \sphinxstyleemphasis{numworkers} option tells the KDC to fork \sphinxstyleemphasis{numworkers} 10434processes to listen to the KDC ports and process requests in parallel. 10435The top level KDC process (whose pid is recorded in the pid file if 10436the \sphinxstylestrong{\sphinxhyphen{}P} option is also given) acts as a supervisor. The supervisor 10437will relay SIGHUP signals to the worker subprocesses, and will 10438terminate the worker subprocess if the it is itself terminated or if 10439any other worker process exits. 10440 10441\sphinxAtStartPar 10442The \sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args} option specifies database\sphinxhyphen{}specific arguments. 10443See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for 10444supported arguments. 10445 10446\sphinxAtStartPar 10447The \sphinxstylestrong{\sphinxhyphen{}T} \sphinxstyleemphasis{offset} option specifies a time offset, in seconds, which 10448the KDC will operate under. It is intended only for testing purposes. 10449 10450 10451\subsection{EXAMPLE} 10452\label{\detokenize{admin/admin_commands/krb5kdc:example}} 10453\sphinxAtStartPar 10454The KDC may service requests for multiple realms (maximum 32 realms). 10455The realms are listed on the command line. Per\sphinxhyphen{}realm options that can 10456be specified on the command line pertain for each realm that follows 10457it and are superseded by subsequent definitions of the same option. 10458 10459\sphinxAtStartPar 10460For example: 10461 10462\begin{sphinxVerbatim}[commandchars=\\\{\}] 10463\PYG{n}{krb5kdc} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{l+m+mi}{2001} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM1} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{l+m+mi}{2002} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM2} \PYG{o}{\PYGZhy{}}\PYG{n}{r} \PYG{n}{REALM3} 10464\end{sphinxVerbatim} 10465 10466\sphinxAtStartPar 10467specifies that the KDC listen on port 2001 for REALM1 and on port 2002 10468for REALM2 and REALM3. Additionally, per\sphinxhyphen{}realm parameters may be 10469specified in the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} file. The location of this file 10470may be specified by the \sphinxstylestrong{KRB5\_KDC\_PROFILE} environment variable. 10471Per\sphinxhyphen{}realm parameters specified in this file take precedence over 10472options specified on the command line. See the {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} 10473description for further details. 10474 10475 10476\subsection{ENVIRONMENT} 10477\label{\detokenize{admin/admin_commands/krb5kdc:environment}} 10478\sphinxAtStartPar 10479See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10480variables. 10481 10482 10483\subsection{SEE ALSO} 10484\label{\detokenize{admin/admin_commands/krb5kdc:see-also}} 10485\sphinxAtStartPar 10486{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}, {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}, 10487{\hyperref[\detokenize{admin/admin_commands/kdb5_ldap_util:kdb5-ldap-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_ldap\_util}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 10488 10489 10490\section{kprop} 10491\label{\detokenize{admin/admin_commands/kprop:kprop}}\label{\detokenize{admin/admin_commands/kprop:kprop-8}}\label{\detokenize{admin/admin_commands/kprop::doc}} 10492 10493\subsection{SYNOPSIS} 10494\label{\detokenize{admin/admin_commands/kprop:synopsis}} 10495\sphinxAtStartPar 10496\sphinxstylestrong{kprop} 10497{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 10498{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}{]} 10499{[}\sphinxstylestrong{\sphinxhyphen{}d}{]} 10500{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}{]} 10501{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab}{]} 10502\sphinxstyleemphasis{replica\_host} 10503 10504 10505\subsection{DESCRIPTION} 10506\label{\detokenize{admin/admin_commands/kprop:description}} 10507\sphinxAtStartPar 10508kprop is used to securely propagate a Kerberos V5 database dump file 10509from the primary Kerberos server to a replica Kerberos server, which is 10510specified by \sphinxstyleemphasis{replica\_host}. The dump file must be created by 10511{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}. 10512 10513 10514\subsection{OPTIONS} 10515\label{\detokenize{admin/admin_commands/kprop:options}}\begin{description} 10516\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 10517\sphinxAtStartPar 10518Specifies the realm of the primary server. 10519 10520\item[{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}}] \leavevmode 10521\sphinxAtStartPar 10522Specifies the filename where the dumped principal database file is 10523to be found; by default the dumped database file is normally 10524{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans}}. 10525 10526\item[{\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}}] \leavevmode 10527\sphinxAtStartPar 10528Specifies the port to use to contact the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} server 10529on the remote host. 10530 10531\item[{\sphinxstylestrong{\sphinxhyphen{}d}}] \leavevmode 10532\sphinxAtStartPar 10533Prints debugging information. 10534 10535\item[{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab}}] \leavevmode 10536\sphinxAtStartPar 10537Specifies the location of the keytab file. 10538 10539\end{description} 10540 10541 10542\subsection{ENVIRONMENT} 10543\label{\detokenize{admin/admin_commands/kprop:environment}} 10544\sphinxAtStartPar 10545See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10546variables. 10547 10548 10549\subsection{SEE ALSO} 10550\label{\detokenize{admin/admin_commands/kprop:see-also}} 10551\sphinxAtStartPar 10552{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, 10553\DUrole{xref,std,std-ref}{kerberos(7)} 10554 10555 10556\section{kpropd} 10557\label{\detokenize{admin/admin_commands/kpropd:kpropd}}\label{\detokenize{admin/admin_commands/kpropd:kpropd-8}}\label{\detokenize{admin/admin_commands/kpropd::doc}} 10558 10559\subsection{SYNOPSIS} 10560\label{\detokenize{admin/admin_commands/kpropd:synopsis}} 10561\sphinxAtStartPar 10562\sphinxstylestrong{kpropd} 10563{[}\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}{]} 10564{[}\sphinxstylestrong{\sphinxhyphen{}A} \sphinxstyleemphasis{admin\_server}{]} 10565{[}\sphinxstylestrong{\sphinxhyphen{}a} \sphinxstyleemphasis{acl\_file}{]} 10566{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{replica\_dumpfile}{]} 10567{[}\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{principal\_database}{]} 10568{[}\sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{kdb5\_util\_prog}{]} 10569{[}\sphinxstylestrong{\sphinxhyphen{}P} \sphinxstyleemphasis{port}{]} 10570{[}\sphinxstylestrong{\textendash{}pid\sphinxhyphen{}file}=\sphinxstyleemphasis{pid\_file}{]} 10571{[}\sphinxstylestrong{\sphinxhyphen{}D}{]} 10572{[}\sphinxstylestrong{\sphinxhyphen{}d}{]} 10573{[}\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab\_file}{]} 10574 10575 10576\subsection{DESCRIPTION} 10577\label{\detokenize{admin/admin_commands/kpropd:description}} 10578\sphinxAtStartPar 10579The \sphinxstyleemphasis{kpropd} command runs on the replica KDC server. It listens for 10580update requests made by the {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} program. If incremental 10581propagation is enabled, it periodically requests incremental updates 10582from the primary KDC. 10583 10584\sphinxAtStartPar 10585When the replica receives a kprop request from the primary, kpropd 10586accepts the dumped KDC database and places it in a file, and then runs 10587{\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} to load the dumped database into the active 10588database which is used by {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}. This allows the primary 10589Kerberos server to use {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} to propagate its database to 10590the replica servers. Upon a successful download of the KDC database 10591file, the replica Kerberos server will have an up\sphinxhyphen{}to\sphinxhyphen{}date KDC 10592database. 10593 10594\sphinxAtStartPar 10595Where incremental propagation is not used, kpropd is commonly invoked 10596out of inetd(8) as a nowait service. This is done by adding a line to 10597the \sphinxcode{\sphinxupquote{/etc/inetd.conf}} file which looks like this: 10598 10599\begin{sphinxVerbatim}[commandchars=\\\{\}] 10600\PYG{n}{kprop} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{kpropd} \PYG{n}{kpropd} 10601\end{sphinxVerbatim} 10602 10603\sphinxAtStartPar 10604kpropd can also run as a standalone daemon, backgrounding itself and 10605waiting for connections on port 754 (or the port specified with the 10606\sphinxstylestrong{\sphinxhyphen{}P} option if given). Standalone mode is required for incremental 10607propagation. Starting in release 1.11, kpropd automatically detects 10608whether it was run from inetd and runs in standalone mode if it is 10609not. Prior to release 1.11, the \sphinxstylestrong{\sphinxhyphen{}S} option is required to run 10610kpropd in standalone mode; this option is now accepted for backward 10611compatibility but does nothing. 10612 10613\sphinxAtStartPar 10614Incremental propagation may be enabled with the \sphinxstylestrong{iprop\_enable} 10615variable in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}}. If incremental propagation is 10616enabled, the replica periodically polls the primary KDC for updates, at 10617an interval determined by the \sphinxstylestrong{iprop\_replica\_poll} variable. If the 10618replica receives updates, kpropd updates its log file with any updates 10619from the primary. {\hyperref[\detokenize{admin/admin_commands/kproplog:kproplog-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kproplog}}}} can be used to view a summary of 10620the update entry log on the replica KDC. If incremental propagation 10621is enabled, the principal \sphinxcode{\sphinxupquote{kiprop/replicahostname@REALM}} (where 10622\sphinxstyleemphasis{replicahostname} is the name of the replica KDC host, and \sphinxstyleemphasis{REALM} is 10623the name of the Kerberos realm) must be present in the replica’s 10624keytab file. 10625 10626\sphinxAtStartPar 10627{\hyperref[\detokenize{admin/admin_commands/kproplog:kproplog-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kproplog}}}} can be used to force full replication when iprop is 10628enabled. 10629 10630 10631\subsection{OPTIONS} 10632\label{\detokenize{admin/admin_commands/kpropd:options}}\begin{description} 10633\item[{\sphinxstylestrong{\sphinxhyphen{}r} \sphinxstyleemphasis{realm}}] \leavevmode 10634\sphinxAtStartPar 10635Specifies the realm of the primary server. 10636 10637\item[{\sphinxstylestrong{\sphinxhyphen{}A} \sphinxstyleemphasis{admin\_server}}] \leavevmode 10638\sphinxAtStartPar 10639Specifies the server to be contacted for incremental updates; by 10640default, the primary admin server is contacted. 10641 10642\item[{\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{file}}] \leavevmode 10643\sphinxAtStartPar 10644Specifies the filename where the dumped principal database file is 10645to be stored; by default the dumped database file is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/from\_master}}. 