xref: /freebsd/crypto/krb5/doc/html/admin/database.html (revision 7f2fe78b9dd5f51c821d771b63d2e096f6fd49e9) 
1*7f2fe78bSCy Schubert
2*7f2fe78bSCy Schubert<!DOCTYPE html>
3*7f2fe78bSCy Schubert
4*7f2fe78bSCy Schubert<html>
5*7f2fe78bSCy Schubert  <head>
6*7f2fe78bSCy Schubert    <meta charset="utf-8" />
7*7f2fe78bSCy Schubert    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
8*7f2fe78bSCy Schubert
9*7f2fe78bSCy Schubert    <title>Database administration &#8212; MIT Kerberos Documentation</title>
10*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
11*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />
12*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />
13*7f2fe78bSCy Schubert    <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
14*7f2fe78bSCy Schubert    <script src="../_static/jquery.js"></script>
15*7f2fe78bSCy Schubert    <script src="../_static/underscore.js"></script>
16*7f2fe78bSCy Schubert    <script src="../_static/doctools.js"></script>
17*7f2fe78bSCy Schubert    <link rel="author" title="About these documents" href="../about.html" />
18*7f2fe78bSCy Schubert    <link rel="index" title="Index" href="../genindex.html" />
19*7f2fe78bSCy Schubert    <link rel="search" title="Search" href="../search.html" />
20*7f2fe78bSCy Schubert    <link rel="copyright" title="Copyright" href="../copyright.html" />
21*7f2fe78bSCy Schubert    <link rel="next" title="Database types" href="dbtypes.html" />
22*7f2fe78bSCy Schubert    <link rel="prev" title="Realm configuration decisions" href="realm_config.html" />
23*7f2fe78bSCy Schubert  </head><body>
24*7f2fe78bSCy Schubert    <div class="header-wrapper">
25*7f2fe78bSCy Schubert        <div class="header">
26*7f2fe78bSCy Schubert
27*7f2fe78bSCy Schubert
28*7f2fe78bSCy Schubert            <h1><a href="../index.html">MIT Kerberos Documentation</a></h1>
29*7f2fe78bSCy Schubert
30*7f2fe78bSCy Schubert            <div class="rel">
31*7f2fe78bSCy Schubert
32*7f2fe78bSCy Schubert        <a href="../index.html" title="Full Table of Contents"
33*7f2fe78bSCy Schubert            accesskey="C">Contents</a> |
34*7f2fe78bSCy Schubert        <a href="realm_config.html" title="Realm configuration decisions"
35*7f2fe78bSCy Schubert            accesskey="P">previous</a> |
36*7f2fe78bSCy Schubert        <a href="dbtypes.html" title="Database types"
37*7f2fe78bSCy Schubert            accesskey="N">next</a> |
38*7f2fe78bSCy Schubert        <a href="../genindex.html" title="General Index"
39*7f2fe78bSCy Schubert            accesskey="I">index</a> |
40*7f2fe78bSCy Schubert        <a href="../search.html" title="Enter search criteria"
41*7f2fe78bSCy Schubert            accesskey="S">Search</a> |
42*7f2fe78bSCy Schubert    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Database administration">feedback</a>
43*7f2fe78bSCy Schubert            </div>
44*7f2fe78bSCy Schubert        </div>
45*7f2fe78bSCy Schubert    </div>
46*7f2fe78bSCy Schubert
47*7f2fe78bSCy Schubert    <div class="content-wrapper">
48*7f2fe78bSCy Schubert      <div class="content">
49*7f2fe78bSCy Schubert        <div class="document">
50*7f2fe78bSCy Schubert
51*7f2fe78bSCy Schubert      <div class="documentwrapper">
52*7f2fe78bSCy Schubert        <div class="bodywrapper">
53*7f2fe78bSCy Schubert          <div class="body" role="main">
54*7f2fe78bSCy Schubert
55*7f2fe78bSCy Schubert  <section id="database-administration">
56*7f2fe78bSCy Schubert<h1>Database administration<a class="headerlink" href="#database-administration" title="Permalink to this headline">¶</a></h1>
57*7f2fe78bSCy Schubert<p>A Kerberos database contains all of a realm’s Kerberos principals,
58*7f2fe78bSCy Schuberttheir passwords, and other administrative information about each
59*7f2fe78bSCy Schubertprincipal.  For the most part, you will use the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a>
60*7f2fe78bSCy Schubertprogram to manipulate the Kerberos database as a whole, and the
61*7f2fe78bSCy Schubert<a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> program to make changes to the entries in the
62*7f2fe78bSCy Schubertdatabase.  (One notable exception is that users will use the
63*7f2fe78bSCy Schubert<a class="reference internal" href="../user/user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a> program to change their own passwords.)  The kadmin
64*7f2fe78bSCy Schubertprogram has its own command-line interface, to which you type the
65*7f2fe78bSCy Schubertdatabase administrating commands.</p>
66*7f2fe78bSCy Schubert<p><a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> provides a means to create, delete, load, or dump
67*7f2fe78bSCy Schuberta Kerberos database.  It also contains commands to roll over the
68*7f2fe78bSCy Schubertdatabase master key, and to stash a copy of the key so that the
69*7f2fe78bSCy Schubert<a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> and <a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a> daemons can use the database
70*7f2fe78bSCy Schubertwithout manual input.</p>
71*7f2fe78bSCy Schubert<p><a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> provides for the maintenance of Kerberos principals,
72*7f2fe78bSCy Schubertpassword policies, and service key tables (keytabs).  Normally it
73*7f2fe78bSCy Schubertoperates as a network client using Kerberos authentication to
74*7f2fe78bSCy Schubertcommunicate with <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, but there is also a variant, named
75*7f2fe78bSCy Schubertkadmin.local, which directly accesses the Kerberos database on the
76*7f2fe78bSCy Schubertlocal filesystem (or through LDAP).  kadmin.local is necessary to set
77*7f2fe78bSCy Schubertup enough of the database to be able to use the remote version.</p>
