1.\" $Id: krb5.conf.5,v 1.22 2001/08/30 18:54:01 joda Exp $ 2.\" 3.Dd April 11, 1999 4.Dt KRB5.CONF 5 5.Os HEIMDAL 6.Sh NAME 7.Nm /etc/krb5.conf 8.Nd configuration file for Kerberos 5 9.Sh DESCRIPTION 10The 11.Nm 12file specifies several configuration parameters for the Kerberos 5 13library, as well as for some programs. 14.Pp 15The file consists of one or more sections, containing a number of 16bindings. The value of each binding can be either a string or a list 17of other bindings. The grammar looks like: 18.Bd -literal -offset indent 19file: 20 /* empty */ 21 sections 22 23sections: 24 section sections 25 section 26 27section: 28 '[' section_name ']' bindings 29 30section_name: 31 STRING 32 33bindings: 34 binding bindings 35 binding 36 37binding: 38 name '=' STRING 39 name '=' '{' bindings '}' 40 41name: 42 STRING 43 44.Ed 45.Li STRINGs 46consists of one or more non-white space characters. 47Currently recognised sections and bindings are: 48.Bl -tag -width "xxx" -offset indent 49.It Li [appdefaults] 50Specifies the default values to be used for Kerberos applications. 51You can specify defaults per application, realm, or a combination of 52these. The preference order is: 53.Bl -enum -compact 54.It 55.Va application Va realm Va option 56.It 57.Va application Va option 58.It 59.Va realm Va option 60.It 61.Va option 62.El 63.Pp 64The supported options are: 65.Bl -tag -width "xxx" -offset indent 66.It Li forwardable = Va boolean 67When obtaining initial credentials, make the credentials forwardable. 68.It Li proxiable = Va boolean 69When obtaining initial credentials, make the credentials proxiable. 70.It Li no-addresses = Va boolean 71When obtaining initial credentials, request them for an empty set of 72addresses, making the tickets valid from any address. 73.It Li ticket_lifetime = Va time 74Default ticket lifetime. 75.It Li renew_lifetime = Va time 76Default renewable ticket lifetime. 77.El 78.It Li [libdefaults] 79.Bl -tag -width "xxx" -offset indent 80.It Li default_realm = Va REALM 81Default realm to use, this is also known as your 82.Dq local realm . 83The default is the result of 84.Fn krb5_get_host_realm "local hostname" . 85.It Li clockskew = Va time 86Maximum time differential (in seconds) allowed when comparing 87times. Default is 300 seconds (five minutes). 88.It Li kdc_timeout = Va time 89Maximum time to wait for a reply from the kdc, default is 3 seconds. 90.It v4_name_convert 91.It v4_instance_resolve 92These are decribed in the 93.Xr krb5_425_conv_principal 3 94manual page. 95.It Li capath = { 96.Bl -tag -width "xxx" -offset indent 97.It Va destination-realm Li = Va next-hop-realm 98.It ... 99.El 100Normally, all requests to realms different from the one of the current 101client are sent to this KDC to get cross-realm tickets. 102If this KDC does not have a cross-realm key with the desired realm and 103the hierarchical path to that realm does not work, a path can be 104configured using this directive. 105The text shown above instructs the KDC to try to obtain a cross-realm 106ticket to 107.Va next-hop-realm 108when the desired realm is 109.Va destination-realm . 110This configuration should preferably be done on the KDC where it will 111help all its clients but can also be done on the client itself. 112.It Li } 113.It Li default_etypes = Va etypes... 114A list of default etypes to use. 115.It Li default_etypes_des = Va etypes... 116A list of default etypes to use when requesting a DES credential. 117.It Li default_keytab_name = Va keytab 118The keytab to use if none other is specified, default is 119.Dq FILE:/etc/krb5.keytab . 120.It Li kdc_timesync = Va boolean 121Try to keep track of the time differential between the local machine 122and the KDC, and then compensate for that when issuing requests. 123.It Li max_retries = Va number 124The max number of times to try to contact each KDC. 125.It Li ticket_lifetime = Va time 126Default ticket lifetime. 