10646 10647\item[{\sphinxstylestrong{\sphinxhyphen{}F} \sphinxstyleemphasis{kerberos\_db}}] \leavevmode 10648\sphinxAtStartPar 10649Path to the Kerberos database file, if not the default. 10650 10651\item[{\sphinxstylestrong{\sphinxhyphen{}p}}] \leavevmode 10652\sphinxAtStartPar 10653Allows the user to specify the pathname to the {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}} 10654program; by default the pathname used is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kdb5\_util}}. 10655 10656\item[{\sphinxstylestrong{\sphinxhyphen{}D}}] \leavevmode 10657\sphinxAtStartPar 10658In this mode, kpropd will not detach itself from the current job 10659and run in the background. Instead, it will run in the 10660foreground. 10661 10662\item[{\sphinxstylestrong{\sphinxhyphen{}d}}] \leavevmode 10663\sphinxAtStartPar 10664Turn on debug mode. kpropd will print out debugging messages 10665during the database propogation and will run in the foreground 10666(implies \sphinxstylestrong{\sphinxhyphen{}D}). 10667 10668\item[{\sphinxstylestrong{\sphinxhyphen{}P}}] \leavevmode 10669\sphinxAtStartPar 10670Allow for an alternate port number for kpropd to listen on. This 10671is only useful in combination with the \sphinxstylestrong{\sphinxhyphen{}S} option. 10672 10673\item[{\sphinxstylestrong{\sphinxhyphen{}a} \sphinxstyleemphasis{acl\_file}}] \leavevmode 10674\sphinxAtStartPar 10675Allows the user to specify the path to the kpropd.acl file; by 10676default the path used is {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kpropd.acl}}. 10677 10678\item[{\sphinxstylestrong{\textendash{}pid\sphinxhyphen{}file}=\sphinxstyleemphasis{pid\_file}}] \leavevmode 10679\sphinxAtStartPar 10680In standalone mode, write the process ID of the daemon into 10681\sphinxstyleemphasis{pid\_file}. 10682 10683\item[{\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{keytab\_file}}] \leavevmode 10684\sphinxAtStartPar 10685Path to a keytab to use for acquiring acceptor credentials. 10686 10687\item[{\sphinxstylestrong{\sphinxhyphen{}x} \sphinxstyleemphasis{db\_args}}] \leavevmode 10688\sphinxAtStartPar 10689Database\sphinxhyphen{}specific arguments. See {\hyperref[\detokenize{admin/admin_commands/kadmin_local:dboptions}]{\sphinxcrossref{\DUrole{std,std-ref}{Database Options}}}} in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} for supported arguments. 10690 10691\end{description} 10692 10693 10694\subsection{FILES} 10695\label{\detokenize{admin/admin_commands/kpropd:files}}\begin{description} 10696\item[{kpropd.acl}] \leavevmode 10697\sphinxAtStartPar 10698Access file for kpropd; the default location is 10699\sphinxcode{\sphinxupquote{/usr/local/var/krb5kdc/kpropd.acl}}. Each entry is a line 10700containing the principal of a host from which the local machine 10701will allow Kerberos database propagation via {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}. 10702 10703\end{description} 10704 10705 10706\subsection{ENVIRONMENT} 10707\label{\detokenize{admin/admin_commands/kpropd:environment}} 10708\sphinxAtStartPar 10709See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10710variables. 10711 10712 10713\subsection{SEE ALSO} 10714\label{\detokenize{admin/admin_commands/kpropd:see-also}} 10715\sphinxAtStartPar 10716{\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, {\hyperref[\detokenize{admin/admin_commands/krb5kdc:krb5kdc-8}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5kdc}}}}, 10717\DUrole{xref,std,std-ref}{kerberos(7)}, inetd(8) 10718 10719 10720\section{kproplog} 10721\label{\detokenize{admin/admin_commands/kproplog:kproplog}}\label{\detokenize{admin/admin_commands/kproplog:kproplog-8}}\label{\detokenize{admin/admin_commands/kproplog::doc}} 10722 10723\subsection{SYNOPSIS} 10724\label{\detokenize{admin/admin_commands/kproplog:synopsis}} 10725\sphinxAtStartPar 10726\sphinxstylestrong{kproplog} {[}\sphinxstylestrong{\sphinxhyphen{}h}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{num}{]} {[}\sphinxhyphen{}v{]} 10727\sphinxstylestrong{kproplog} {[}\sphinxhyphen{}R{]} 10728 10729 10730\subsection{DESCRIPTION} 10731\label{\detokenize{admin/admin_commands/kproplog:description}} 10732\sphinxAtStartPar 10733The kproplog command displays the contents of the KDC database update 10734log to standard output. It can be used to keep track of incremental 10735updates to the principal database. The update log file contains the 10736update log maintained by the {\hyperref[\detokenize{admin/admin_commands/kadmind:kadmind-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmind}}}} process on the primary 10737KDC server and the {\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} process on the replica KDC 10738servers. When updates occur, they are logged to this file. 10739Subsequently any KDC replica configured for incremental updates will 10740request the current data from the primary KDC and update their log 10741file with any updates returned. 10742 10743\sphinxAtStartPar 10744The kproplog command requires read access to the update log file. It 10745will display update entries only for the KDC it runs on. 10746 10747\sphinxAtStartPar 10748If no options are specified, kproplog displays a summary of the update 10749log. If invoked on the primary, kproplog also displays all of the 10750update entries. If invoked on a replica KDC server, kproplog displays 10751only a summary of the updates, which includes the serial number of the 10752last update received and the associated time stamp of the last update. 10753 10754 10755\subsection{OPTIONS} 10756\label{\detokenize{admin/admin_commands/kproplog:options}}\begin{description} 10757\item[{\sphinxstylestrong{\sphinxhyphen{}R}}] \leavevmode 10758\sphinxAtStartPar 10759Reset the update log. This forces full resynchronization. If 10760used on a replica then that replica will request a full resync. 10761If used on the primary then all replicas will request full 10762resyncs. 10763 10764\item[{\sphinxstylestrong{\sphinxhyphen{}h}}] \leavevmode 10765\sphinxAtStartPar 10766Display a summary of the update log. This information includes 10767the database version number, state of the database, the number of 10768updates in the log, the time stamp of the first and last update, 10769and the version number of the first and last update entry. 10770 10771\item[{\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{num}}] \leavevmode 10772\sphinxAtStartPar 10773Display the last \sphinxstyleemphasis{num} update entries in the log. This is useful 10774when debugging synchronization between KDC servers. 10775 10776\item[{\sphinxstylestrong{\sphinxhyphen{}v}}] \leavevmode 10777\sphinxAtStartPar 10778Display individual attributes per update. An example of the 10779output generated for one entry: 10780 10781\begin{sphinxVerbatim}[commandchars=\\\{\}] 10782\PYG{n}{Update} \PYG{n}{Entry} 10783 \PYG{n}{Update} \PYG{n}{serial} \PYG{c+c1}{\PYGZsh{} : 4} 10784 \PYG{n}{Update} \PYG{n}{operation} \PYG{p}{:} \PYG{n}{Add} 10785 \PYG{n}{Update} \PYG{n}{principal} \PYG{p}{:} \PYG{n}{test}\PYG{n+nd}{@EXAMPLE}\PYG{o}{.}\PYG{n}{COM} 10786 \PYG{n}{Update} \PYG{n}{size} \PYG{p}{:} \PYG{l+m+mi}{424} 10787 \PYG{n}{Update} \PYG{n}{committed} \PYG{p}{:} \PYG{k+kc}{True} 10788 \PYG{n}{Update} \PYG{n}{time} \PYG{n}{stamp} \PYG{p}{:} \PYG{n}{Fri} \PYG{n}{Feb} \PYG{l+m+mi}{20} \PYG{l+m+mi}{23}\PYG{p}{:}\PYG{l+m+mi}{37}\PYG{p}{:}\PYG{l+m+mi}{42} \PYG{l+m+mi}{2004} 10789 \PYG{n}{Attributes} \PYG{n}{changed} \PYG{p}{:} \PYG{l+m+mi}{6} 10790 \PYG{n}{Principal} 10791 \PYG{n}{Key} \PYG{n}{data} 10792 \PYG{n}{Password} \PYG{n}{last} \PYG{n}{changed} 10793 \PYG{n}{Modifying} \PYG{n}{principal} 10794 \PYG{n}{Modification} \PYG{n}{time} 10795 \PYG{n}{TL} \PYG{n}{data} 10796\end{sphinxVerbatim} 10797 10798\end{description} 10799 10800 10801\subsection{ENVIRONMENT} 10802\label{\detokenize{admin/admin_commands/kproplog:environment}} 10803\sphinxAtStartPar 10804See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10805variables. 10806 10807 10808\subsection{SEE ALSO} 10809\label{\detokenize{admin/admin_commands/kproplog:see-also}} 10810\sphinxAtStartPar 10811{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 10812 10813 10814\section{ktutil} 10815\label{\detokenize{admin/admin_commands/ktutil:ktutil}}\label{\detokenize{admin/admin_commands/ktutil:ktutil-1}}\label{\detokenize{admin/admin_commands/ktutil::doc}} 10816 10817\subsection{SYNOPSIS} 10818\label{\detokenize{admin/admin_commands/ktutil:synopsis}} 10819\sphinxAtStartPar 10820\sphinxstylestrong{ktutil} 10821 10822 10823\subsection{DESCRIPTION} 10824\label{\detokenize{admin/admin_commands/ktutil:description}} 10825\sphinxAtStartPar 10826The ktutil command invokes a command interface from which an 10827administrator can read, write, or edit entries in a keytab. (Kerberos 10828V4 srvtab files are no longer supported.) 10829 10830 10831\subsection{COMMANDS} 10832\label{\detokenize{admin/admin_commands/ktutil:commands}} 10833 10834\subsubsection{list} 10835\label{\detokenize{admin/admin_commands/ktutil:list}}\begin{quote} 10836 10837\sphinxAtStartPar 10838\sphinxstylestrong{list} {[}\sphinxstylestrong{\sphinxhyphen{}t}{]} {[}\sphinxstylestrong{\sphinxhyphen{}k}{]} {[}\sphinxstylestrong{\sphinxhyphen{}e}{]} 10839\end{quote} 10840 10841\sphinxAtStartPar 10842Displays the current keylist. If \sphinxstylestrong{\sphinxhyphen{}t}, \sphinxstylestrong{\sphinxhyphen{}k}, and/or \sphinxstylestrong{\sphinxhyphen{}e} are 10843specified, also display the timestamp, key contents, or enctype 10844(respectively). 10845 10846\sphinxAtStartPar 10847Alias: \sphinxstylestrong{l} 10848 10849 10850\subsubsection{read\_kt} 10851\label{\detokenize{admin/admin_commands/ktutil:read-kt}}\begin{quote} 10852 10853\sphinxAtStartPar 10854\sphinxstylestrong{read\_kt} \sphinxstyleemphasis{keytab} 10855\end{quote} 10856 10857\sphinxAtStartPar 10858Read the Kerberos V5 keytab file \sphinxstyleemphasis{keytab} into the current keylist. 10859 10860\sphinxAtStartPar 10861Alias: \sphinxstylestrong{rkt} 10862 10863 10864\subsubsection{write\_kt} 10865\label{\detokenize{admin/admin_commands/ktutil:write-kt}}\begin{quote} 10866 10867\sphinxAtStartPar 10868\sphinxstylestrong{write\_kt} \sphinxstyleemphasis{keytab} 10869\end{quote} 10870 10871\sphinxAtStartPar 10872Write the current keylist into the Kerberos V5 keytab file \sphinxstyleemphasis{keytab}. 10873 10874\sphinxAtStartPar 10875Alias: \sphinxstylestrong{wkt} 10876 10877 10878\subsubsection{clear\_list} 10879\label{\detokenize{admin/admin_commands/ktutil:clear-list}}\begin{quote} 10880 10881\sphinxAtStartPar 10882\sphinxstylestrong{clear\_list} 10883\end{quote} 10884 10885\sphinxAtStartPar 10886Clear the current keylist. 10887 10888\sphinxAtStartPar 10889Alias: \sphinxstylestrong{clear} 10890 10891 10892\subsubsection{delete\_entry} 10893\label{\detokenize{admin/admin_commands/ktutil:delete-entry}}\begin{quote} 10894 10895\sphinxAtStartPar 10896\sphinxstylestrong{delete\_entry} \sphinxstyleemphasis{slot} 10897\end{quote} 10898 10899\sphinxAtStartPar 10900Delete the entry in slot number \sphinxstyleemphasis{slot} from the current keylist. 