1.\" $Id: krb5.conf.5,v 1.12 2001/01/19 04:53:24 assar Exp $ 2.\" 3.Dd April 11, 1999 4.Dt KRB5.CONF 5 5.Os HEIMDAL 6.Sh NAME 7.Nm /etc/krb5.conf 8.Nd 9Configuration file for Kerberos 5 10.Sh DESCRIPTION 11The 12.Nm 13file specifies several configuration parameters for the Kerberos 5 14library, as well as for some programs. 15.Pp 16The file consists of one or more sections, containing a number of 17bindings. The value of each binding can be either a string or a list 18of other bindings. The grammar looks like: 19.Bd -literal -offset indent 20file: 21 /* empty */ 22 sections 23 24sections: 25 section sections 26 section 27 28section: 29 '[' section_name ']' bindings 30 31section_name: 32 STRING 33 34bindings: 35 binding bindings 36 binding 37 38binding: 39 name '=' STRING 40 name '=' '{' bindings '}' 41 42name: 43 STRING 44 45.Ed 46.Li STRINGs 47consists of one or more non-white space characters. 48Currently recognised sections and bindings are: 49.Bl -tag -width "xxx" -offset indent 50.It Li [libdefaults] 51.Bl -tag -width "xxx" -offset indent 52.It Li default_realm = Va REALM 53Default realm to use, this is also known as your 54.Dq local realm . 55The default is the result of 56.Fn krb5_get_host_realm "local hostname" . 57.It Li clockskew = Va time 58Maximum time differential (in seconds) allowed when comparing 59times. Default is 300 seconds (five minutes). 60.It Li kdc_timeout = Va time 61Maximum time to wait for a reply from the kdc, default is 3 seconds. 62.It v4_name_convert 63.It v4_instance_resolve 64These are decribed in the 65.Xr krb5_425_conv_principal 3 66manual page. 67.It Li capath = { 68.Bl -tag -width "xxx" -offset indent 69.It Va destination-realm Li = Va next-hop-realm 70.It ... 71.El 72Normally, all requests to realms different from the one of the current 73client are sent to this KDC to get cross-realm tickets. 74If this KDC does not have a cross-realm key with the desired realm and 75the hierarchical path to that realm does not work, a path can be 76configured using this directive. 77The text shown above instructs the KDC to try to obtain a cross-realm 78ticket to 79.Va next-hop-realm 80when the desired realm is 81.Va destination-realm . 82This configuration should preferably be done on the KDC where it will 83help all its clients but can also be done on the client itself. 84.It Li } 85.It Li default_etypes = Va etypes... 86A list of default etypes to use. 87.It Li default_etypes_des = Va etypes... 88A list of default etypes to use when requesting a DES credential. 89.It Li default_keytab_name = Va keytab 90The keytab to use if none other is specified, default is 91.Dq FILE:/etc/krb5.keytab . 92.It Li kdc_timesync = Va boolean 93Try to keep track of the time differential between the local machine 94and the KDC, and then compensate for that when issuing requests. 95.It Li max_retries = Va number 96The max number of times to try to contact each KDC. 97.It Li ticket_lifetime = Va time 98Default ticket lifetime. 99.It Li renew_lifetime = Va time 100Default renewable ticket lifetime. 101.It Li verify_ap_req_nofail = Va boolean 102Enable to make a failure to verify obtained credentials 103non-fatal. This can be useful if there is no keytab on a host. 104.It Li warn_pwexpire = Va time 105How soon to warn for expiring password. Default is seven days. 106.It Li http_proxy = Va proxy-spec 107A HTTP-proxy to use when talking to the KDC via HTTP. 108.It Li dns_proxy = Va proxy-spec 109Enable using DNS via HTTP. 110.It Li extra_addresses = Va address... 111A list of addresses to get tickets for along with all local addresses. 112.It Li time_format = Va string 113How to print time strings in logs, this string is passed to 114.Xr strftime 3 . 115.It Li log_utc = Va boolean 116Write log-entries using UTC instead of your local time zone. 117.El 118.It Li [domain_realm] 119This is a list of mappings from DNS domain to Kerberos realm. Each 120binding in this section looks like: 121.Pp 122.Dl domain = realm 123.Pp 124The domain can be either a full name of a host or a trailing 125component, in the latter case the domain-string should start with a 126perid. 127.It Li [realms] 128.Bl -tag -width "xxx" -offset indent 129.It Va REALM Li = { 130.Bl -tag -width "xxx" -offset indent 131.It Li kdc = Va host[:port] 132Specifies a list of kdcs for this realm. If the optional port is absent, the 133default value for the 134.Dq kerberos/udp 135service will be used. 136The kdcs will be used in the order that they are specified. 137.It Li admin_server = Va host[:port] 138Specifies the admin server for this realm, where all the modifications 139to the database are perfomed. 140.It Li kpasswd_server = Va host[:port] 141Points to the server where all the password changes are perfomed. 