78*7f2fe78bSCy Schubert<p>kadmin can authenticate to the admin server using the service
79*7f2fe78bSCy Schubertprincipal <code class="docutils literal notranslate"><span class="pre">kadmin/admin</span></code> or <code class="docutils literal notranslate"><span class="pre">kadmin/HOST</span></code> (where <em>HOST</em> is the
80*7f2fe78bSCy Schuberthostname of the admin server).  If the credentials cache contains a
81*7f2fe78bSCy Schubertticket for either service principal and the <strong>-c</strong> ccache option is
82*7f2fe78bSCy Schubertspecified, that ticket is used to authenticate to KADM5.  Otherwise,
83*7f2fe78bSCy Schubertthe <strong>-p</strong> and <strong>-k</strong> options are used to specify the client Kerberos
84*7f2fe78bSCy Schubertprincipal name used to authenticate.  Once kadmin has determined the
85*7f2fe78bSCy Schubertprincipal name, it requests a <code class="docutils literal notranslate"><span class="pre">kadmin/admin</span></code> Kerberos service ticket
86*7f2fe78bSCy Schubertfrom the KDC, and uses that service ticket to authenticate to KADM5.</p>
87*7f2fe78bSCy Schubert<p>See <a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> for the available kadmin and kadmin.local
88*7f2fe78bSCy Schubertcommands and options.</p>
89*7f2fe78bSCy Schubert<section id="principals">
90*7f2fe78bSCy Schubert<span id="id1"></span><h2>Principals<a class="headerlink" href="#principals" title="Permalink to this headline">¶</a></h2>
91*7f2fe78bSCy Schubert<p>Each entry in the Kerberos database contains a Kerberos principal and
92*7f2fe78bSCy Schubertthe attributes and policies associated with that principal.</p>
93*7f2fe78bSCy Schubert<p>To add a principal to the database, use the <a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>
94*7f2fe78bSCy Schubert<strong>add_principal</strong> command.  User principals should usually be created
95*7f2fe78bSCy Schubertwith the <code class="docutils literal notranslate"><span class="pre">+requires_preauth</span> <span class="pre">-allow_svr</span></code> options to help mitigate
96*7f2fe78bSCy Schubertdictionary attacks (see <a class="reference internal" href="dictionary.html#dictionary"><span class="std std-ref">Addressing dictionary attack risks</span></a>):</p>
97*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">+</span><span class="n">requires_preauth</span> <span class="o">-</span><span class="n">allow_svr</span> <span class="n">alice</span>
98*7f2fe78bSCy Schubert<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="s2">&quot;alice@KRBTEST.COM&quot;</span><span class="p">:</span>
99*7f2fe78bSCy Schubert<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="s2">&quot;alice@KRBTEST.COM&quot;</span><span class="p">:</span>
100*7f2fe78bSCy Schubert</pre></div>
101*7f2fe78bSCy Schubert</div>
102*7f2fe78bSCy Schubert<p>User principals which will authenticate with <a class="reference internal" href="pkinit.html#pkinit"><span class="std std-ref">PKINIT configuration</span></a> should
103*7f2fe78bSCy Schubertinstead by created with the <code class="docutils literal notranslate"><span class="pre">-nokey</span></code> option:</p>
104*7f2fe78bSCy Schubert<blockquote>
105*7f2fe78bSCy Schubert<div><p>kadmin: addprinc -nokey alice</p>
106*7f2fe78bSCy Schubert</div></blockquote>
107*7f2fe78bSCy Schubert<p>Service principals can be created with the <code class="docutils literal notranslate"><span class="pre">-nokey</span></code> option;
108*7f2fe78bSCy Schubertlong-term keys will be added when a keytab is generated:</p>
109*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">-</span><span class="n">nokey</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span>
110*7f2fe78bSCy Schubert<span class="n">kadmin</span><span class="p">:</span> <span class="n">ktadd</span> <span class="o">-</span><span class="n">k</span> <span class="n">foo</span><span class="o">.</span><span class="n">keytab</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span>
111*7f2fe78bSCy Schubert<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">1</span><span class="p">,</span> <span class="n">encryption</span> <span class="nb">type</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">WRFILE</span><span class="p">:</span><span class="n">foo</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span>
112*7f2fe78bSCy Schubert<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">1</span><span class="p">,</span> <span class="n">encryption</span> <span class="nb">type</span> <span class="n">aes128</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">WRFILE</span><span class="p">:</span><span class="n">foo</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span>
113*7f2fe78bSCy Schubert</pre></div>
114*7f2fe78bSCy Schubert</div>
115*7f2fe78bSCy Schubert<p>To modify attributes of an existing principal, use the kadmin
116*7f2fe78bSCy Schubert<strong>modify_principal</strong> command:</p>
117*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">modprinc</span> <span class="o">-</span><span class="n">expire</span> <span class="n">tomorrow</span> <span class="n">alice</span>
118*7f2fe78bSCy Schubert<span class="n">Principal</span> <span class="s2">&quot;alice@KRBTEST.COM&quot;</span> <span class="n">modified</span><span class="o">.</span>
119*7f2fe78bSCy Schubert</pre></div>
120*7f2fe78bSCy Schubert</div>
121*7f2fe78bSCy Schubert<p>To delete a principal, use the kadmin <strong>delete_principal</strong> command:</p>
122*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>kadmin: delprinc alice
123*7f2fe78bSCy SchubertAre you sure you want to delete the principal &quot;alice@KRBTEST.COM&quot;? (yes/no): yes
124*7f2fe78bSCy SchubertPrincipal &quot;alice@KRBTEST.COM&quot; deleted.