10901 10902\sphinxAtStartPar 10903Alias: \sphinxstylestrong{delent} 10904 10905 10906\subsubsection{add\_entry} 10907\label{\detokenize{admin/admin_commands/ktutil:add-entry}}\begin{quote} 10908 10909\sphinxAtStartPar 10910\sphinxstylestrong{add\_entry} \{\sphinxstylestrong{\sphinxhyphen{}key}|\sphinxstylestrong{\sphinxhyphen{}password}\} \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{principal} 10911\sphinxstylestrong{\sphinxhyphen{}k} \sphinxstyleemphasis{kvno} {[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{enctype}{]} {[}\sphinxstylestrong{\sphinxhyphen{}f}|\sphinxstylestrong{\sphinxhyphen{}s} \sphinxstyleemphasis{salt}{]} 10912\end{quote} 10913 10914\sphinxAtStartPar 10915Add \sphinxstyleemphasis{principal} to keylist using key or password. If the \sphinxstylestrong{\sphinxhyphen{}f} flag 10916is specified, salt information will be fetched from the KDC; in this 10917case the \sphinxstylestrong{\sphinxhyphen{}e} flag may be omitted, or it may be supplied to force a 10918particular enctype. If the \sphinxstylestrong{\sphinxhyphen{}f} flag is not specified, the \sphinxstylestrong{\sphinxhyphen{}e} 10919flag must be specified, and the default salt will be used unless 10920overridden with the \sphinxstylestrong{\sphinxhyphen{}s} option. 10921 10922\sphinxAtStartPar 10923Alias: \sphinxstylestrong{addent} 10924 10925 10926\subsubsection{list\_requests} 10927\label{\detokenize{admin/admin_commands/ktutil:list-requests}}\begin{quote} 10928 10929\sphinxAtStartPar 10930\sphinxstylestrong{list\_requests} 10931\end{quote} 10932 10933\sphinxAtStartPar 10934Displays a listing of available commands. 10935 10936\sphinxAtStartPar 10937Aliases: \sphinxstylestrong{lr}, \sphinxstylestrong{?} 10938 10939 10940\subsubsection{quit} 10941\label{\detokenize{admin/admin_commands/ktutil:quit}}\begin{quote} 10942 10943\sphinxAtStartPar 10944\sphinxstylestrong{quit} 10945\end{quote} 10946 10947\sphinxAtStartPar 10948Quits ktutil. 10949 10950\sphinxAtStartPar 10951Aliases: \sphinxstylestrong{exit}, \sphinxstylestrong{q} 10952 10953 10954\subsection{EXAMPLE} 10955\label{\detokenize{admin/admin_commands/ktutil:example}}\begin{quote} 10956 10957\begin{sphinxVerbatim}[commandchars=\\\{\}] 10958\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{add\PYGZus{}entry} \PYG{o}{\PYGZhy{}}\PYG{n}{password} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{l+m+mi}{1} \PYG{o}{\PYGZhy{}}\PYG{n}{e} 10959 \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} 10960\PYG{n}{Password} \PYG{k}{for} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 10961\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{add\PYGZus{}entry} \PYG{o}{\PYGZhy{}}\PYG{n}{password} \PYG{o}{\PYGZhy{}}\PYG{n}{p} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{n}{k} \PYG{l+m+mi}{1} \PYG{o}{\PYGZhy{}}\PYG{n}{e} 10962 \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} 10963\PYG{n}{Password} \PYG{k}{for} \PYG{n}{alice}\PYG{n+nd}{@BLEEP}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} 10964\PYG{n}{ktutil}\PYG{p}{:} \PYG{n}{write\PYGZus{}kt} \PYG{n}{alice}\PYG{o}{.}\PYG{n}{keytab} 10965\PYG{n}{ktutil}\PYG{p}{:} 10966\end{sphinxVerbatim} 10967\end{quote} 10968 10969 10970\subsection{ENVIRONMENT} 10971\label{\detokenize{admin/admin_commands/ktutil:environment}} 10972\sphinxAtStartPar 10973See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 10974variables. 10975 10976 10977\subsection{SEE ALSO} 10978\label{\detokenize{admin/admin_commands/ktutil:see-also}} 10979\sphinxAtStartPar 10980{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 10981 10982 10983\section{k5srvutil} 10984\label{\detokenize{admin/admin_commands/k5srvutil:k5srvutil}}\label{\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}}\label{\detokenize{admin/admin_commands/k5srvutil::doc}} 10985 10986\subsection{SYNOPSIS} 10987\label{\detokenize{admin/admin_commands/k5srvutil:synopsis}} 10988\sphinxAtStartPar 10989\sphinxstylestrong{k5srvutil} \sphinxstyleemphasis{operation} 10990{[}\sphinxstylestrong{\sphinxhyphen{}i}{]} 10991{[}\sphinxstylestrong{\sphinxhyphen{}f} \sphinxstyleemphasis{filename}{]} 10992{[}\sphinxstylestrong{\sphinxhyphen{}e} \sphinxstyleemphasis{keysalts}{]} 10993 10994 10995\subsection{DESCRIPTION} 10996\label{\detokenize{admin/admin_commands/k5srvutil:description}} 10997\sphinxAtStartPar 10998k5srvutil allows an administrator to list keys currently in 10999a keytab, to obtain new keys for a principal currently in a keytab, 11000or to delete non\sphinxhyphen{}current keys from a keytab. 11001 11002\sphinxAtStartPar 11003\sphinxstyleemphasis{operation} must be one of the following: 11004\begin{description} 11005\item[{\sphinxstylestrong{list}}] \leavevmode 11006\sphinxAtStartPar 11007Lists the keys in a keytab, showing version number and principal 11008name. 11009 11010\item[{\sphinxstylestrong{change}}] \leavevmode 11011\sphinxAtStartPar 11012Uses the kadmin protocol to update the keys in the Kerberos 11013database to new randomly\sphinxhyphen{}generated keys, and updates the keys in 11014the keytab to match. If a key’s version number doesn’t match the 11015version number stored in the Kerberos server’s database, then the 11016operation will fail. If the \sphinxstylestrong{\sphinxhyphen{}i} flag is given, k5srvutil will 11017prompt for confirmation before changing each key. If the \sphinxstylestrong{\sphinxhyphen{}k} 11018option is given, the old and new keys will be displayed. 11019Ordinarily, keys will be generated with the default encryption 11020types and key salts. This can be overridden with the \sphinxstylestrong{\sphinxhyphen{}e} 11021option. Old keys are retained in the keytab so that existing 11022tickets continue to work, but \sphinxstylestrong{delold} should be used after 11023such tickets expire, to prevent attacks against the old keys. 11024 11025\item[{\sphinxstylestrong{delold}}] \leavevmode 11026\sphinxAtStartPar 11027Deletes keys that are not the most recent version from the keytab. 11028This operation should be used some time after a change operation 11029to remove old keys, after existing tickets issued for the service 11030have expired. If the \sphinxstylestrong{\sphinxhyphen{}i} flag is given, then k5srvutil will 11031prompt for confirmation for each principal. 11032 11033\item[{\sphinxstylestrong{delete}}] \leavevmode 11034\sphinxAtStartPar 11035Deletes particular keys in the keytab, interactively prompting for 11036each key. 11037 11038\end{description} 11039 11040\sphinxAtStartPar 11041In all cases, the default keytab is used unless this is overridden by 11042the \sphinxstylestrong{\sphinxhyphen{}f} option. 11043 11044\sphinxAtStartPar 11045k5srvutil uses the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program to edit the keytab in 11046place. 11047 11048 11049\subsection{ENVIRONMENT} 11050\label{\detokenize{admin/admin_commands/k5srvutil:environment}} 11051\sphinxAtStartPar 11052See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 11053variables. 11054 11055 11056\subsection{SEE ALSO} 11057\label{\detokenize{admin/admin_commands/k5srvutil:see-also}} 11058\sphinxAtStartPar 11059{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, {\hyperref[\detokenize{admin/admin_commands/ktutil:ktutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{ktutil}}}}, \DUrole{xref,std,std-ref}{kerberos(7)} 11060 11061 11062\section{sserver} 11063\label{\detokenize{admin/admin_commands/sserver:sserver}}\label{\detokenize{admin/admin_commands/sserver:sserver-8}}\label{\detokenize{admin/admin_commands/sserver::doc}} 11064 11065\subsection{SYNOPSIS} 11066\label{\detokenize{admin/admin_commands/sserver:synopsis}} 11067\sphinxAtStartPar 11068\sphinxstylestrong{sserver} 11069{[} \sphinxstylestrong{\sphinxhyphen{}p} \sphinxstyleemphasis{port} {]} 11070{[} \sphinxstylestrong{\sphinxhyphen{}S} \sphinxstyleemphasis{keytab} {]} 11071{[} \sphinxstyleemphasis{server\_port} {]} 11072 11073 11074\subsection{DESCRIPTION} 11075\label{\detokenize{admin/admin_commands/sserver:description}} 11076\sphinxAtStartPar 11077sserver and \DUrole{xref,std,std-ref}{sclient(1)} are a simple demonstration client/server 11078application. When sclient connects to sserver, it performs a Kerberos 11079authentication, and then sserver returns to sclient the Kerberos 11080principal which was used for the Kerberos authentication. It makes a 11081good test that Kerberos has been successfully installed on a machine. 11082 11083\sphinxAtStartPar 11084The service name used by sserver and sclient is sample. Hence, 11085sserver will require that there be a keytab entry for the service 11086\sphinxcode{\sphinxupquote{sample/hostname.domain.name@REALM.NAME}}. This keytab is generated 11087using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} program. The keytab file is usually 11088installed as {\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}}. 11089 11090\sphinxAtStartPar 11091The \sphinxstylestrong{\sphinxhyphen{}S} option allows for a different keytab than the default. 11092 11093\sphinxAtStartPar 11094sserver is normally invoked out of inetd(8), using a line in 11095\sphinxcode{\sphinxupquote{/etc/inetd.conf}} that looks like this: 11096 11097\begin{sphinxVerbatim}[commandchars=\\\{\}] 11098\PYG{n}{sample} \PYG{n}{stream} \PYG{n}{tcp} \PYG{n}{nowait} \PYG{n}{root} \PYG{o}{/}\PYG{n}{usr}\PYG{o}{/}\PYG{n}{local}\PYG{o}{/}\PYG{n}{sbin}\PYG{o}{/}\PYG{n}{sserver} \PYG{n}{sserver} 11099\end{sphinxVerbatim} 11100 11101\sphinxAtStartPar 11102Since \sphinxcode{\sphinxupquote{sample}} is normally not a port defined in \sphinxcode{\sphinxupquote{/etc/services}}, 11103you will usually have to add a line to \sphinxcode{\sphinxupquote{/etc/services}} which looks 11104like this: 11105 11106\begin{sphinxVerbatim}[commandchars=\\\{\}] 11107\PYG{n}{sample} \PYG{l+m+mi}{13135}\PYG{o}{/}\PYG{n}{tcp} 11108\end{sphinxVerbatim} 11109 11110\sphinxAtStartPar 11111When using sclient, you will first have to have an entry in the 11112Kerberos database, by using {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, and then you have to get 11113Kerberos tickets, by using \DUrole{xref,std,std-ref}{kinit(1)}. Also, if you are running 11114the sclient program on a different host than the sserver it will be 11115connecting to, be sure that both hosts have an entry in /etc/services 11116for the sample tcp port, and that the same port number is in both 11117files. 11118 11119\sphinxAtStartPar 11120When you run sclient you should see something like this: 11121 11122\begin{sphinxVerbatim}[commandchars=\\\{\}] 11123\PYG{n}{sendauth} \PYG{n}{succeeded}\PYG{p}{,} \PYG{n}{reply} \PYG{o+ow}{is}\PYG{p}{:} 11124\PYG{n}{reply} \PYG{n+nb}{len} \PYG{l+m+mi}{32}\PYG{p}{,} \PYG{n}{contents}\PYG{p}{:} 11125\PYG{n}{You} \PYG{n}{are} \PYG{n}{nlgilman}\PYG{n+nd}{@JIMI}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} 11126\end{sphinxVerbatim} 11127 11128 11129\subsection{COMMON ERROR MESSAGES} 11130\label{\detokenize{admin/admin_commands/sserver:common-error-messages}}\begin{enumerate} 11131\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{)}% 11132\item {} 11133\sphinxAtStartPar 11134kinit returns the error: 11135 11136\begin{sphinxVerbatim}[commandchars=\\\{\}] 11137\PYG{n}{kinit}\PYG{p}{:} \PYG{n}{Client} \PYG{o+ow}{not} \PYG{n}{found} \PYG{o+ow}{in} \PYG{n}{Kerberos} \PYG{n}{database} \PYG{k}{while} \PYG{n}{getting} 11138 \PYG{n}{initial} \PYG{n}{credentials} 11139\end{sphinxVerbatim} 11140 11141\sphinxAtStartPar 11142This means that you didn’t create an entry for your username in the 11143Kerberos database. 