127.It Li renew_lifetime = Va time 128Default renewable ticket lifetime. 129.It Li forwardable = Va boolean 130When obtaining initial credentials, make the credentials forwardable. 131This option is also valid in the [realms] section. 132.It Li proxiable = Va boolean 133When obtaining initial credentials, make the credentials proxiable. 134This option is also valid in the [realms] section. 135.It Li verify_ap_req_nofail = Va boolean 136Enable to make a failure to verify obtained credentials 137non-fatal. This can be useful if there is no keytab on a host. 138.It Li warn_pwexpire = Va time 139How soon to warn for expiring password. Default is seven days. 140.It Li http_proxy = Va proxy-spec 141A HTTP-proxy to use when talking to the KDC via HTTP. 142.It Li dns_proxy = Va proxy-spec 143Enable using DNS via HTTP. 144.It Li extra_addresses = Va address... 145A list of addresses to get tickets for along with all local addresses. 146.It Li time_format = Va string 147How to print time strings in logs, this string is passed to 148.Xr strftime 3 . 149.It Li date_format = Va string 150How to print date strings in logs, this string is passed to 151.Xr strftime 3 . 152.It Li log_utc = Va boolean 153Write log-entries using UTC instead of your local time zone. 154.It Li srv_lookup = Va boolean 155Use DNS SRV records to lookup realm configuration information. 156.It Li scan_interfaces = Va boolean 157Scan all network interfaces for addresses, as opposed to simply using 158the address associated with the system's host name. 159.It Li fcache_version = Va int 160Use file credential cache format version specified. 161.It Li krb4_get_tickets = Va boolean 162Also get Kerberos 4 tickets in 163.Nm kinit , 164.Nm login , 165and other programs. 166This option is also valid in the [realms] section. 167.El 168.It Li [domain_realm] 169This is a list of mappings from DNS domain to Kerberos realm. Each 170binding in this section looks like: 171.Pp 172.Dl domain = realm 173.Pp 174The domain can be either a full name of a host or a trailing 175component, in the latter case the domain-string should start with a 176perid. 177.It Li [realms] 178.Bl -tag -width "xxx" -offset indent 179.It Va REALM Li = { 180.Bl -tag -width "xxx" -offset indent 181.It Li kdc = Va host[:port] 182Specifies a list of kdcs for this realm. If the optional port is absent, the 183default value for the 184.Dq kerberos/udp 185service will be used. 186The kdcs will be used in the order that they are specified. 187.It Li admin_server = Va host[:port] 188Specifies the admin server for this realm, where all the modifications 189to the database are perfomed. 190.It Li kpasswd_server = Va host[:port] 191Points to the server where all the password changes are perfomed. 192If there is no such entry, the kpasswd port on the admin_server host 193will be tried. 194.It Li krb524_server = Va Host[:port] 195Points to the server that does 524 conversions. If it is not 196mentioned, the krb524 port on the kdcs will be tried. 197.It Li v4_instance_convert 198.It Li v4_name_convert 199.It Li default_domain 200See 201.Xr krb5_425_conv_principal 3 . 202.El 203.It Li } 204.El 205.It Li [logging] 206.Bl -tag -width "xxx" -offset indent 207.It Va entity Li = Va destination 208Specifies that 209.Va entity 210should use the specified 211.Li destination 212for logging. See the 213.Xr krb5_openlog 3 214manual page for a list of defined destinations. 215.El 216.It Li [kdc] 217.Bl -tag -width "xxx" -offset indent 218.It database Li = { 219.Bl -tag -width "xxx" -offset indent 220.It dbname Li = Va DATABASENAME 221use this database for this realm. 222.It realm Li = Va REALM 223specifies the realm that will be stored in this database. 224.It mkey_file Li = Pa FILENAME 225use this keytab file for the master key of this database. 