125*7f2fe78bSCy SchubertMake sure that you have removed this principal from all ACLs before reusing.
126*7f2fe78bSCy Schubert</pre></div>
127*7f2fe78bSCy Schubert</div>
128*7f2fe78bSCy Schubert<p>To change a principal’s password, use the kadmin <strong>change_password</strong>
129*7f2fe78bSCy Schubertcommand.  Password changes made through kadmin are subject to the same
130*7f2fe78bSCy Schubertpassword policies as would apply to password changes made through
131*7f2fe78bSCy Schubert<a class="reference internal" href="../user/user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>.</p>
132*7f2fe78bSCy Schubert<p>To view the attributes of a principal, use the kadmin`
133*7f2fe78bSCy Schubert<strong>get_principal</strong> command.</p>
134*7f2fe78bSCy Schubert<p>To generate a listing of principals, use the kadmin
135*7f2fe78bSCy Schubert<strong>list_principals</strong> command.</p>
136*7f2fe78bSCy Schubert</section>
137*7f2fe78bSCy Schubert<section id="policies">
138*7f2fe78bSCy Schubert<span id="id2"></span><h2>Policies<a class="headerlink" href="#policies" title="Permalink to this headline">¶</a></h2>
139*7f2fe78bSCy Schubert<p>A policy is a set of rules governing passwords.  Policies can dictate
140*7f2fe78bSCy Schubertminimum and maximum password lifetimes, minimum number of characters
141*7f2fe78bSCy Schubertand character classes a password must contain, and the number of old
142*7f2fe78bSCy Schubertpasswords kept in the database.</p>
143*7f2fe78bSCy Schubert<p>To add a new policy, use the <a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> <strong>add_policy</strong> command:</p>
144*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">addpol</span> <span class="o">-</span><span class="n">maxlife</span> <span class="s2">&quot;1 year&quot;</span> <span class="o">-</span><span class="n">history</span> <span class="mi">3</span> <span class="n">stduser</span>
145*7f2fe78bSCy Schubert</pre></div>
146*7f2fe78bSCy Schubert</div>
147*7f2fe78bSCy Schubert<p>To modify attributes of a principal, use the kadmin <strong>modify_policy</strong>
148*7f2fe78bSCy Schubertcommand.  To delete a policy, use the kadmin <strong>delete_policy</strong>
149*7f2fe78bSCy Schubertcommand.</p>
150*7f2fe78bSCy Schubert<p>To associate a policy with a principal, use the kadmin
151*7f2fe78bSCy Schubert<strong>modify_principal</strong> command with the <strong>-policy</strong> option:</p>
152*7f2fe78bSCy Schubert<blockquote>
153*7f2fe78bSCy Schubert<div><p>kadmin: modprinc -policy stduser alice
154*7f2fe78bSCy SchubertPrincipal “<a class="reference external" href="mailto:alice&#37;&#52;&#48;KRBTEST&#46;COM">alice<span>&#64;</span>KRBTEST<span>&#46;</span>COM</a>” modified.</p>
155*7f2fe78bSCy Schubert</div></blockquote>
156*7f2fe78bSCy Schubert<p>A principal entry may be associated with a nonexistent policy, either
157*7f2fe78bSCy Schubertbecause the policy did not exist at the time of associated or was
158*7f2fe78bSCy Schubertdeleted afterwards.  kadmin will warn when associated a principal with
159*7f2fe78bSCy Schuberta nonexistent policy, and will annotate the policy name with “[does
160*7f2fe78bSCy Schubertnot exist]” in the <strong>get_principal</strong> output.</p>
161*7f2fe78bSCy Schubert<section id="updating-the-history-key">
162*7f2fe78bSCy Schubert<span id="updating-history-key"></span><h3>Updating the history key<a class="headerlink" href="#updating-the-history-key" title="Permalink to this headline">¶</a></h3>
163*7f2fe78bSCy Schubert<p>If a policy specifies a number of old keys kept of two or more, the
164*7f2fe78bSCy Schubertstored old keys are encrypted in a history key, which is found in the
165*7f2fe78bSCy Schubertkey data of the <code class="docutils literal notranslate"><span class="pre">kadmin/history</span></code> principal.</p>
166*7f2fe78bSCy Schubert<p>Currently there is no support for proper rollover of the history key,
167*7f2fe78bSCy Schubertbut you can change the history key (for example, to use a better
168*7f2fe78bSCy Schubertencryption type) at the cost of invalidating currently stored old
169*7f2fe78bSCy Schubertkeys.  To change the history key, run:</p>
170*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">change_password</span> <span class="o">-</span><span class="n">randkey</span> <span class="n">kadmin</span><span class="o">/</span><span class="n">history</span>