11144 11145\item {} 11146\sphinxAtStartPar 11147sclient returns the error: 11148 11149\begin{sphinxVerbatim}[commandchars=\\\{\}] 11150\PYG{n}{unknown} \PYG{n}{service} \PYG{n}{sample}\PYG{o}{/}\PYG{n}{tcp}\PYG{p}{;} \PYG{n}{check} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{services} 11151\end{sphinxVerbatim} 11152 11153\sphinxAtStartPar 11154This means that you don’t have an entry in /etc/services for the 11155sample tcp port. 11156 11157\item {} 11158\sphinxAtStartPar 11159sclient returns the error: 11160 11161\begin{sphinxVerbatim}[commandchars=\\\{\}] 11162\PYG{n}{connect}\PYG{p}{:} \PYG{n}{Connection} \PYG{n}{refused} 11163\end{sphinxVerbatim} 11164 11165\sphinxAtStartPar 11166This probably means you didn’t edit /etc/inetd.conf correctly, or 11167you didn’t restart inetd after editing inetd.conf. 11168 11169\item {} 11170\sphinxAtStartPar 11171sclient returns the error: 11172 11173\begin{sphinxVerbatim}[commandchars=\\\{\}] 11174\PYG{n}{sclient}\PYG{p}{:} \PYG{n}{Server} \PYG{o+ow}{not} \PYG{n}{found} \PYG{o+ow}{in} \PYG{n}{Kerberos} \PYG{n}{database} \PYG{k}{while} \PYG{n}{using} 11175 \PYG{n}{sendauth} 11176\end{sphinxVerbatim} 11177 11178\sphinxAtStartPar 11179This means that the \sphinxcode{\sphinxupquote{sample/hostname@LOCAL.REALM}} service was not 11180defined in the Kerberos database; it should be created using 11181{\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}, and a keytab file needs to be generated to make 11182the key for that service principal available for sclient. 11183 11184\item {} 11185\sphinxAtStartPar 11186sclient returns the error: 11187 11188\begin{sphinxVerbatim}[commandchars=\\\{\}] 11189\PYG{n}{sendauth} \PYG{n}{rejected}\PYG{p}{,} \PYG{n}{error} \PYG{n}{reply} \PYG{o+ow}{is}\PYG{p}{:} 11190 \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{No such file or directory}\PYG{l+s+s2}{\PYGZdq{}} 11191\end{sphinxVerbatim} 11192 11193\sphinxAtStartPar 11194This probably means sserver couldn’t find the keytab file. It was 11195probably not installed in the proper directory. 11196 11197\end{enumerate} 11198 11199 11200\subsection{ENVIRONMENT} 11201\label{\detokenize{admin/admin_commands/sserver:environment}} 11202\sphinxAtStartPar 11203See \DUrole{xref,std,std-ref}{kerberos(7)} for a description of Kerberos environment 11204variables. 11205 11206 11207\subsection{SEE ALSO} 11208\label{\detokenize{admin/admin_commands/sserver:see-also}} 11209\sphinxAtStartPar 11210\DUrole{xref,std,std-ref}{sclient(1)}, \DUrole{xref,std,std-ref}{kerberos(7)}, services(5), inetd(8) 11211 11212 11213\chapter{MIT Kerberos defaults} 11214\label{\detokenize{mitK5defaults:mit-kerberos-defaults}}\label{\detokenize{mitK5defaults:mitk5defaults}}\label{\detokenize{mitK5defaults::doc}} 11215 11216\section{General defaults} 11217\label{\detokenize{mitK5defaults:general-defaults}} 11218 11219\begin{savenotes}\sphinxattablestart 11220\centering 11221\begin{tabulary}{\linewidth}[t]{|T|T|T|} 11222\hline 11223\sphinxstyletheadfamily 11224\sphinxAtStartPar 11225Description 11226&\sphinxstyletheadfamily 11227\sphinxAtStartPar 11228Default 11229&\sphinxstyletheadfamily 11230\sphinxAtStartPar 11231Environment 11232\\ 11233\hline 11234\sphinxAtStartPar 11235\DUrole{xref,std,std-ref}{keytab\_definition} file 11236& 11237\sphinxAtStartPar 11238{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFKTNAME}}}} 11239& 11240\sphinxAtStartPar 11241\sphinxstylestrong{KRB5\_KTNAME} 11242\\ 11243\hline 11244\sphinxAtStartPar 11245Client \DUrole{xref,std,std-ref}{keytab\_definition} file 11246& 11247\sphinxAtStartPar 11248{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{DEFCKTNAME}}}} 11249& 11250\sphinxAtStartPar 11251\sphinxstylestrong{KRB5\_CLIENT\_KTNAME} 11252\\ 11253\hline 11254\sphinxAtStartPar 11255Kerberos config file {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} 11256& 11257\sphinxAtStartPar 11258\sphinxcode{\sphinxupquote{/etc/krb5.conf}}\sphinxcode{\sphinxupquote{:}}{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/krb5.conf}} 11259& 11260\sphinxAtStartPar 11261\sphinxstylestrong{KRB5\_CONFIG} 11262\\ 11263\hline 11264\sphinxAtStartPar 11265KDC config file {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} 11266& 11267\sphinxAtStartPar 11268{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kdc.conf}} 11269& 11270\sphinxAtStartPar 11271\sphinxstylestrong{KRB5\_KDC\_PROFILE} 11272\\ 11273\hline 11274\sphinxAtStartPar 11275GSS mechanism config file 11276& 11277\sphinxAtStartPar 11278{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SYSCONFDIR}}}}\sphinxcode{\sphinxupquote{/gss/mech}} 11279& 11280\sphinxAtStartPar 11281\sphinxstylestrong{GSS\_MECH\_CONFIG} 11282\\ 11283\hline 11284\sphinxAtStartPar 11285KDC database path (DB2) 11286& 11287\sphinxAtStartPar 11288{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/principal}} 11289&\\ 11290\hline 11291\sphinxAtStartPar 11292Master key \DUrole{xref,std,std-ref}{stash\_definition} 11293& 11294\sphinxAtStartPar 11295{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/.k5.}}\sphinxstyleemphasis{realm} 11296&\\ 11297\hline 11298\sphinxAtStartPar 11299Admin server ACL file {\hyperref[\detokenize{admin/conf_files/kadm5_acl:kadm5-acl-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kadm5.acl}}}} 11300& 11301\sphinxAtStartPar 11302{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kadm5.acl}} 11303&\\ 11304\hline 11305\sphinxAtStartPar 11306OTP socket directory 11307& 11308\sphinxAtStartPar 11309{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{RUNSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}} 11310&\\ 11311\hline 11312\sphinxAtStartPar 11313Plugin base directory 11314& 11315\sphinxAtStartPar 11316{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LIBDIR}}}}\sphinxcode{\sphinxupquote{/krb5/plugins}} 11317&\\ 11318\hline 11319\sphinxAtStartPar 11320\DUrole{xref,std,std-ref}{rcache\_definition} directory 11321& 11322\sphinxAtStartPar 11323\sphinxcode{\sphinxupquote{/var/tmp}} 11324& 11325\sphinxAtStartPar 11326\sphinxstylestrong{KRB5RCACHEDIR} 11327\\ 11328\hline 11329\sphinxAtStartPar 11330Master key default enctype 11331& 11332\sphinxAtStartPar 11333\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96}} 11334&\\ 11335\hline 11336\sphinxAtStartPar 11337Default {\hyperref[\detokenize{admin/conf_files/kdc_conf:keysalt-lists}]{\sphinxcrossref{\DUrole{std,std-ref}{keysalt list}}}} 11338& 11339\sphinxAtStartPar 11340\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96:normal}} 11341&\\ 11342\hline 11343\sphinxAtStartPar 11344Permitted enctypes 11345& 11346\sphinxAtStartPar 11347\sphinxcode{\sphinxupquote{aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha1\sphinxhyphen{}96 aes256\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha384\sphinxhyphen{}192 aes128\sphinxhyphen{}cts\sphinxhyphen{}hmac\sphinxhyphen{}sha256\sphinxhyphen{}128 des3\sphinxhyphen{}cbc\sphinxhyphen{}sha1 arcfour\sphinxhyphen{}hmac\sphinxhyphen{}md5 camellia256\sphinxhyphen{}cts\sphinxhyphen{}cmac camellia128\sphinxhyphen{}cts\sphinxhyphen{}cmac}} 11348&\\ 11349\hline 11350\sphinxAtStartPar 11351KDC default port 11352& 11353\sphinxAtStartPar 1135488 11355&\\ 11356\hline 11357\sphinxAtStartPar 11358Admin server port 11359& 11360\sphinxAtStartPar 11361749 11362&\\ 11363\hline 11364\sphinxAtStartPar 11365Password change port 11366& 11367\sphinxAtStartPar 11368464 11369&\\ 11370\hline 11371\end{tabulary} 11372\par 11373\sphinxattableend\end{savenotes} 11374 11375 11376\section{Replica KDC propagation defaults} 11377\label{\detokenize{mitK5defaults:replica-kdc-propagation-defaults}} 11378\sphinxAtStartPar 11379This table shows defaults used by the {\hyperref[\detokenize{admin/admin_commands/kprop:kprop-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop}}}} and 11380{\hyperref[\detokenize{admin/admin_commands/kpropd:kpropd-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kpropd}}}} programs. 11381 11382 11383\begin{savenotes}\sphinxattablestart 11384\centering 11385\begin{tabulary}{\linewidth}[t]{|T|T|T|} 11386\hline 11387\sphinxstyletheadfamily 11388\sphinxAtStartPar 11389Description 11390&\sphinxstyletheadfamily 11391\sphinxAtStartPar 11392Default 11393&\sphinxstyletheadfamily 11394\sphinxAtStartPar 11395Environment 11396\\ 11397\hline 11398\sphinxAtStartPar 11399kprop database dump file 11400& 11401\sphinxAtStartPar 11402{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/replica\_datatrans}} 11403&\\ 11404\hline 11405\sphinxAtStartPar 11406kpropd temporary dump file 11407& 11408\sphinxAtStartPar 11409{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/from\_master}} 11410&\\ 11411\hline 11412\sphinxAtStartPar 11413kdb5\_util location 11414& 11415\sphinxAtStartPar 11416{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kdb5\_util}} 11417&\\ 11418\hline 11419\sphinxAtStartPar 11420kprop location 11421& 11422\sphinxAtStartPar 11423{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{SBINDIR}}}}\sphinxcode{\sphinxupquote{/kprop}} 11424&\\ 11425\hline 11426\sphinxAtStartPar 11427kpropd ACL file 11428& 11429\sphinxAtStartPar 11430{\hyperref[\detokenize{mitK5defaults:paths}]{\sphinxcrossref{\DUrole{std,std-ref}{LOCALSTATEDIR}}}}\sphinxcode{\sphinxupquote{/krb5kdc}}\sphinxcode{\sphinxupquote{/kpropd.acl}} 11431&\\ 11432\hline 11433\sphinxAtStartPar 11434kprop port 11435& 11436\sphinxAtStartPar 11437754 11438& 11439\sphinxAtStartPar 11440KPROP\_PORT 11441\\ 11442\hline 11443\end{tabulary} 11444\par 11445\sphinxattableend\end{savenotes} 11446 11447 11448\section{Default paths for Unix\sphinxhyphen{}like systems} 11449\label{\detokenize{mitK5defaults:default-paths-for-unix-like-systems}}\label{\detokenize{mitK5defaults:paths}} 11450\sphinxAtStartPar 11451On Unix\sphinxhyphen{}like systems, some paths used by MIT krb5 depend on parameters 11452chosen at build time. For a custom build, these paths default to 11453subdirectories of \sphinxcode{\sphinxupquote{/usr/local}}. When MIT krb5 is integrated into an 11454operating system, the paths are generally chosen to match the 11455operating system’s filesystem layout. 