1.\" $Id: krb5.conf.5,v 1.17 2001/05/31 13:58:34 assar Exp $ 2.\" 3.Dd April 11, 1999 4.Dt KRB5.CONF 5 5.Os HEIMDAL 6.Sh NAME 7.Nm /etc/krb5.conf 8.Nd configuration file for Kerberos 5 9.Sh DESCRIPTION 10The 11.Nm 12file specifies several configuration parameters for the Kerberos 5 13library, as well as for some programs. 14.Pp 15The file consists of one or more sections, containing a number of 16bindings. The value of each binding can be either a string or a list 17of other bindings. The grammar looks like: 18.Bd -literal -offset indent 19file: 20 /* empty */ 21 sections 22 23sections: 24 section sections 25 section 26 27section: 28 '[' section_name ']' bindings 29 30section_name: 31 STRING 32 33bindings: 34 binding bindings 35 binding 36 37binding: 38 name '=' STRING 39 name '=' '{' bindings '}' 40 41name: 42 STRING 43 44.Ed 45.Li STRINGs 46consists of one or more non-white space characters. 47Currently recognised sections and bindings are: 48.Bl -tag -width "xxx" -offset indent 49.It Li [appdefaults] 50Specifies the default values to be used for Kerberos applications. 51You can specify defaults per application, realm, or a combination of 52these. The preference order is: 53.Bl -enum -compact 54.It 55.Va application Va realm Va option 56.It 57.Va application Va option 58.It 59.Va realm Va option 60.It 61.Va option 62.El 63.Pp 64The supported options are: 65.Bl -tag -width "xxx" -offset indent 66.It Li forwardable = Va boolean 67When obtaining initial credentials, make the credentials forwardable. 68.It Li proxiable = Va boolean 69When obtaining initial credentials, make the credentials proxiable. 70.It Li no-addresses = Va boolean 71When obtaining initial credentials, request them for an empty set of 72addresses, making the tickets valid from any address. 73.It Li ticket_life = Va time 74Default ticket lifetime. 75.It Li renew_lifetime = Va time 76Default renewable ticket lifetime. 77.El 78.It Li [libdefaults] 79.Bl -tag -width "xxx" -offset indent 80.It Li default_realm = Va REALM 81Default realm to use, this is also known as your 82.Dq local realm . 83The default is the result of 84.Fn krb5_get_host_realm "local hostname" . 85.It Li clockskew = Va time 86Maximum time differential (in seconds) allowed when comparing 87times. Default is 300 seconds (five minutes). 88.It Li kdc_timeout = Va time 89Maximum time to wait for a reply from the kdc, default is 3 seconds. 90.It v4_name_convert 91.It v4_instance_resolve 92These are decribed in the 93.Xr krb5_425_conv_principal 3 94manual page. 95.It Li capath = { 96.Bl -tag -width "xxx" -offset indent 97.It Va destination-realm Li = Va next-hop-realm 98.It ... 99.El 100Normally, all requests to realms different from the one of the current 101client are sent to this KDC to get cross-realm tickets. 102If this KDC does not have a cross-realm key with the desired realm and 103the hierarchical path to that realm does not work, a path can be 104configured using this directive. 105The text shown above instructs the KDC to try to obtain a cross-realm 106ticket to 107.Va next-hop-realm 108when the desired realm is 109.Va destination-realm . 110This configuration should preferably be done on the KDC where it will 111help all its clients but can also be done on the client itself. 112.It Li } 113.It Li default_etypes = Va etypes... 114A list of default etypes to use. 115.It Li default_etypes_des = Va etypes... 116A list of default etypes to use when requesting a DES credential. 117.It Li default_keytab_name = Va keytab 118The keytab to use if none other is specified, default is 119.Dq FILE:/etc/krb5.keytab . 120.It Li kdc_timesync = Va boolean 121Try to keep track of the time differential between the local machine 122and the KDC, and then compensate for that when issuing requests. 