171*7f2fe78bSCy Schubert</pre></div>
172*7f2fe78bSCy Schubert</div>
173*7f2fe78bSCy Schubert<p>This command will fail if you specify the <strong>-keepold</strong> flag.  Only one
174*7f2fe78bSCy Schubertnew history key will be created, even if you specify multiple key/salt
175*7f2fe78bSCy Schubertcombinations.</p>
176*7f2fe78bSCy Schubert<p>In the future, we plan to migrate towards encrypting old keys in the
177*7f2fe78bSCy Schubertmaster key instead of the history key, and implementing proper
178*7f2fe78bSCy Schubertrollover support for stored old keys.</p>
179*7f2fe78bSCy Schubert</section>
180*7f2fe78bSCy Schubert</section>
181*7f2fe78bSCy Schubert<section id="privileges">
182*7f2fe78bSCy Schubert<span id="id3"></span><h2>Privileges<a class="headerlink" href="#privileges" title="Permalink to this headline">¶</a></h2>
183*7f2fe78bSCy Schubert<p>Administrative privileges for the Kerberos database are stored in the
184*7f2fe78bSCy Schubertfile <a class="reference internal" href="conf_files/kadm5_acl.html#kadm5-acl-5"><span class="std std-ref">kadm5.acl</span></a>.</p>
185*7f2fe78bSCy Schubert<div class="admonition note">
186*7f2fe78bSCy Schubert<p class="admonition-title">Note</p>
187*7f2fe78bSCy Schubert<p>A common use of an admin instance is so you can grant
188*7f2fe78bSCy Schubertseparate permissions (such as administrator access to the
189*7f2fe78bSCy SchubertKerberos database) to a separate Kerberos principal. For
190*7f2fe78bSCy Schubertexample, the user <code class="docutils literal notranslate"><span class="pre">joeadmin</span></code> might have a principal for
191*7f2fe78bSCy Schuberthis administrative use, called <code class="docutils literal notranslate"><span class="pre">joeadmin/admin</span></code>.  This
192*7f2fe78bSCy Schubertway, <code class="docutils literal notranslate"><span class="pre">joeadmin</span></code> would obtain <code class="docutils literal notranslate"><span class="pre">joeadmin/admin</span></code> tickets
193*7f2fe78bSCy Schubertonly when he actually needs to use those permissions.</p>
194*7f2fe78bSCy Schubert</div>
195*7f2fe78bSCy Schubert</section>
196*7f2fe78bSCy Schubert<section id="operations-on-the-kerberos-database">
197*7f2fe78bSCy Schubert<span id="db-operations"></span><h2>Operations on the Kerberos database<a class="headerlink" href="#operations-on-the-kerberos-database" title="Permalink to this headline">¶</a></h2>
198*7f2fe78bSCy Schubert<p>The <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> command is the primary tool for administrating
199*7f2fe78bSCy Schubertthe Kerberos database when using the DB2 or LMDB modules (see
200*7f2fe78bSCy Schubert<a class="reference internal" href="dbtypes.html#dbtypes"><span class="std std-ref">Database types</span></a>).  Creating a database is described in
201*7f2fe78bSCy Schubert<a class="reference internal" href="install_kdc.html#create-db"><span class="std std-ref">Create the KDC database</span></a>.</p>
202*7f2fe78bSCy Schubert<p>To create a stash file using the master password (because the database
203*7f2fe78bSCy Schubertwas not created with one using the <code class="docutils literal notranslate"><span class="pre">create</span> <span class="pre">-s</span></code> flag, or after
204*7f2fe78bSCy Schubertrestoring from a backup which did not contain the stash file), use the
205*7f2fe78bSCy Schubertkdb5_util <strong>stash</strong> command:</p>
206*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util stash
207*7f2fe78bSCy Schubertkdb5_util: Cannot find/read stored master key while reading master key
208*7f2fe78bSCy Schubertkdb5_util: Warning: proceeding without master key
209*7f2fe78bSCy SchubertEnter KDC database master key:  &lt;= Type the KDC database master password.
210*7f2fe78bSCy Schubert</pre></div>
211*7f2fe78bSCy Schubert</div>
212*7f2fe78bSCy Schubert<p>To destroy a database, use the kdb5_util destroy command:</p>
213*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util destroy
214*7f2fe78bSCy SchubertDeleting KDC database stored in &#39;/var/krb5kdc/principal&#39;, are you sure?
215*7f2fe78bSCy Schubert(type &#39;yes&#39; to confirm)? yes
216*7f2fe78bSCy SchubertOK, deleting database &#39;/var/krb5kdc/principal&#39;...