11456 11457 11458\begin{savenotes}\sphinxattablestart 11459\centering 11460\begin{tabulary}{\linewidth}[t]{|T|T|T|T|} 11461\hline 11462\sphinxstyletheadfamily 11463\sphinxAtStartPar 11464Description 11465&\sphinxstyletheadfamily 11466\sphinxAtStartPar 11467Symbolic name 11468&\sphinxstyletheadfamily 11469\sphinxAtStartPar 11470Custom build path 11471&\sphinxstyletheadfamily 11472\sphinxAtStartPar 11473Typical OS path 11474\\ 11475\hline 11476\sphinxAtStartPar 11477User programs 11478& 11479\sphinxAtStartPar 11480BINDIR 11481& 11482\sphinxAtStartPar 11483\sphinxcode{\sphinxupquote{/usr/local/bin}} 11484& 11485\sphinxAtStartPar 11486\sphinxcode{\sphinxupquote{/usr/bin}} 11487\\ 11488\hline 11489\sphinxAtStartPar 11490Libraries and plugins 11491& 11492\sphinxAtStartPar 11493LIBDIR 11494& 11495\sphinxAtStartPar 11496\sphinxcode{\sphinxupquote{/usr/local/lib}} 11497& 11498\sphinxAtStartPar 11499\sphinxcode{\sphinxupquote{/usr/lib}} 11500\\ 11501\hline 11502\sphinxAtStartPar 11503Parent of KDC state dir 11504& 11505\sphinxAtStartPar 11506LOCALSTATEDIR 11507& 11508\sphinxAtStartPar 11509\sphinxcode{\sphinxupquote{/usr/local/var}} 11510& 11511\sphinxAtStartPar 11512\sphinxcode{\sphinxupquote{/var}} 11513\\ 11514\hline 11515\sphinxAtStartPar 11516Parent of KDC runtime dir 11517& 11518\sphinxAtStartPar 11519RUNSTATEDIR 11520& 11521\sphinxAtStartPar 11522\sphinxcode{\sphinxupquote{/usr/local/var/run}} 11523& 11524\sphinxAtStartPar 11525\sphinxcode{\sphinxupquote{/run}} 11526\\ 11527\hline 11528\sphinxAtStartPar 11529Administrative programs 11530& 11531\sphinxAtStartPar 11532SBINDIR 11533& 11534\sphinxAtStartPar 11535\sphinxcode{\sphinxupquote{/usr/local/sbin}} 11536& 11537\sphinxAtStartPar 11538\sphinxcode{\sphinxupquote{/usr/sbin}} 11539\\ 11540\hline 11541\sphinxAtStartPar 11542Alternate krb5.conf dir 11543& 11544\sphinxAtStartPar 11545SYSCONFDIR 11546& 11547\sphinxAtStartPar 11548\sphinxcode{\sphinxupquote{/usr/local/etc}} 11549& 11550\sphinxAtStartPar 11551\sphinxcode{\sphinxupquote{/etc}} 11552\\ 11553\hline 11554\sphinxAtStartPar 11555Default ccache name 11556& 11557\sphinxAtStartPar 11558DEFCCNAME 11559& 11560\sphinxAtStartPar 11561\sphinxcode{\sphinxupquote{FILE:/tmp/krb5cc\_\%\{uid\}}} 11562& 11563\sphinxAtStartPar 11564\sphinxcode{\sphinxupquote{FILE:/tmp/krb5cc\_\%\{uid\}}} 11565\\ 11566\hline 11567\sphinxAtStartPar 11568Default keytab name 11569& 11570\sphinxAtStartPar 11571DEFKTNAME 11572& 11573\sphinxAtStartPar 11574\sphinxcode{\sphinxupquote{FILE:/etc/krb5.keytab}} 11575& 11576\sphinxAtStartPar 11577\sphinxcode{\sphinxupquote{FILE:/etc/krb5.keytab}} 11578\\ 11579\hline 11580\sphinxAtStartPar 11581Default PKCS11 module 11582& 11583\sphinxAtStartPar 11584PKCS11\_MODNAME 11585& 11586\sphinxAtStartPar 11587\sphinxcode{\sphinxupquote{opensc\sphinxhyphen{}pkcs11.so}} 11588& 11589\sphinxAtStartPar 11590\sphinxcode{\sphinxupquote{opensc\sphinxhyphen{}pkcs11.so}} 11591\\ 11592\hline 11593\end{tabulary} 11594\par 11595\sphinxattableend\end{savenotes} 11596 11597\sphinxAtStartPar 11598The default client keytab name (DEFCKTNAME) typically defaults to 11599\sphinxcode{\sphinxupquote{FILE:/usr/local/var/krb5/user/\%\{euid\}/client.keytab}} for a custom 11600build. A native build will typically use a path which will vary 11601according to the operating system’s layout of \sphinxcode{\sphinxupquote{/var}}. 11602 11603 11604\chapter{Environment variables} 11605\label{\detokenize{admin/env_variables:environment-variables}}\label{\detokenize{admin/env_variables::doc}} 11606\sphinxAtStartPar 11607This content has moved to \DUrole{xref,std,std-ref}{kerberos(7)}. 11608 11609 11610\chapter{Troubleshooting} 11611\label{\detokenize{admin/troubleshoot:troubleshooting}}\label{\detokenize{admin/troubleshoot:troubleshoot}}\label{\detokenize{admin/troubleshoot::doc}} 11612 11613\section{Trace logging} 11614\label{\detokenize{admin/troubleshoot:trace-logging}}\label{\detokenize{admin/troubleshoot:id1}} 11615\sphinxAtStartPar 11616Most programs using MIT krb5 1.9 or later can be made to provide 11617information about internal krb5 library operations using trace 11618logging. To enable this, set the \sphinxstylestrong{KRB5\_TRACE} environment variable 11619to a filename before running the program. On many operating systems, 11620the filename \sphinxcode{\sphinxupquote{/dev/stdout}} can be used to send trace logging output 11621to standard output. 11622 11623\sphinxAtStartPar 11624Some programs do not honor \sphinxstylestrong{KRB5\_TRACE}, either because they use 11625secure library contexts (this generally applies to setuid programs and 11626parts of the login system) or because they take direct control of the 11627trace logging system using the API. 11628 11629\sphinxAtStartPar 11630Here is a short example showing trace logging output for an invocation 11631of the \DUrole{xref,std,std-ref}{kvno(1)} command: 11632 11633\begin{sphinxVerbatim}[commandchars=\\\{\}] 11634\PYG{n}{shell}\PYG{o}{\PYGZpc{}} \PYG{n}{env} \PYG{n}{KRB5\PYGZus{}TRACE}\PYG{o}{=}\PYG{o}{/}\PYG{n}{dev}\PYG{o}{/}\PYG{n}{stdout} \PYG{n}{kvno} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM} 11635\PYG{p}{[}\PYG{l+m+mi}{9138}\PYG{p}{]} \PYG{l+m+mf}{1332348778.823276}\PYG{p}{:} \PYG{n}{Getting} \PYG{n}{credentials} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}} 11636 \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{n}{using} \PYG{n}{ccache} 11637 \PYG{n}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{me}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{build}\PYG{o}{/}\PYG{n}{testdir}\PYG{o}{/}\PYG{n}{ccache} 11638\PYG{p}{[}\PYG{l+m+mi}{9138}\PYG{p}{]} \PYG{l+m+mf}{1332348778.823381}\PYG{p}{:} \PYG{n}{Retrieving} \PYG{n}{user}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZgt{}} 11639 \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM} \PYG{k+kn}{from} 11640 \PYG{n+nn}{FILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{me}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{/}\PYG{n}{build}\PYG{o}{/}\PYG{n}{testdir}\PYG{o}{/}\PYG{n}{ccache} \PYG{k}{with} \PYG{n}{result}\PYG{p}{:} \PYG{l+m+mi}{0}\PYG{o}{/}\PYG{n}{Unknown} \PYG{n}{code} \PYG{l+m+mi}{0} 11641\PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{n+nd}{@KRBTEST}\PYG{o}{.}\PYG{n}{COM}\PYG{p}{:} \PYG{n}{kvno} \PYG{o}{=} \PYG{l+m+mi}{1} 11642\end{sphinxVerbatim} 11643 11644 11645\section{List of errors} 11646\label{\detokenize{admin/troubleshoot:list-of-errors}} 11647 11648\subsection{Frequently seen errors} 11649\label{\detokenize{admin/troubleshoot:frequently-seen-errors}}\begin{enumerate} 11650\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 11651\item {} 11652\sphinxAtStartPar 11653{\hyperref[\detokenize{admin/troubleshoot:init-creds-etype-nosupp}]{\sphinxcrossref{\DUrole{std,std-ref}{KDC has no support for encryption type while getting initial credentials}}}} 11654 11655\item {} 11656\sphinxAtStartPar 11657{\hyperref[\detokenize{admin/troubleshoot:cert-chain-etype-nosupp}]{\sphinxcrossref{\DUrole{std,std-ref}{credential verification failed: KDC has no support for encryption type}}}} 11658 11659\item {} 11660\sphinxAtStartPar 11661{\hyperref[\detokenize{admin/troubleshoot:err-cert-chain-cert-expired}]{\sphinxcrossref{\DUrole{std,std-ref}{Cannot create cert chain: certificate has expired}}}} 11662 11663\end{enumerate} 11664 11665 11666\subsection{Errors seen by admins} 11667\label{\detokenize{admin/troubleshoot:errors-seen-by-admins}}\phantomsection\label{\detokenize{admin/troubleshoot:prop-failed-start}}\begin{enumerate} 11668\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 11669\item {} 11670\sphinxAtStartPar 11671{\hyperref[\detokenize{admin/troubleshoot:kprop-no-route}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: No route to host while connecting to server}}}} 11672 11673\item {} 11674\sphinxAtStartPar 11675{\hyperref[\detokenize{admin/troubleshoot:kprop-con-refused}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Connection refused while connecting to server}}}} 11676 11677\item {} 11678\sphinxAtStartPar 11679{\hyperref[\detokenize{admin/troubleshoot:kprop-sendauth-exchange}]{\sphinxcrossref{\DUrole{std,std-ref}{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server}}}} 11680 11681\end{enumerate} 11682\phantomsection\label{\detokenize{admin/troubleshoot:prop-failed-end}} 11683 11684\bigskip\hrule\bigskip 11685 11686 11687 11688\subsubsection{KDC has no support for encryption type while getting initial credentials} 11689\label{\detokenize{admin/troubleshoot:kdc-has-no-support-for-encryption-type-while-getting-initial-credentials}}\label{\detokenize{admin/troubleshoot:init-creds-etype-nosupp}} 11690 11691\subsubsection{credential verification failed: KDC has no support for encryption type} 11692\label{\detokenize{admin/troubleshoot:credential-verification-failed-kdc-has-no-support-for-encryption-type}}\label{\detokenize{admin/troubleshoot:cert-chain-etype-nosupp}} 11693\sphinxAtStartPar 11694This most commonly happens when trying to use a principal with only 11695DES keys, in a release (MIT krb5 1.7 or later) which disables DES by 11696default. DES encryption is considered weak due to its inadequate key 11697size. If you cannot migrate away from its use, you can re\sphinxhyphen{}enable DES 11698by adding \sphinxcode{\sphinxupquote{allow\_weak\_crypto = true}} to the {\hyperref[\detokenize{admin/conf_files/krb5_conf:libdefaults}]{\sphinxcrossref{\DUrole{std,std-ref}{{[}libdefaults{]}}}}} 11699section of {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}}. 11700 11701 11702\subsubsection{Cannot create cert chain: certificate has expired} 11703\label{\detokenize{admin/troubleshoot:cannot-create-cert-chain-certificate-has-expired}}\label{\detokenize{admin/troubleshoot:err-cert-chain-cert-expired}} 11704\sphinxAtStartPar 11705This error message indicates that PKINIT authentication failed because 11706the client certificate, KDC certificate, or one of the certificates in 11707the signing chain above them has expired. 11708 11709\sphinxAtStartPar 11710If the KDC certificate has expired, this message appears in the KDC 11711log file, and the client will receive a “Preauthentication failed” 11712error. (Prior to release 1.11, the KDC log file message erroneously 11713appears as “Out of memory”. Prior to release 1.12, the client will 11714receive a “Generic error”.) 11715 11716\sphinxAtStartPar 11717If the client or a signing certificate has expired, this message may 11718appear in {\hyperref[\detokenize{admin/troubleshoot:trace-logging}]{\sphinxcrossref{trace\_logging}}} output from \DUrole{xref,std,std-ref}{kinit(1)} or, starting in 11719release 1.12, as an error message from kinit or another program which 11720gets initial tickets. The error message is more likely to appear 11721properly on the client if the principal entry has no long\sphinxhyphen{}term keys. 11722 11723 11724\subsubsection{kprop: No route to host while connecting to server} 11725\label{\detokenize{admin/troubleshoot:kprop-no-route-to-host-while-connecting-to-server}}\label{\detokenize{admin/troubleshoot:kprop-no-route}} 11726\sphinxAtStartPar 11727Make sure that the hostname of the replica KDC (as given to kprop) is 11728correct, and that any firewalls between the primary and the replica 11729allow a connection on port 754. 11730 11731 11732\subsubsection{kprop: Connection refused while connecting to server} 11733\label{\detokenize{admin/troubleshoot:kprop-connection-refused-while-connecting-to-server}}\label{\detokenize{admin/troubleshoot:kprop-con-refused}} 11734\sphinxAtStartPar 11735If the replica KDC is intended to run kpropd out of inetd, make sure 11736that inetd is configured to accept krb5\_prop connections. inetd may 11737need to be restarted or sent a SIGHUP to recognize the new 11738configuration. If the replica is intended to run kpropd in standalone 11739mode, make sure that it is running. 11740 11741 11742\subsubsection{kprop: Server rejected authentication (during sendauth exchange) while authenticating to server} 11743\label{\detokenize{admin/troubleshoot:kprop-server-rejected-authentication-during-sendauth-exchange-while-authenticating-to-server}}\label{\detokenize{admin/troubleshoot:kprop-sendauth-exchange}} 11744\sphinxAtStartPar 11745Make sure that: 11746\begin{enumerate} 11747\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 11748\item {} 11749\sphinxAtStartPar 11750The time is synchronized between the primary and replica KDCs. 11751 11752\item {} 11753\sphinxAtStartPar 11754The master stash file was copied from the primary to the expected 11755location on the replica. 