1.\" Copyright (c) 2003 - 2004 Kungliga Tekniska Högskolan 2.\" (Royal Institute of Technology, Stockholm, Sweden). 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" 3. Neither the name of the Institute nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" $Id$ 33.\" 34.Dd August 24, 2006 35.Dt KDC 8 36.Os HEIMDAL 37.Sh NAME 38.Nm kdc 39.Nd Kerberos 5 server 40.Sh SYNOPSIS 41.Nm 42.Bk -words 43.Oo Fl c Ar file \*(Ba Xo 44.Fl Fl config-file= Ns Ar file 45.Xc 46.Oc 47.Op Fl p | Fl Fl no-require-preauth 48.Op Fl Fl max-request= Ns Ar size 49.Op Fl H | Fl Fl enable-http 50.Op Fl Fl no-524 51.Op Fl Fl kerberos4 52.Op Fl Fl kerberos4-cross-realm 53.Oo Fl r Ar string \*(Ba Xo 54.Fl Fl v4-realm= Ns Ar string 55.Xc 56.Oc 57.Oo Fl P Ar portspec \*(Ba Xo 58.Fl Fl ports= Ns Ar portspec 59.Xc 60.Oc 61.Op Fl Fl detach 62.Op Fl Fl disable-des 63.Op Fl Fl addresses= Ns Ar list of addresses 64.Ek 65.Sh DESCRIPTION 66.Nm 67serves requests for tickets. 68When it starts, it first checks the flags passed, any options that are 69not specified with a command line flag are taken from a config file, 70or from a default compiled-in value. 71.Pp 72Options supported: 73.Bl -tag -width Ds 74.It Fl c Ar file , Fl Fl config-file= Ns Ar file 75Specifies the location of the config file, the default is 76.Pa /var/heimdal/kdc.conf . 77This is the only value that can't be specified in the config file. 78.It Fl p , Fl Fl no-require-preauth 79Turn off the requirement for pre-authentication in the initial AS-REQ 80for all principals. 81The use of pre-authentication makes it more difficult to do offline 82password attacks. 83You might want to turn it off if you have clients 84that don't support pre-authentication. 85Since the version 4 protocol doesn't support any pre-authentication, 86serving version 4 clients is just about the same as not requiring 87pre-authentication. 88The default is to require pre-authentication. 89Adding the require-preauth per principal is a more flexible way of 90handling this. 91.It Fl Fl max-request= Ns Ar size 92Gives an upper limit on the size of the requests that the kdc is 93willing to handle. 94.It Fl H , Fl Fl enable-http 95Makes the kdc listen on port 80 and handle requests encapsulated in HTTP. 96.It Fl Fl no-524 97don't respond to 524 requests 98.It Fl Fl kerberos4 99respond to Kerberos 4 requests 100.It Fl Fl kerberos4-cross-realm 101respond to Kerberos 4 requests from foreign realms. 102This is a known security hole and should not be enabled unless you 103understand the consequences and are willing to live with them. 104.It Fl r Ar string , Fl Fl v4-realm= Ns Ar string 105What realm this server should act as when dealing with version 4 106requests. 107The database can contain any number of realms, but since the version 4 108protocol doesn't contain a realm for the server, it must be explicitly 109specified. 110The default is whatever is returned by 111.Fn krb_get_lrealm . 112This option is only available if the KDC has been compiled with version 1134 support. 114.It Fl P Ar portspec , Fl Fl ports= Ns Ar portspec 115Specifies the set of ports the KDC should listen on. 116It is given as a 117white-space separated list of services or port numbers. 118.It Fl Fl addresses= Ns Ar list of addresses 119The list of addresses to listen for requests on. 120By default, the kdc will listen on all the locally configured 121addresses. 122If only a subset is desired, or the automatic detection fails, this 123option might be used. 124.It Fl Fl detach 125detach from pty and run as a daemon. 126.It Fl Fl disable-des 127disable add des encryption types, makes the kdc not use them. 128.El 129.Pp 130All activities are logged to one or more destinations, see 131.Xr krb5.conf 5 , 132and 133.Xr krb5_openlog 3 . 134The entity used for logging is 135.Nm kdc . 136.Sh CONFIGURATION FILE 137The configuration file has the same syntax as 138.Xr krb5.conf 5 , 139but will be read before 140.Pa /etc/krb5.conf , 141so it may override settings found there. 142Options specific to the KDC only are found in the 143.Dq [kdc] 144section. 145All the command-line options can preferably be added in the 146configuration file. 147The only difference is the pre-authentication flag, which has to be 148specified as: 149.Pp 150.Dl require-preauth = no 151.Pp 152(in fact you can specify the option as 153.Fl Fl require-preauth=no ) . 154.Pp 155And there are some configuration options which do not have 156command-line equivalents: 157.Bl -tag -width "xxx" -offset indent 158.It Li enable-digest = Va boolean 159turn on support for digest processing in the KDC. 160The default is FALSE. 161.It Li check-ticket-addresses = Va boolean 162Check the addresses in the ticket when processing TGS requests. 163The default is TRUE. 164.It Li allow-null-ticket-addresses = Va boolean 165Permit tickets with no addresses. 166This option is only relevant when check-ticket-addresses is TRUE. 167.It Li allow-anonymous = Va boolean 168Permit anonymous tickets with no addresses. 169.It Li max-kdc-datagram-reply-length = Va number 170Maximum packet size the UDP rely that the KDC will transmit, instead 171the KDC sends back a reply telling the client to use TCP instead. 172.It Li transited-policy = Li always-check \*(Ba \ 173Li allow-per-principal | Li always-honour-request 174This controls how KDC requests with the 175.Li disable-transited-check 176flag are handled. It can be one of: 177.Bl -tag -width "xxx" -offset indent 178.It Li always-check 179Always check transited encoding, this is the default. 180.It Li allow-per-principal 181Currently this is identical to 182.Li always-check . 183In a future release, it will be possible to mark a principal as able 184to handle unchecked requests. 185.It Li always-honour-request 186Always do what the client asked. 187In a future release, it will be possible to force a check per 188principal. 189.El 190.It encode_as_rep_as_tgs_rep = Va boolean 191Encode AS-Rep as TGS-Rep to be bug-compatible with old DCE code. 192The Heimdal clients allow both. 193.It kdc_warn_pwexpire = Va time 194How long before password/principal expiration the KDC should start 195sending out warning messages. 196.El 197.Pp 198The configuration file is only read when the 199.Nm 200is started. 201If changes made to the configuration file are to take effect, the 202.Nm 203needs to be restarted. 204.Pp 205An example of a config file: 206.Bd -literal -offset indent 207[kdc] 208 require-preauth = no 209 v4-realm = FOO.SE 210.Ed 211.Sh BUGS 212If the machine running the KDC has new addresses added to it, the KDC 213will have to be restarted to listen to them. 214The reason it doesn't just listen to wildcarded (like INADDR_ANY) 215addresses, is that the replies has to come from the same address they 216were sent to, and most OS:es doesn't pass this information to the 217application. 218If your normal mode of operation require that you add and remove 219addresses, the best option is probably to listen to a wildcarded TCP 220socket, and make sure your clients use TCP to connect. 221For instance, this will listen to IPv4 TCP port 88 only: 222.Bd -literal -offset indent 223kdc --addresses=0.0.0.0 --ports="88/tcp" 224.Ed 225.Pp 226There should be a way to specify protocol, port, and address triplets, 227not just addresses and protocol, port tuples. 228.Sh SEE ALSO 229.Xr kinit 1 , 230.Xr krb5.conf 5 231