217*7f2fe78bSCy Schubert** Database &#39;/var/krb5kdc/principal&#39; destroyed.
218*7f2fe78bSCy Schubert</pre></div>
219*7f2fe78bSCy Schubert</div>
220*7f2fe78bSCy Schubert<section id="dumping-and-loading-a-kerberos-database">
221*7f2fe78bSCy Schubert<span id="restore-from-dump"></span><h3>Dumping and loading a Kerberos database<a class="headerlink" href="#dumping-and-loading-a-kerberos-database" title="Permalink to this headline">¶</a></h3>
222*7f2fe78bSCy Schubert<p>To dump a Kerberos database into a text file for backup or transfer
223*7f2fe78bSCy Schubertpurposes, use the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> <strong>dump</strong> command on one of the
224*7f2fe78bSCy SchubertKDCs:</p>
225*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util dump dumpfile
226*7f2fe78bSCy Schubert
227*7f2fe78bSCy Schubert$ kbd5_util dump -verbose dumpfile
228*7f2fe78bSCy Schubertkadmin/admin@ATHENA.MIT.EDU
229*7f2fe78bSCy Schubertkrbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
230*7f2fe78bSCy Schubertkadmin/history@ATHENA.MIT.EDU
231*7f2fe78bSCy SchubertK/M@ATHENA.MIT.EDU
232*7f2fe78bSCy Schubertkadmin/changepw@ATHENA.MIT.EDU
233*7f2fe78bSCy Schubert</pre></div>
234*7f2fe78bSCy Schubert</div>
235*7f2fe78bSCy Schubert<p>You may specify which principals to dump, using full principal names
236*7f2fe78bSCy Schubertincluding realm:</p>
237*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util dump -verbose someprincs K/M@ATHENA.MIT.EDU kadmin/admin@ATHENA.MIT.EDU
238*7f2fe78bSCy Schubertkadmin/admin@ATHENA.MIT.EDU
239*7f2fe78bSCy SchubertK/M@ATHENA.MIT.EDU
240*7f2fe78bSCy Schubert</pre></div>
241*7f2fe78bSCy Schubert</div>
242*7f2fe78bSCy Schubert<p>To restore a Kerberos database dump from a file, use the
243*7f2fe78bSCy Schubert<a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> <strong>load</strong> command:</p>
244*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util load dumpfile
245*7f2fe78bSCy Schubert</pre></div>
246*7f2fe78bSCy Schubert</div>
247*7f2fe78bSCy Schubert<p>To update an existing database with a partial dump file containing
248*7f2fe78bSCy Schubertonly some principals, use the <code class="docutils literal notranslate"><span class="pre">-update</span></code> flag:</p>
249*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util load -update someprincs
250*7f2fe78bSCy Schubert</pre></div>
251*7f2fe78bSCy Schubert</div>
252*7f2fe78bSCy Schubert<div class="admonition note">
253*7f2fe78bSCy Schubert<p class="admonition-title">Note</p>
254*7f2fe78bSCy Schubert<p>If the database file exists, and the <em>-update</em> flag was not
255*7f2fe78bSCy Schubertgiven, <em>kdb5_util</em> will overwrite the existing database.</p>
256*7f2fe78bSCy Schubert</div>
257*7f2fe78bSCy Schubert</section>
258*7f2fe78bSCy Schubert<section id="updating-the-master-key">
259*7f2fe78bSCy Schubert<span id="updating-master-key"></span><h3>Updating the master key<a class="headerlink" href="#updating-the-master-key" title="Permalink to this headline">¶</a></h3>
260*7f2fe78bSCy Schubert<p>Starting with release 1.7, <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> allows the master key
261*7f2fe78bSCy Schubertto be changed using a rollover process, with minimal loss of
262*7f2fe78bSCy Schubertavailability.  To roll over the master key, follow these steps:</p>
263*7f2fe78bSCy Schubert<ol class="arabic">
264*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">list_mkeys</span></code> to view the
265*7f2fe78bSCy Schubertcurrent master key version number (KVNO).  If you have never rolled
266*7f2fe78bSCy Schubertover the master key before, this will likely be version 1:</p>
267*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_util list_mkeys
268*7f2fe78bSCy SchubertMaster keys for Principal: K/M@KRBTEST.COM
269*7f2fe78bSCy SchubertKVNO: 1, Enctype: aes256-cts-hmac-sha384-192, Active on: Thu Jan 01 00:00:00 UTC 1970 *
270*7f2fe78bSCy Schubert</pre></div>
271*7f2fe78bSCy Schubert</div>
272*7f2fe78bSCy Schubert</li>
273*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">use_mkey</span> <span class="pre">1</span></code> to ensure that a
274*7f2fe78bSCy Schubertmaster key activation list is present in the database.  This step
275*7f2fe78bSCy Schubertis unnecessary in release 1.11.4 or later, or if the database was
276*7f2fe78bSCy Schubertinitially created with release 1.7 or later.</p></li>
277*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">add_mkey</span> <span class="pre">-s</span></code> to create a new
278*7f2fe78bSCy Schubertmaster key and write it to the stash file.  Enter a secure password
279*7f2fe78bSCy Schubertwhen prompted.  If this is the first time you are changing the
280*7f2fe78bSCy Schubertmaster key, the new key will have version 2.  The new master key
281*7f2fe78bSCy Schubertwill not be used until you make it active.</p></li>
282*7f2fe78bSCy Schubert<li><p>Propagate the database to all replica KDCs, either manually or by
283*7f2fe78bSCy Schubertwaiting until the next scheduled propagation.  If you do not have
284*7f2fe78bSCy Schubertany replica KDCs, you can skip this and the next step.</p></li>
285*7f2fe78bSCy Schubert<li><p>On each replica KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">list_mkeys</span></code> to verify that
286*7f2fe78bSCy Schubertthe new master key is present, and then <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">stash</span></code> to
287*7f2fe78bSCy Schubertwrite the new master key to the replica KDC’s stash file.</p></li>
288*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">use_mkey</span> <span class="pre">2</span></code> to begin using the
289*7f2fe78bSCy Schubertnew master key.  Replace <code class="docutils literal notranslate"><span class="pre">2</span></code> with the version of the new master
290*7f2fe78bSCy Schubertkey, as appropriate.  You can optionally specify a date for the new
291*7f2fe78bSCy Schubertmaster key to become active; by default, it will become active
292*7f2fe78bSCy Schubertimmediately.  Prior to release 1.12, <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> must be
293*7f2fe78bSCy Schubertrestarted for this change to take full effect.</p></li>
294*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">update_princ_encryption</span></code>.