11756 11757\item {} 11758\sphinxAtStartPar 11759The replica has a keytab file in the default location containing a 11760\sphinxcode{\sphinxupquote{host}} principal for the replica’s hostname. 11761 11762\end{enumerate} 11763 11764 11765\chapter{Advanced topics} 11766\label{\detokenize{admin/advanced/index:advanced-topics}}\label{\detokenize{admin/advanced/index::doc}} 11767 11768\section{Retiring DES} 11769\label{\detokenize{admin/advanced/retiring-des:retiring-des}}\label{\detokenize{admin/advanced/retiring-des:id1}}\label{\detokenize{admin/advanced/retiring-des::doc}} 11770\sphinxAtStartPar 11771Version 5 of the Kerberos protocol was originally implemented using 11772the Data Encryption Standard (DES) as a block cipher for encryption. 11773While it was considered secure at the time, advancements in computational 11774ability have rendered DES vulnerable to brute force attacks on its 56\sphinxhyphen{}bit 11775keyspace. As such, it is now considered insecure and should not be 11776used (\index{RFC@\spxentry{RFC}!RFC 6649@\spxentry{RFC 6649}}\sphinxhref{https://tools.ietf.org/html/rfc6649.html}{\sphinxstylestrong{RFC 6649}}). 11777 11778 11779\subsection{History} 11780\label{\detokenize{admin/advanced/retiring-des:history}} 11781\sphinxAtStartPar 11782DES was used in the original Kerberos implementation, and was the 11783only cryptosystem in krb5 1.0. Partial support for triple\sphinxhyphen{}DES (3DES) was 11784added in version 1.1, with full support following in version 1.2. 11785The Advanced Encryption Standard (AES), which supersedes DES, gained 11786partial support in version 1.3.0 of krb5 and full support in version 1.3.2. 11787However, deployments of krb5 using Kerberos databases created with older 11788versions of krb5 will not necessarily start using strong crypto for 11789ordinary operation without administrator intervention. 11790 11791\sphinxAtStartPar 11792MIT krb5 began flagging deprecated encryption types with release 1.17, 11793and removed DES (single\sphinxhyphen{}DES) support in release 1.18. As a 11794consequence, a release prior to 1.18 is required to perform these 11795migrations. 11796 11797 11798\subsection{Types of keys} 11799\label{\detokenize{admin/advanced/retiring-des:types-of-keys}}\begin{itemize} 11800\item {} 11801\sphinxAtStartPar 11802The database master key: This key is not exposed to user requests, 11803but is used to encrypt other key material stored in the kerberos 11804database. The database master key is currently stored as \sphinxcode{\sphinxupquote{K/M}} 11805by default. 11806 11807\item {} 11808\sphinxAtStartPar 11809Password\sphinxhyphen{}derived keys: User principals frequently have keys 11810derived from a password. When a new password is set, the KDC 11811uses various string2key functions to generate keys in the database 11812for that principal. 11813 11814\item {} 11815\sphinxAtStartPar 11816Keytab keys: Application server principals generally use random 11817keys which are not derived from a password. When the database 11818entry is created, the KDC generates random keys of various enctypes 11819to enter in the database, which are conveyed to the application server 11820and stored in a keytab. 11821 11822\item {} 11823\sphinxAtStartPar 11824Session keys: These are short\sphinxhyphen{}term keys generated by the KDC while 11825processing client requests, with an enctype selected by the KDC. 11826 11827\end{itemize} 11828 11829\sphinxAtStartPar 11830For details on the various enctypes and how enctypes are selected by the KDC 11831for session keys and client/server long\sphinxhyphen{}term keys, see {\hyperref[\detokenize{admin/enctypes:enctypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}}. 11832When using the {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} interface to generate new long\sphinxhyphen{}term keys, 11833the \sphinxstylestrong{\sphinxhyphen{}e} argument can be used to force a particular set of enctypes, 11834overriding the KDC default values. 11835 11836\begin{sphinxadmonition}{note}{Note:} 11837\sphinxAtStartPar 11838When the KDC is selecting a session key, it has no knowledge about the 11839kerberos installation on the server which will receive the service ticket, 11840only what keys are in the database for the service principal. 11841In order to allow uninterrupted operation to 11842clients while migrating away from DES, care must be taken to ensure that 11843kerberos installations on application server machines are configured to 11844support newer encryption types before keys of those new encryption types 11845are created in the Kerberos database for those server principals. 11846\end{sphinxadmonition} 11847 11848 11849\subsection{Upgrade procedure} 11850\label{\detokenize{admin/advanced/retiring-des:upgrade-procedure}} 11851\sphinxAtStartPar 11852This procedure assumes that the KDC software has already been upgraded 11853to a modern version of krb5 that supports non\sphinxhyphen{}DES keys, so that the 11854only remaining task is to update the actual keys used to service requests. 11855The realm used for demonstrating this procedure, ZONE.MIT.EDU, 11856is an example of the worst\sphinxhyphen{}case scenario, where all keys in the realm 11857are DES. The realm was initially created with a very old version of krb5, 11858and \sphinxstylestrong{supported\_enctypes} in {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} was set to a value 11859appropriate when the KDC was installed, but was not updated as the KDC 11860was upgraded: 11861 11862\begin{sphinxVerbatim}[commandchars=\\\{\}] 11863\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 11864 \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 11865 \PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11866 \PYG{n}{master\PYGZus{}key\PYGZus{}type} \PYG{o}{=} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} 11867 \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{p}{:}\PYG{n}{v4} \PYG{n}{des}\PYG{p}{:}\PYG{n}{norealm} \PYG{n}{des}\PYG{p}{:}\PYG{n}{onlyrealm} \PYG{n}{des}\PYG{p}{:}\PYG{n}{afs3} 11868 \PYG{p}{\PYGZcb{}} 11869\end{sphinxVerbatim} 11870 11871\sphinxAtStartPar 11872This resulted in the keys for all principals in the realm being forced 11873to DES\sphinxhyphen{}only, unless specifically requested using {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}}. 11874 11875\sphinxAtStartPar 11876Before starting the upgrade, all KDCs were running krb5 1.11, 11877and the database entries for some “high\sphinxhyphen{}value” principals were: 11878 11879\begin{sphinxVerbatim}[commandchars=\\\{\}] 11880\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc krbtgt/ZONE.MIT.EDU\PYGZsq{}} 11881\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11882\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} 11883\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{v4} 11884\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11885\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc kadmin/admin\PYGZsq{}} 11886\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11887\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} 11888\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{15}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} 11889\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11890\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc kadmin/changepw\PYGZsq{}} 11891\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11892\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{1} 11893\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{14}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} 11894\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11895\end{sphinxVerbatim} 11896 11897\sphinxAtStartPar 11898The \sphinxcode{\sphinxupquote{krbtgt/REALM}} key appears to have never been changed since creation 11899(its kvno is 1), and all three database entries have only a des\sphinxhyphen{}cbc\sphinxhyphen{}crc key. 11900 11901 11902\subsubsection{The krbtgt key and KDC keys} 11903\label{\detokenize{admin/advanced/retiring-des:the-krbtgt-key-and-kdc-keys}} 11904\sphinxAtStartPar 11905Perhaps the biggest single\sphinxhyphen{}step improvement in the security of the cell 11906is gained by strengthening the key of the ticket\sphinxhyphen{}granting service principal, 11907\sphinxcode{\sphinxupquote{krbtgt/REALM}}—if this principal’s key is compromised, so is the 11908entire realm. Since the server that will handle service tickets 11909for this principal is the KDC itself, it is easy to guarantee that it 11910will be configured to support any encryption types which might be 11911selected. However, the default KDC behavior when creating new keys is to 11912remove the old keys, which would invalidate all existing tickets issued 11913against that principal, rendering the TGTs cached by clients useless. 11914Instead, a new key can be created with the old key retained, so that 11915existing tickets will still function until their scheduled expiry 11916(see {\hyperref[\detokenize{admin/database:changing-krbtgt-key}]{\sphinxcrossref{\DUrole{std,std-ref}{Changing the krbtgt key}}}}). 11917 11918\begin{sphinxVerbatim}[commandchars=\\\{\}] 11919\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} 11920\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} 11921\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} 11922\PYG{o}{\PYGZgt{}} \PYG{o}{\PYGZhy{}}\PYG{n}{keepold} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{l+s+s2}{\PYGZdq{}} 11923\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 11924\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} 11925\end{sphinxVerbatim} 11926 11927\begin{sphinxadmonition}{note}{Note:} 11928\sphinxAtStartPar 11929The new \sphinxcode{\sphinxupquote{krbtgt@REALM}} key should be propagated to replica KDCs 11930immediately so that TGTs issued by the primary KDC can be used to 11931issue service tickets on replica KDCs. Replica KDCs will refuse 11932requests using the new TGT kvno until the new krbtgt entry has 11933been propagated to them. 11934\end{sphinxadmonition} 11935 11936\sphinxAtStartPar 11937It is necessary to explicitly specify the enctypes for the new database 11938entry, since \sphinxstylestrong{supported\_enctypes} has not been changed. Leaving 11939\sphinxstylestrong{supported\_enctypes} unchanged makes a potential rollback operation 11940easier, since all new keys of new enctypes are the result of explicit 11941administrator action and can be easily enumerated. 11942Upgrading the krbtgt key should have minimal user\sphinxhyphen{}visible disruption other 11943than that described in the note above, since only clients which list the 11944new enctypes as supported will use them, per the procedure 11945in {\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}}. 