142If there is no such entry, the kpasswd port on the admin_server host 143will be tried. 144.It Li v4_instance_convert 145.It Li v4_name_convert 146.It Li default_domain 147See 148.Xr krb5_425_conv_principal 3 . 149.El 150.It Li } 151.El 152.It Li [logging] 153.Bl -tag -width "xxx" -offset indent 154.It Va entity Li = Va destination 155Specifies that 156.Va entity 157should use the specified 158.Li destination 159for logging. See the 160.Xr krb5_openlog 3 161manual page for a list of defined destinations. 162.El 163.It Li [kdc] 164.Bl -tag -width "xxx" -offset indent 165.It database Li = { 166.Bl -tag -width "xxx" -offset indent 167.It dbname Li = Va DATABASENAME 168use this database for this realm. 169.It realm Li = Va REALM 170specifies the realm that will be stored in this database. 171.It mkey_file Li = Pa FILENAME 172use this keytab file for the master key of this database. 173If not specified 174.Va DATABASENAME Ns .mkey 175will be used. 176.It acl_file Li = PA FILENAME 177use this file for the ACL list of this database. 178.It log_file Li = Pa FILENAME 179use this file as the log of changes performed to the database. This 180file is used by 181.Nm ipropd-master 182for propagating changes to slaves. 183.El 184.It Li } 185.It max-request = Va SIZE 186Maximum size of a kdc request. 187.It require-preauth = Va BOOL 188If set pre-authentication is required. Since krb4 requests are not 189pre-authenticated they will be rejected. 190.It ports = Va "list of ports" 191list of ports the kdc should listen to. 192.It addresses = Va "list of interfaces" 193list of addresses the kdc should bind to. 194.It enable-kerberos4 = Va BOOL 195turn on kerberos4 support. 196.It v4-realm = Va REALM 197to what realm v4 requests should be mapped. 198.It enable-524 = Va BOOL 199should the Kerberos 524 converting facility be turned on. Default is same as 200.Va enable-kerberos4 . 201.It enable-http = Va BOOL 202should the kdc answer kdc-requests over http. 203.It enable-kaserver = Va BOOL 204if this kdc should emulate the AFS kaserver. 205.It check-ticket-addresses = Va BOOL 206verify the addresses in the tickets used in tgs requests. 207.\" XXX 208.It allow-null-ticket-addresses = Va BOOL 209allow addresses-less tickets. 210.\" XXX 211.It allow-anonymous = Va BOOL 212if the kdc is allowed to hand out anonymous tickets. 213.It encode_as_rep_as_tgs_rep = Va BOOL 214encode as-rep as tgs-rep tobe compatible with mistakes older DCE secd did. 215.\" XXX 216.It kdc_warn_pwexpire = Va TIME 217the time before expiration that the user should be warned that her 218password is about to expire. 219.It logging = Va Logging 220What type of logging the kdc should use, see also [logging]/kdc. 221.El 222.It Li [kadmin] 223.Bl -tag -width "xxx" -offset indent 224.It require-preauth = Va BOOL 225If pre-authentication is required to talk to the kadmin server. 226.It default_keys = Va keytypes... 227for each entry in 228.Va default_keys 229try to parse it as a sequence of 230.Va etype:salttype:salt 231syntax of this if something like: 232.Pp 233[(des|des3|etype):](pw-salt|afs3-salt)[:string] 234.Pp 235if 236.Ar etype 237is omitted it means everything, and if string is omitted is means the default string (for that principal). Additional special values of keyttypes are: 238.Bl -tag -width "xxx" -offset indent 239.It v5 240The kerberos 5 salt 241.Va pw-salt 242.It v4 243The kerberos 4 type 244.Va des:pw-salt: 245.El 246.It use_v4_salt = Va BOOL 247When true, this is the same as 248.Pp 249.Va default_keys = Va des3:pw-salt Va v4 250.Pp 251and is only left for backwards compatability. 252.El 253.El 254.Sh ENVIRONMENT 255.Ev KRB5_CONFIG 256points to the configuration file to read. 257.Sh EXAMPLE 258.Bd -literal -offset indent 259[lib_defaults] 260 default_domain = FOO.SE 261[domain_realm] 262 .foo.se = FOO.SE 263 .bar.se = FOO.SE 264[realms] 265 FOO.SE = { 266 kdc = kerberos.foo.se 267 v4_name_convert = { 268 rcmd = host 269 } 270 v4_instance_convert = { 271 xyz = xyz.bar.se 272 } 273 default_domain = foo.se 274 } 275[logging] 276 kdc = FILE:/var/heimdal/kdc.log 277 kdc = SYSLOG:INFO 278 default = SYSLOG:INFO:USER 279.Ed 280.Sh DIAGNOSTICS 281Since 282.Nm 283is read and parsed by the krb5 library, there is not a lot of 284opportunities for programs to report parsing errors in any useful 285format. 286To help overcome this problem, there is a program 287.Nm verify_krb5_conf 288that reads 289.Nm 290and tries to emit useful diagnostics from parsing errors. Note that 291this program does not have any way of knowing what options are 292actually used and thus cannot warn about unknown or misspelt ones. 293.Sh SEE ALSO 294.Xr verify_krb5_conf 8 , 295.Xr krb5_openlog 3 , 296.Xr krb5_425_conv_principal 3 , 297.Xr strftime 3 , 298.Xr Source tm 299