295*7f2fe78bSCy SchubertThis command will iterate over the database and re-encrypt all keys
296*7f2fe78bSCy Schubertin the new master key.  If the database is large and uses DB2, the
297*7f2fe78bSCy Schubertprimary KDC will become unavailable while this command runs, but
298*7f2fe78bSCy Schubertclients should fail over to replica KDCs (if any are present)
299*7f2fe78bSCy Schubertduring this time period.  In release 1.13 and later, you can
300*7f2fe78bSCy Schubertinstead run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">-x</span> <span class="pre">unlockiter</span> <span class="pre">update_princ_encryption</span></code> to
301*7f2fe78bSCy Schubertuse unlocked iteration; this variant will take longer, but will
302*7f2fe78bSCy Schubertkeep the database available to the KDC and kadmind while it runs.</p></li>
303*7f2fe78bSCy Schubert<li><p>Wait until the above changes have propagated to all replica KDCs
304*7f2fe78bSCy Schubertand until all running KDC and kadmind processes have serviced
305*7f2fe78bSCy Schubertrequests using updated principal entries.</p></li>
306*7f2fe78bSCy Schubert<li><p>On the primary KDC, run <code class="docutils literal notranslate"><span class="pre">kdb5_util</span> <span class="pre">purge_mkeys</span></code> to clean up the
307*7f2fe78bSCy Schubertold master key.</p></li>
308*7f2fe78bSCy Schubert</ol>
309*7f2fe78bSCy Schubert</section>
310*7f2fe78bSCy Schubert</section>
311*7f2fe78bSCy Schubert<section id="operations-on-the-ldap-database">
312*7f2fe78bSCy Schubert<span id="ops-on-ldap"></span><h2>Operations on the LDAP database<a class="headerlink" href="#operations-on-the-ldap-database" title="Permalink to this headline">¶</a></h2>
313*7f2fe78bSCy Schubert<p>The <a class="reference internal" href="admin_commands/kdb5_ldap_util.html#kdb5-ldap-util-8"><span class="std std-ref">kdb5_ldap_util</span></a> command is the primary tool for
314*7f2fe78bSCy Schubertadministrating the Kerberos database when using the LDAP module.
315*7f2fe78bSCy SchubertCreating an LDAP Kerberos database is describe in <a class="reference internal" href="conf_ldap.html#conf-ldap"><span class="std std-ref">Configuring Kerberos with OpenLDAP back-end</span></a>.</p>
316*7f2fe78bSCy Schubert<p>To view a list of realms in the LDAP database, use the kdb5_ldap_util
317*7f2fe78bSCy Schubert<strong>list</strong> command:</p>
318*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util list
319*7f2fe78bSCy SchubertKRBTEST.COM
320*7f2fe78bSCy Schubert</pre></div>
321*7f2fe78bSCy Schubert</div>
322*7f2fe78bSCy Schubert<p>To modify the attributes of a realm, use the kdb5_ldap_util <strong>modify</strong>
323*7f2fe78bSCy Schubertcommand.  For example, to change the default realm’s maximum ticket
324*7f2fe78bSCy Schubertlife:</p>
325*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util modify -maxtktlife &quot;10 hours&quot;
326*7f2fe78bSCy Schubert</pre></div>
327*7f2fe78bSCy Schubert</div>
328*7f2fe78bSCy Schubert<p>To display the attributes of a realm, use the kdb5_ldap_util <strong>view</strong>
329*7f2fe78bSCy Schubertcommand:</p>
330*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util view
331*7f2fe78bSCy Schubert               Realm Name: KRBTEST.COM
332*7f2fe78bSCy Schubert      Maximum Ticket Life: 0 days 00:10:00
333*7f2fe78bSCy Schubert</pre></div>
334*7f2fe78bSCy Schubert</div>
335*7f2fe78bSCy Schubert<p>To remove a realm from the LDAP database, destroying its contents, use
336*7f2fe78bSCy Schubertthe kdb5_ldap_util <strong>destroy</strong> command:</p>
337*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util destroy
338*7f2fe78bSCy SchubertDeleting KDC database of &#39;KRBTEST.COM&#39;, are you sure?