123.It Li max_retries = Va number 124The max number of times to try to contact each KDC. 125.It Li ticket_lifetime = Va time 126Default ticket lifetime. 127.It Li renew_lifetime = Va time 128Default renewable ticket lifetime. 129.It Li forwardable = Va boolean 130When obtaining initial credentials, make the credentials forwardable. 131This option is also valid in the [realms] section. 132.It Li proxiable = Va boolean 133When obtaining initial credentials, make the credentials proxiable. 134This option is also valid in the [realms] section. 135.It Li verify_ap_req_nofail = Va boolean 136Enable to make a failure to verify obtained credentials 137non-fatal. This can be useful if there is no keytab on a host. 138.It Li warn_pwexpire = Va time 139How soon to warn for expiring password. Default is seven days. 140.It Li http_proxy = Va proxy-spec 141A HTTP-proxy to use when talking to the KDC via HTTP. 142.It Li dns_proxy = Va proxy-spec 143Enable using DNS via HTTP. 144.It Li extra_addresses = Va address... 145A list of addresses to get tickets for along with all local addresses. 146.It Li time_format = Va string 147How to print time strings in logs, this string is passed to 148.Xr strftime 3 . 149.It Li date_format = Va string 150How to print date strings in logs, this string is passed to 151.Xr strftime 3 . 152.It Li log_utc = Va boolean 153Write log-entries using UTC instead of your local time zone. 154.It Li srv_lookup = Va boolean 155Use DNS SRV records to lookup realm configuration information. 156.It Li srv_try_txt = Va boolean 157If a SRV lookup fails, try looking up the same info in a DNS TXT record. 158.It Li scan_interfaces = Va boolean 159Scan all network interfaces for addresses, as opposed to simply using 160the address associated with the system's host name. 161.It Li fcache_version = Va int 162Use file credential cache format version specified. 163.It Li krb4_get_tickets = Va boolean 164Also get Kerberos 4 tickets in 165.Nm kinit 166and other programs. 167This option is also valid in the [realms] section. 168.El 169.It Li [domain_realm] 170This is a list of mappings from DNS domain to Kerberos realm. Each 171binding in this section looks like: 172.Pp 173.Dl domain = realm 174.Pp 175The domain can be either a full name of a host or a trailing 176component, in the latter case the domain-string should start with a 177perid. 178.It Li [realms] 179.Bl -tag -width "xxx" -offset indent 180.It Va REALM Li = { 181.Bl -tag -width "xxx" -offset indent 182.It Li kdc = Va host[:port] 183Specifies a list of kdcs for this realm. If the optional port is absent, the 184default value for the 185.Dq kerberos/udp 186service will be used. 187The kdcs will be used in the order that they are specified. 188.It Li admin_server = Va host[:port] 189Specifies the admin server for this realm, where all the modifications 190to the database are perfomed. 191.It Li kpasswd_server = Va host[:port] 192Points to the server where all the password changes are perfomed. 193If there is no such entry, the kpasswd port on the admin_server host 194will be tried. 195.It Li v4_instance_convert 196.It Li v4_name_convert 197.It Li default_domain 198See 199.Xr krb5_425_conv_principal 3 . 200.El 201.It Li } 202.El 203.It Li [logging] 204.Bl -tag -width "xxx" -offset indent 205.It Va entity Li = Va destination 206Specifies that 207.Va entity 208should use the specified 209.Li destination 210for logging. See the 211.Xr krb5_openlog 3 212manual page for a list of defined destinations. 213.El 214.It Li [kdc] 215.Bl -tag -width "xxx" -offset indent 216.It database Li = { 217.Bl -tag -width "xxx" -offset indent 218.It dbname Li = Va DATABASENAME 219use this database for this realm. 220.It realm Li = Va REALM 221specifies the realm that will be stored in this database. 222.It mkey_file Li = Pa FILENAME 223use this keytab file for the master key of this database. 