11946Once the krbtgt key is updated, the session and ticket keys for user 11947TGTs will be strong keys, but subsequent requests 11948for service tickets will still get DES keys until the service principals 11949have new keys generated. Application service 11950remains uninterrupted due to the key\sphinxhyphen{}selection procedure on the KDC. 11951 11952\sphinxAtStartPar 11953After the change, the database entry is now: 11954 11955\begin{sphinxVerbatim}[commandchars=\\\{\}] 11956\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc krbtgt/ZONE.MIT.EDU\PYGZsq{}} 11957\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11958\PYG{n}{Number} \PYG{n}{of} \PYG{n}{keys}\PYG{p}{:} \PYG{l+m+mi}{5} 11959\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} 11960\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} 11961\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1} 11962\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{2}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} 11963\PYG{n}{Key}\PYG{p}{:} \PYG{n}{vno} \PYG{l+m+mi}{1}\PYG{p}{,} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{v4} 11964\PYG{p}{[}\PYG{o}{.}\PYG{o}{.}\PYG{o}{.}\PYG{p}{]} 11965\end{sphinxVerbatim} 11966 11967\sphinxAtStartPar 11968Since the expected disruptions from rekeying the krbtgt principal are 11969minor, after a short testing period, it is 11970appropriate to rekey the other high\sphinxhyphen{}value principals, \sphinxcode{\sphinxupquote{kadmin/admin@REALM}} 11971and \sphinxcode{\sphinxupquote{kadmin/changepw@REALM}}. These are the service principals used for 11972changing user passwords and updating application keytabs. The kadmin 11973and password\sphinxhyphen{}changing services are regular kerberized services, so the 11974session\sphinxhyphen{}key\sphinxhyphen{}selection algorithm described in {\hyperref[\detokenize{admin/enctypes:session-key-selection}]{\sphinxcrossref{\DUrole{std,std-ref}{Session key selection}}}} 11975applies. It is particularly important to have strong session keys for 11976these services, since user passwords and new long\sphinxhyphen{}term keys are conveyed 11977over the encrypted channel. 11978 11979\begin{sphinxVerbatim}[commandchars=\\\{\}] 11980\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} 11981\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} 11982\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} 11983\PYG{o}{\PYGZgt{}} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{admin}\PYG{l+s+s2}{\PYGZdq{}} 11984\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 11985\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{kadmin/admin@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} 11986\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}e \PYGZdl{}\PYGZob{}enctypes\PYGZcb{} \PYGZhy{}randkey \PYGZbs{}} 11987\PYG{o}{\PYGZgt{}} \PYG{n}{kadmin}\PYG{o}{/}\PYG{n}{changepw}\PYG{l+s+s2}{\PYGZdq{}} 11988\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 11989\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{kadmin/changepw@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} 11990\end{sphinxVerbatim} 11991 11992\sphinxAtStartPar 11993It is not necessary to retain a single\sphinxhyphen{}DES key for these services, since 11994password changes are not part of normal daily workflow, and disruption 11995from a client failure is likely to be minimal. Furthermore, if a kerberos 11996client experiences failure changing a user password or keytab key, 11997this indicates that that client will become inoperative once services 11998are rekeyed to non\sphinxhyphen{}DES enctypes. Such problems can be detected early 11999at this stage, giving more time for corrective action. 12000 12001 12002\subsubsection{Adding strong keys to application servers} 12003\label{\detokenize{admin/advanced/retiring-des:adding-strong-keys-to-application-servers}} 12004\sphinxAtStartPar 12005Before switching the default enctypes for new keys over to strong enctypes, 12006it may be desired to test upgrading a handful of services with the 12007new configuration before flipping the switch for the defaults. This 12008still requires using the \sphinxstylestrong{\sphinxhyphen{}e} argument in {\hyperref[\detokenize{admin/admin_commands/kadmin_local:kadmin-1}]{\sphinxcrossref{\DUrole{std,std-ref}{kadmin}}}} to get non\sphinxhyphen{}default 12009enctypes: 12010 12011\begin{sphinxVerbatim}[commandchars=\\\{\}] 12012\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} enctypes=aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96:normal,\PYGZbs{}} 12013\PYG{o}{\PYGZgt{}} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal}\PYG{p}{,}\PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} 12014\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}p zephyr/zephyr@ZONE.MIT.EDU \PYGZhy{}k \PYGZhy{}t \PYGZbs{}} 12015\PYG{o}{\PYGZgt{}} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} \PYG{o}{\PYGZhy{}}\PYG{n}{q} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{ktadd \PYGZhy{}e \PYGZdl{}}\PYG{l+s+si}{\PYGZob{}enctypes\PYGZcb{}}\PYG{l+s+s2}{ }\PYG{l+s+se}{\PYGZbs{}} 12016\PYG{l+s+s2}{\PYGZgt{} \PYGZhy{}k /etc/zephyr/krb5.keytab zephyr/zephyr@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} 12017\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12018\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12019\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12020\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12021\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{4}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12022\end{sphinxVerbatim} 12023 12024\sphinxAtStartPar 12025Be sure to remove the old keys from the application keytab, per best 12026practice. 12027 12028\begin{sphinxVerbatim}[commandchars=\\\{\}] 12029\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} k5srvutil \PYGZhy{}f /etc/zephyr/krb5.keytab delold} 12030\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12031\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{zephyr}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{zephyr}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12032\end{sphinxVerbatim} 12033 12034 12035\subsubsection{Adding strong keys by default} 12036\label{\detokenize{admin/advanced/retiring-des:adding-strong-keys-by-default}} 12037\sphinxAtStartPar 12038Once the high\sphinxhyphen{}visibility services have been rekeyed, it is probably 12039appropriate to change {\hyperref[\detokenize{admin/conf_files/kdc_conf:kdc-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{kdc.conf}}}} to generate keys with the new 12040encryption types by default. This enables server administrators to generate 12041new enctypes with the \sphinxstylestrong{change} subcommand of {\hyperref[\detokenize{admin/admin_commands/k5srvutil:k5srvutil-1}]{\sphinxcrossref{\DUrole{std,std-ref}{k5srvutil}}}}, 12042and causes user password 12043changes to add new encryption types for their entries. It will probably 12044be necessary to implement administrative controls to cause all user 12045principal keys to be updated in a reasonable period of time, whether 12046by forcing password changes or a password synchronization service that 12047has access to the current password and can add the new keys. 12048 12049\begin{sphinxVerbatim}[commandchars=\\\{\}] 12050\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 12051 \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 12052 \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{crc}\PYG{p}{:}\PYG{n}{normal} 12053\end{sphinxVerbatim} 12054 12055\begin{sphinxadmonition}{note}{Note:} 12056\sphinxAtStartPar 12057The krb5kdc process must be restarted for these changes to take effect. 12058\end{sphinxadmonition} 12059 12060\sphinxAtStartPar 12061At this point, all service administrators can update their services and the 12062servers behind them to take advantage of strong cryptography. 12063If necessary, the server’s krb5 installation should be configured and/or 12064upgraded to a version supporting non\sphinxhyphen{}DES keys. See {\hyperref[\detokenize{admin/enctypes:enctypes}]{\sphinxcrossref{\DUrole{std,std-ref}{Encryption types}}}} for 12065krb5 version and configuration settings. 12066Only when the service is configured to accept non\sphinxhyphen{}DES keys should 12067the key version number be incremented and new keys generated 12068(\sphinxcode{\sphinxupquote{k5srvutil change \&\& k5srvutil delold}}). 12069 12070\begin{sphinxVerbatim}[commandchars=\\\{\}] 12071\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} k5srvutil change} 12072\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12073\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{256} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12074\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{128} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12075\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{Triple} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{HMAC}\PYG{o}{/}\PYG{n}{sha1} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12076\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{3}\PYG{p}{,} \PYG{n}{encryption} \PYG{n+nb}{type} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32} \PYG{n}{added} \PYG{n}{to} \PYG{n}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12077\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} klist \PYGZhy{}e \PYGZhy{}k \PYGZhy{}t /etc/krb5.keytab} 12078\PYG{n}{Keytab} \PYG{n}{name}\PYG{p}{:} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab} 12079\PYG{n}{KVNO} \PYG{n}{Timestamp} \PYG{n}{Principal} 12080\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} \PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}}\PYG{o}{\PYGZhy{}} 12081 \PYG{l+m+mi}{2} \PYG{l+m+mi}{10}\PYG{o}{/}\PYG{l+m+mi}{10}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{17}\PYG{p}{:}\PYG{l+m+mi}{03}\PYG{p}{:}\PYG{l+m+mi}{59} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32}\PYG{p}{)} 12082 \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{256} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC}\PYG{p}{)} 12083 \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{AES}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{128} \PYG{n}{CTS} \PYG{n}{mode} \PYG{k}{with} \PYG{l+m+mi}{96}\PYG{o}{\PYGZhy{}}\PYG{n}{bit} \PYG{n}{SHA}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{1} \PYG{n}{HMAC}\PYG{p}{)} 12084 \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{Triple} \PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{HMAC}\PYG{o}{/}\PYG{n}{sha1}\PYG{p}{)} 12085 \PYG{l+m+mi}{3} \PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12}\PYG{o}{/}\PYG{l+m+mi}{12} \PYG{l+m+mi}{15}\PYG{p}{:}\PYG{l+m+mi}{31}\PYG{p}{:}\PYG{l+m+mi}{19} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{p}{(}\PYG{n}{DES} \PYG{n}{cbc} \PYG{n}{mode} \PYG{k}{with} \PYG{n}{CRC}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{32}\PYG{p}{)} 12086\PYG{n}{root}\PYG{n+nd}{@dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{p}{:}\PYG{o}{\PYGZti{}}\PYG{c+c1}{\PYGZsh{} k5srvutil delold} 12087\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{keytab} \PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12088\PYG{n}{Entry} \PYG{k}{for} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{dr}\PYG{o}{\PYGZhy{}}\PYG{n}{willy}\PYG{o}{.}\PYG{n}{xvm}\PYG{o}{.}\PYG{n}{mit}\PYG{o}{.}\PYG{n}{edu}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{kvno} \PYG{l+m+mi}{2} \PYG{n}{removed} \PYG{k+kn}{from} \PYG{n+nn}{keytab} \PYG{n}{WRFILE}\PYG{p}{:}\PYG{o}{/}\PYG{n}{etc}\PYG{o}{/}\PYG{n}{krb5}\PYG{o}{.}\PYG{n}{keytab}\PYG{o}{.} 12089\end{sphinxVerbatim} 12090 12091\sphinxAtStartPar 12092When a single service principal is shared by multiple backend servers in 12093a load\sphinxhyphen{}balanced environment, it may be necessary to schedule downtime 12094or adjust the population in the load\sphinxhyphen{}balanced pool in order to propagate 12095the updated keytab to all hosts in the pool with minimal service interruption. 