339*7f2fe78bSCy Schubert(type &#39;yes&#39; to confirm)? yes
340*7f2fe78bSCy SchubertOK, deleting database of &#39;KRBTEST.COM&#39;...
341*7f2fe78bSCy Schubert** Database of &#39;KRBTEST.COM&#39; destroyed.
342*7f2fe78bSCy Schubert</pre></div>
343*7f2fe78bSCy Schubert</div>
344*7f2fe78bSCy Schubert<section id="ticket-policy-operations">
345*7f2fe78bSCy Schubert<h3>Ticket Policy operations<a class="headerlink" href="#ticket-policy-operations" title="Permalink to this headline">¶</a></h3>
346*7f2fe78bSCy Schubert<p>Unlike the DB2 and LMDB modules, the LDAP module supports ticket
347*7f2fe78bSCy Schubertpolicy objects, which can be associated with principals to restrict
348*7f2fe78bSCy Schubertmaximum ticket lifetimes and set mandatory principal flags.  Ticket
349*7f2fe78bSCy Schubertpolicy objects are distinct from the password policies described
350*7f2fe78bSCy Schubertearlier on this page, and are chiefly managed through kdb5_ldap_util
351*7f2fe78bSCy Schubertrather than kadmin.  To create a new ticket policy, use the
352*7f2fe78bSCy Schubertkdb5_ldap_util <strong>create_policy</strong> command:</p>
353*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util create_policy -maxrenewlife &quot;2 days&quot; users
354*7f2fe78bSCy Schubert</pre></div>
355*7f2fe78bSCy Schubert</div>
356*7f2fe78bSCy Schubert<p>To associate a ticket policy with a principal, use the
357*7f2fe78bSCy Schubert<a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> <strong>modify_principal</strong> (or <strong>add_principal</strong>) command
358*7f2fe78bSCy Schubertwith the <strong>-x tktpolicy=</strong><em>policy</em> option:</p>
359*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kadmin.local modprinc -x tktpolicy=users alice
360*7f2fe78bSCy Schubert</pre></div>
361*7f2fe78bSCy Schubert</div>
362*7f2fe78bSCy Schubert<p>To remove a ticket policy reference from a principal, use the same
363*7f2fe78bSCy Schubertcommand with an empty <em>policy</em>:</p>
364*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kadmin.local modprinc -x tktpolicy= alice
365*7f2fe78bSCy Schubert</pre></div>
366*7f2fe78bSCy Schubert</div>
367*7f2fe78bSCy Schubert<p>To list the existing ticket policy objects, use the kdb5_ldap_util
368*7f2fe78bSCy Schubert<strong>list_policy</strong> command:</p>
369*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util list_policy
370*7f2fe78bSCy Schubertusers
371*7f2fe78bSCy Schubert</pre></div>
372*7f2fe78bSCy Schubert</div>
373*7f2fe78bSCy Schubert<p>To modify the attributes of a ticket policy object, use the
374*7f2fe78bSCy Schubertkdb5_ldap_util <strong>modify_policy</strong> command:</p>
375*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util modify_policy -allow_svr +requires_preauth users
376*7f2fe78bSCy Schubert</pre></div>
377*7f2fe78bSCy Schubert</div>
378*7f2fe78bSCy Schubert<p>To view the attributes of a ticket policy object, use the
379*7f2fe78bSCy Schubertkdb5_ldap_util <strong>view_policy</strong> command:</p>
380*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util view_policy users
381*7f2fe78bSCy Schubert            Ticket policy: users
382*7f2fe78bSCy Schubert   Maximum renewable life: 2 days 00:00:00
383*7f2fe78bSCy Schubert             Ticket flags: REQUIRES_PRE_AUTH DISALLOW_SVR
384*7f2fe78bSCy Schubert</pre></div>
385*7f2fe78bSCy Schubert</div>
386*7f2fe78bSCy Schubert<p>To destroy an ticket policy object, use the kdb5_ldap_util
387*7f2fe78bSCy Schubert<strong>destroy_policy</strong> command:</p>
388*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>$ kdb5_ldap_util destroy_policy users
389*7f2fe78bSCy SchubertThis will delete the policy object &#39;users&#39;, are you sure?
390*7f2fe78bSCy Schubert(type &#39;yes&#39; to confirm)? yes
391*7f2fe78bSCy Schubert** policy object &#39;users&#39; deleted.
392*7f2fe78bSCy Schubert</pre></div>
393*7f2fe78bSCy Schubert</div>
394*7f2fe78bSCy Schubert</section>
395*7f2fe78bSCy Schubert</section>
396*7f2fe78bSCy Schubert<section id="cross-realm-authentication">
397*7f2fe78bSCy Schubert<span id="xrealm-authn"></span><h2>Cross-realm authentication<a class="headerlink" href="#cross-realm-authentication" title="Permalink to this headline">¶</a></h2>
398*7f2fe78bSCy Schubert<p>In order for a KDC in one realm to authenticate Kerberos users in a
399*7f2fe78bSCy Schubertdifferent realm, it must share a key with the KDC in the other realm.