224If not specified 225.Va DATABASENAME Ns .mkey 226will be used. 227.It acl_file Li = PA FILENAME 228use this file for the ACL list of this database. 229.It log_file Li = Pa FILENAME 230use this file as the log of changes performed to the database. This 231file is used by 232.Nm ipropd-master 233for propagating changes to slaves. 234.El 235.It Li } 236.It max-request = Va SIZE 237Maximum size of a kdc request. 238.It require-preauth = Va BOOL 239If set pre-authentication is required. Since krb4 requests are not 240pre-authenticated they will be rejected. 241.It ports = Va "list of ports" 242list of ports the kdc should listen to. 243.It addresses = Va "list of interfaces" 244list of addresses the kdc should bind to. 245.It enable-kerberos4 = Va BOOL 246turn on kerberos4 support. 247.It v4-realm = Va REALM 248to what realm v4 requests should be mapped. 249.It enable-524 = Va BOOL 250should the Kerberos 524 converting facility be turned on. Default is same as 251.Va enable-kerberos4 . 252.It enable-http = Va BOOL 253should the kdc answer kdc-requests over http. 254.It enable-kaserver = Va BOOL 255if this kdc should emulate the AFS kaserver. 256.It check-ticket-addresses = Va BOOL 257verify the addresses in the tickets used in tgs requests. 258.\" XXX 259.It allow-null-ticket-addresses = Va BOOL 260allow addresses-less tickets. 261.\" XXX 262.It allow-anonymous = Va BOOL 263if the kdc is allowed to hand out anonymous tickets. 264.It encode_as_rep_as_tgs_rep = Va BOOL 265encode as-rep as tgs-rep tobe compatible with mistakes older DCE secd did. 266.\" XXX 267.It kdc_warn_pwexpire = Va TIME 268the time before expiration that the user should be warned that her 269password is about to expire. 270.It logging = Va Logging 271What type of logging the kdc should use, see also [logging]/kdc. 272.El 273.It Li [kadmin] 274.Bl -tag -width "xxx" -offset indent 275.It require-preauth = Va BOOL 276If pre-authentication is required to talk to the kadmin server. 277.It default_keys = Va keytypes... 278for each entry in 279.Va default_keys 280try to parse it as a sequence of 281.Va etype:salttype:salt 282syntax of this if something like: 283.Pp 284[(des|des3|etype):](pw-salt|afs3-salt)[:string] 285.Pp 286if 287.Ar etype 288is omitted it means everything, and if string is omitted is means the default string (for that principal). Additional special values of keyttypes are: 289.Bl -tag -width "xxx" -offset indent 290.It v5 291The kerberos 5 salt 292.Va pw-salt 293.It v4 294The kerberos 4 type 295.Va des:pw-salt: 296.El 297.It use_v4_salt = Va BOOL 298When true, this is the same as 299.Pp 300.Va default_keys = Va des3:pw-salt Va v4 301.Pp 302and is only left for backwards compatability. 303.El 304.El 305.Sh ENVIRONMENT 306.Ev KRB5_CONFIG 307points to the configuration file to read. 308.Sh EXAMPLE 309.Bd -literal -offset indent 310[libdefaults] 311 default_realm = FOO.SE 312[domain_realm] 313 .foo.se = FOO.SE 314 .bar.se = FOO.SE 315[realms] 316 FOO.SE = { 317 kdc = kerberos.foo.se 318 v4_name_convert = { 319 rcmd = host 320 } 321 v4_instance_convert = { 322 xyz = xyz.bar.se 323 } 324 default_domain = foo.se 325 } 326[logging] 327 kdc = FILE:/var/heimdal/kdc.log 328 kdc = SYSLOG:INFO 329 default = SYSLOG:INFO:USER 330.Ed 331.Sh DIAGNOSTICS 332Since 333.Nm 334is read and parsed by the krb5 library, there is not a lot of 335opportunities for programs to report parsing errors in any useful 336format. 337To help overcome this problem, there is a program 338.Nm verify_krb5_conf 339that reads 340.Nm 341and tries to emit useful diagnostics from parsing errors. Note that 342this program does not have any way of knowing what options are 343actually used and thus cannot warn about unknown or misspelt ones. 344.Sh SEE ALSO 345.Xr verify_krb5_conf 8 , 346.Xr krb5_openlog 3 , 347.Xr krb5_425_conv_principal 3 , 348.Xr strftime 3 , 349.Xr kinit 1 , 350.Xr Source tm 351