12096 12097 12098\subsubsection{Removing DES keys from usage} 12099\label{\detokenize{admin/advanced/retiring-des:removing-des-keys-from-usage}} 12100\sphinxAtStartPar 12101This situation remains something of a testing or transitory state, 12102as new DES keys are still being generated, and will be used if requested 12103by a client. To make more progress removing DES from the realm, the KDC 12104should be configured to not generate such keys by default. 12105 12106\begin{sphinxadmonition}{note}{Note:} 12107\sphinxAtStartPar 12108An attacker posing as a client can implement a brute force attack against 12109a DES key for any principal, if that key is in the current (highest\sphinxhyphen{}kvno) 12110key list. This attack is only possible if \sphinxstylestrong{allow\_weak\_crypto = true} 12111is enabled on the KDC. Setting the \sphinxstylestrong{+requires\_preauth} flag on a 12112principal forces this attack to be an online attack, much slower than 12113the offline attack otherwise available to the attacker. However, setting 12114this flag on a service principal is not always advisable; see the entry in 12115{\hyperref[\detokenize{admin/admin_commands/kadmin_local:add-principal}]{\sphinxcrossref{\DUrole{std,std-ref}{add\_principal}}}} for details. 12116\end{sphinxadmonition} 12117 12118\sphinxAtStartPar 12119The following KDC configuration will not generate DES keys by default: 12120 12121\begin{sphinxVerbatim}[commandchars=\\\{\}] 12122\PYG{p}{[}\PYG{n}{realms}\PYG{p}{]} 12123 \PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{o}{=} \PYG{p}{\PYGZob{}} 12124 \PYG{n}{supported\PYGZus{}enctypes} \PYG{o}{=} \PYG{n}{aes256}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{aes128}\PYG{o}{\PYGZhy{}}\PYG{n}{cts}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{o}{\PYGZhy{}}\PYG{l+m+mi}{96}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{cbc}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} \PYG{n}{des3}\PYG{o}{\PYGZhy{}}\PYG{n}{hmac}\PYG{o}{\PYGZhy{}}\PYG{n}{sha1}\PYG{p}{:}\PYG{n}{normal} 12125\end{sphinxVerbatim} 12126 12127\begin{sphinxadmonition}{note}{Note:} 12128\sphinxAtStartPar 12129As before, the KDC process must be restarted for this change to take 12130effect. It is best practice to update kdc.conf on all KDCs, not just the 12131primary, to avoid unpleasant surprises should the primary fail and a 12132replica need to be promoted. 12133\end{sphinxadmonition} 12134 12135\sphinxAtStartPar 12136It is now appropriate to remove the legacy single\sphinxhyphen{}DES key from the 12137\sphinxcode{\sphinxupquote{krbtgt/REALM}} entry: 12138 12139\begin{sphinxVerbatim}[commandchars=\\\{\}] 12140\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZdq{}cpw \PYGZhy{}randkey \PYGZhy{}keepold \PYGZbs{}} 12141\PYG{o}{\PYGZgt{}} \PYG{n}{krbtgt}\PYG{o}{/}\PYG{n}{ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU}\PYG{l+s+s2}{\PYGZdq{}} 12142\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{host}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ATHENA}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 12143\PYG{n}{Key} \PYG{k}{for} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{randomized}\PYG{o}{.} 12144\end{sphinxVerbatim} 12145 12146\sphinxAtStartPar 12147After the maximum ticket lifetime has passed, the old database entry 12148should be removed. 12149 12150\begin{sphinxVerbatim}[commandchars=\\\{\}] 12151\PYG{p}{[}\PYG{n}{root}\PYG{n+nd}{@casio} \PYG{n}{krb5kdc}\PYG{p}{]}\PYG{c+c1}{\PYGZsh{} kadmin.local \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}purgekeys krbtgt/ZONE.MIT.EDU\PYGZsq{}} 12152\PYG{n}{Authenticating} \PYG{k}{as} \PYG{n}{principal} \PYG{n}{root}\PYG{o}{/}\PYG{n}{admin}\PYG{n+nd}{@ZONE}\PYG{o}{.}\PYG{n}{MIT}\PYG{o}{.}\PYG{n}{EDU} \PYG{k}{with} \PYG{n}{password}\PYG{o}{.} 12153\PYG{n}{Old} \PYG{n}{keys} \PYG{k}{for} \PYG{n}{principal} \PYG{l+s+s2}{\PYGZdq{}}\PYG{l+s+s2}{krbtgt/ZONE.MIT.EDU@ZONE.MIT.EDU}\PYG{l+s+s2}{\PYGZdq{}} \PYG{n}{purged}\PYG{o}{.} 12154\end{sphinxVerbatim} 12155 12156\sphinxAtStartPar 12157After the KDC is restarted with the new \sphinxstylestrong{supported\_enctypes}, 12158all user password changes and application keytab updates will not 12159generate DES keys by default. 12160 12161\begin{sphinxVerbatim}[commandchars=\\\{\}] 12162contents\PYGZhy{}vnder\PYGZhy{}pressvre:\PYGZti{}\PYGZgt{} kpasswd zonetest@ZONE.MIT.EDU 12163Password for zonetest@ZONE.MIT.EDU: [enter old password] 12164Enter new password: [enter new password] 12165Enter it again: [enter new password] 12166Password changed. 12167contents\PYGZhy{}vnder\PYGZhy{}pressvre:\PYGZti{}\PYGZgt{} kadmin \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}q \PYGZsq{}getprinc zonetest\PYGZsq{} 12168[...] 12169Number of keys: 3 12170Key: vno 9, aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 12171Key: vno 9, aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 12172Key: vno 9, des3\PYGZhy{}cbc\PYGZhy{}sha1 12173[...] 12174 12175[kaduk@glossolalia \PYGZti{}]\PYGZdl{} kadmin \PYGZhy{}p kaduk@ZONE.MIT.EDU \PYGZhy{}r ZONE.MIT.EDU \PYGZhy{}k \PYGZbs{} 12176\PYGZgt{} \PYGZhy{}t kaduk\PYGZhy{}zone.keytab \PYGZhy{}q \PYGZsq{}ktadd \PYGZhy{}k kaduk\PYGZhy{}zone.keytab kaduk@ZONE.MIT.EDU\PYGZsq{} 12177Authenticating as principal kaduk@ZONE.MIT.EDU with keytab kaduk\PYGZhy{}zone.keytab. 12178Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type aes256\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. 12179Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type aes128\PYGZhy{}cts\PYGZhy{}hmac\PYGZhy{}sha1\PYGZhy{}96 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. 12180Entry for principal kaduk@ZONE.MIT.EDU with kvno 3, encryption type des3\PYGZhy{}cbc\PYGZhy{}sha1 added to keytab WRFILE:kaduk\PYGZhy{}zone.keytab. 12181\end{sphinxVerbatim} 12182 12183\sphinxAtStartPar 12184Once all principals have been re\sphinxhyphen{}keyed, DES support can be disabled on the 12185KDC (\sphinxstylestrong{allow\_weak\_crypto = false}), and client machines can remove 12186\sphinxstylestrong{allow\_weak\_crypto = true} from their {\hyperref[\detokenize{admin/conf_files/krb5_conf:krb5-conf-5}]{\sphinxcrossref{\DUrole{std,std-ref}{krb5.conf}}}} configuration 12187files, completing the migration. \sphinxstylestrong{allow\_weak\_crypto} takes precedence over 12188all places where DES enctypes could be explicitly configured. DES keys will 12189not be used, even if they are present, when \sphinxstylestrong{allow\_weak\_crypto = false}. 12190 12191 12192\subsubsection{Support for legacy services} 12193\label{\detokenize{admin/advanced/retiring-des:support-for-legacy-services}} 12194\sphinxAtStartPar 12195If there remain legacy services which do not support non\sphinxhyphen{}DES enctypes 12196(such as older versions of AFS), \sphinxstylestrong{allow\_weak\_crypto} must remain 12197enabled on the KDC. Client machines need not have this setting, 12198though—applications which require DES can use API calls to allow 12199weak crypto on a per\sphinxhyphen{}request basis, overriding the system krb5.conf. 12200However, having \sphinxstylestrong{allow\_weak\_crypto} set on the KDC means that any 12201principals which have a DES key in the database could still use those 12202keys. To minimize the use of DES in the realm and restrict it to just 12203legacy services which require DES, it is necessary to remove all other 12204DES keys. The realm has been configured such that at password and 12205keytab change, no DES keys will be generated by default. The task 12206then reduces to requiring user password changes and having server 12207administrators update their service keytabs. Administrative outreach 12208will be necessary, and if the desire to eliminate DES is sufficiently 12209strong, the KDC administrators may choose to randkey any principals 12210which have not been rekeyed after some timeout period, forcing the 12211user to contact the helpdesk for access. 12212 12213 12214\subsection{The Database Master Key} 12215\label{\detokenize{admin/advanced/retiring-des:the-database-master-key}} 12216\sphinxAtStartPar 12217This procedure does not alter \sphinxcode{\sphinxupquote{K/M@REALM}}, the key used to encrypt key 12218material in the Kerberos database. (This is the key stored in the stash file 12219on the KDC if stash files are used.) However, the security risk of 12220a single\sphinxhyphen{}DES key for \sphinxcode{\sphinxupquote{K/M}} is minimal, given that access to material 12221encrypted in \sphinxcode{\sphinxupquote{K/M}} (the Kerberos database) is generally tightly controlled. 12222If an attacker can gain access to the encrypted database, they likely 12223have access to the stash file as well, rendering the weak cryptography 12224broken by non\sphinxhyphen{}cryptographic means. As such, upgrading \sphinxcode{\sphinxupquote{K/M}} to a stronger 12225encryption type is unlikely to be a high\sphinxhyphen{}priority task. 12226 12227\sphinxAtStartPar 12228Is is possible to upgrade the master key used for the database, if 12229desired. Using {\hyperref[\detokenize{admin/admin_commands/kdb5_util:kdb5-util-8}]{\sphinxcrossref{\DUrole{std,std-ref}{kdb5\_util}}}}’s \sphinxstylestrong{add\_mkey}, \sphinxstylestrong{use\_mkey}, and 12230\sphinxstylestrong{update\_princ\_encryption} commands, a new master key can be added 12231and activated for use on new key material, and the existing entries 12232converted to the new master key. 12233 12234 12235\chapter{Various links} 12236\label{\detokenize{admin/various_envs:various-links}}\label{\detokenize{admin/various_envs::doc}} 12237 12238\section{Whitepapers} 12239\label{\detokenize{admin/various_envs:whitepapers}}\begin{enumerate} 12240\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 12241\item {} 12242\sphinxAtStartPar 12243\sphinxurl{https://kerberos.org/software/whitepapers.html} 12244 12245\end{enumerate} 12246 12247 12248\section{Tutorials} 12249\label{\detokenize{admin/various_envs:tutorials}}\begin{enumerate} 12250\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 12251\item {} 12252\sphinxAtStartPar 12253Fulvio Ricciardi \textless{}\sphinxurl{https://www.kerberos.org/software/tutorial.html}\textgreater{}\_ 12254 12255\end{enumerate} 12256 12257 12258\section{Troubleshooting} 12259\label{\detokenize{admin/various_envs:troubleshooting}}\begin{enumerate} 12260\sphinxsetlistlabels{\arabic}{enumi}{enumii}{}{.}% 12261\item {} 12262\sphinxAtStartPar 12263\sphinxurl{https://wiki.ncsa.illinois.edu/display/ITS/Windows+Kerberos+Troubleshooting} 12264 12265\item {} 12266\sphinxAtStartPar 12267\sphinxurl{https://www.shrubbery.net/solaris9ab/SUNWaadm/SYSADV6/p27.html} 12268 12269\item {} 12270\sphinxAtStartPar 12271\sphinxurl{https://docs.oracle.com/cd/E19253-01/816-4557/trouble-1/index.html} 12272 12273\item {} 12274\sphinxAtStartPar 12275\sphinxurl{https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb463167(v=technet.10})\#EBAA 12276 12277\item {} 12278\sphinxAtStartPar 12279\sphinxurl{https://bugs.launchpad.net/ubuntu/+source/libpam-heimdal/+bug/86528} 12280 12281\end{enumerate} 12282 12283 12284 12285\renewcommand{\indexname}{Index} 12286\printindex 12287\end{document}