226If not specified 227.Va DATABASENAME Ns .mkey 228will be used. 229.It acl_file Li = PA FILENAME 230use this file for the ACL list of this database. 231.It log_file Li = Pa FILENAME 232use this file as the log of changes performed to the database. This 233file is used by 234.Nm ipropd-master 235for propagating changes to slaves. 236.El 237.It Li } 238.It max-request = Va SIZE 239Maximum size of a kdc request. 240.It require-preauth = Va BOOL 241If set pre-authentication is required. Since krb4 requests are not 242pre-authenticated they will be rejected. 243.It ports = Va "list of ports" 244list of ports the kdc should listen to. 245.It addresses = Va "list of interfaces" 246list of addresses the kdc should bind to. 247.It enable-kerberos4 = Va BOOL 248turn on kerberos4 support. 249.It v4-realm = Va REALM 250to what realm v4 requests should be mapped. 251.It enable-524 = Va BOOL 252should the Kerberos 524 converting facility be turned on. Default is same as 253.Va enable-kerberos4 . 254.It enable-http = Va BOOL 255should the kdc answer kdc-requests over http. 256.It enable-kaserver = Va BOOL 257if this kdc should emulate the AFS kaserver. 258.It check-ticket-addresses = Va BOOL 259verify the addresses in the tickets used in tgs requests. 260.\" XXX 261.It allow-null-ticket-addresses = Va BOOL 262allow addresses-less tickets. 263.\" XXX 264.It allow-anonymous = Va BOOL 265if the kdc is allowed to hand out anonymous tickets. 266.It encode_as_rep_as_tgs_rep = Va BOOL 267encode as-rep as tgs-rep tobe compatible with mistakes older DCE secd did. 268.\" XXX 269.It kdc_warn_pwexpire = Va TIME 270the time before expiration that the user should be warned that her 271password is about to expire. 272.It logging = Va Logging 273What type of logging the kdc should use, see also [logging]/kdc. 274.El 275.It Li [kadmin] 276.Bl -tag -width "xxx" -offset indent 277.It require-preauth = Va BOOL 278If pre-authentication is required to talk to the kadmin server. 279.It default_keys = Va keytypes... 280for each entry in 281.Va default_keys 282try to parse it as a sequence of 283.Va etype:salttype:salt 284syntax of this if something like: 285.Pp 286[(des|des3|etype):](pw-salt|afs3-salt)[:string] 287.Pp 288if 289.Ar etype 290is omitted it means everything, and if string is omitted is means the default string (for that principal). Additional special values of keyttypes are: 291.Bl -tag -width "xxx" -offset indent 292.It v5 293The kerberos 5 salt 294.Va pw-salt 295.It v4 296The kerberos 4 type 297.Va des:pw-salt: 298.El 299.It use_v4_salt = Va BOOL 300When true, this is the same as 301.Pp 302.Va default_keys = Va des3:pw-salt Va v4 303.Pp 304and is only left for backwards compatability. 305.El 306.El 307.Sh ENVIRONMENT 308.Ev KRB5_CONFIG 309points to the configuration file to read. 310.Sh EXAMPLE 311.Bd -literal -offset indent 312[libdefaults] 313 default_realm = FOO.SE 314[domain_realm] 315 .foo.se = FOO.SE 316 .bar.se = FOO.SE 317[realms] 318 FOO.SE = { 319 kdc = kerberos.foo.se 320 v4_name_convert = { 321 rcmd = host 322 } 323 v4_instance_convert = { 324 xyz = xyz.bar.se 325 } 326 default_domain = foo.se 327 } 328[logging] 329 kdc = FILE:/var/heimdal/kdc.log 330 kdc = SYSLOG:INFO 331 default = SYSLOG:INFO:USER 332.Ed 333.Sh DIAGNOSTICS 334Since 335.Nm 336is read and parsed by the krb5 library, there is not a lot of 337opportunities for programs to report parsing errors in any useful 338format. 339To help overcome this problem, there is a program 340.Nm verify_krb5_conf 341that reads 342.Nm 343and tries to emit useful diagnostics from parsing errors. Note that 344this program does not have any way of knowing what options are 345actually used and thus cannot warn about unknown or misspelled ones. 346.Sh SEE ALSO 347.Xr kinit 1 , 348.Xr krb5_425_conv_principal 3 , 349.Xr krb5_openlog 3 , 350.Xr strftime 3 , 351.Xr verify_krb5_conf 8 352