400*7f2fe78bSCy SchubertIn both databases, there must be krbtgt service principals for both realms.
401*7f2fe78bSCy SchubertFor example, if you need to do cross-realm authentication between the realms
402*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">ATHENA.MIT.EDU</span></code> and <code class="docutils literal notranslate"><span class="pre">EXAMPLE.COM</span></code>, you would need to add the
403*7f2fe78bSCy Schubertprincipals <code class="docutils literal notranslate"><span class="pre">krbtgt/EXAMPLE.COM&#64;ATHENA.MIT.EDU</span></code> and
404*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">krbtgt/ATHENA.MIT.EDU&#64;EXAMPLE.COM</span></code> to both databases.
405*7f2fe78bSCy SchubertThese principals must all have the same passwords, key version
406*7f2fe78bSCy Schubertnumbers, and encryption types; this may require explicitly setting
407*7f2fe78bSCy Schubertthe key version number with the <strong>-kvno</strong> option.</p>
408*7f2fe78bSCy Schubert<p>In the ATHENA.MIT.EDU and EXAMPLE.COM cross-realm case, the administrators
409*7f2fe78bSCy Schubertwould run the following commands on the KDCs in both realms:</p>
410*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span><span class="p">:</span> <span class="n">kadmin</span><span class="o">.</span><span class="n">local</span> <span class="o">-</span><span class="n">e</span> <span class="s2">&quot;aes256-cts:normal&quot;</span>
411*7f2fe78bSCy Schubert<span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">-</span><span class="n">requires_preauth</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>
412*7f2fe78bSCy Schubert<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span>
413*7f2fe78bSCy Schubert<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span>
414*7f2fe78bSCy Schubert<span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">-</span><span class="n">requires_preauth</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>
415*7f2fe78bSCy Schubert<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span>
416*7f2fe78bSCy Schubert<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span>
417*7f2fe78bSCy Schubert<span class="n">kadmin</span><span class="p">:</span>
418*7f2fe78bSCy Schubert</pre></div>
419*7f2fe78bSCy Schubert</div>
420*7f2fe78bSCy Schubert<div class="admonition note">
421*7f2fe78bSCy Schubert<p class="admonition-title">Note</p>
422*7f2fe78bSCy Schubert<p>Even if most principals in a realm are generally created
423*7f2fe78bSCy Schubertwith the <strong>requires_preauth</strong> flag enabled, this flag is not
424*7f2fe78bSCy Schubertdesirable on cross-realm authentication keys because doing
425*7f2fe78bSCy Schubertso makes it impossible to disable preauthentication on a
426*7f2fe78bSCy Schubertservice-by-service basis.  Disabling it as in the example
427*7f2fe78bSCy Schubertabove is recommended.</p>
428*7f2fe78bSCy Schubert</div>
429*7f2fe78bSCy Schubert<div class="admonition note">
430*7f2fe78bSCy Schubert<p class="admonition-title">Note</p>
431*7f2fe78bSCy Schubert<p>It is very important that these principals have good
432*7f2fe78bSCy Schubertpasswords.  MIT recommends that TGT principal passwords be
433*7f2fe78bSCy Schubertat least 26 characters of random ASCII text.</p>
434*7f2fe78bSCy Schubert</div>
435*7f2fe78bSCy Schubert</section>
436*7f2fe78bSCy Schubert<section id="changing-the-krbtgt-key">
437*7f2fe78bSCy Schubert<span id="changing-krbtgt-key"></span><h2>Changing the krbtgt key<a class="headerlink" href="#changing-the-krbtgt-key" title="Permalink to this headline">¶</a></h2>
438*7f2fe78bSCy Schubert<p>A Kerberos Ticket Granting Ticket (TGT) is a service ticket for the
439*7f2fe78bSCy Schubertprincipal <code class="docutils literal notranslate"><span class="pre">krbtgt/REALM</span></code>.  The key for this principal is created
440*7f2fe78bSCy Schubertwhen the Kerberos database is initialized and need not be changed.
441*7f2fe78bSCy SchubertHowever, it will only have the encryption types supported by the KDC
442*7f2fe78bSCy Schubertat the time of the initial database creation.  To allow use of newer
443*7f2fe78bSCy Schubertencryption types for the TGT, this key has to be changed.</p>
444*7f2fe78bSCy Schubert<p>Changing this key using the normal <a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>
445*7f2fe78bSCy Schubert<strong>change_password</strong> command would invalidate any previously issued
446*7f2fe78bSCy SchubertTGTs.  Therefore, when changing this key, normally one should use the
447*7f2fe78bSCy Schubert<strong>-keepold</strong> flag to change_password to retain the previous key in the
448*7f2fe78bSCy Schubertdatabase as well as the new key.  For example:</p>
449*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">change_password</span> <span class="o">-</span><span class="n">randkey</span> <span class="o">-</span><span class="n">keepold</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>
450*7f2fe78bSCy Schubert</pre></div>
451*7f2fe78bSCy Schubert</div>
452*7f2fe78bSCy Schubert<div class="admonition warning">
453*7f2fe78bSCy Schubert<p class="admonition-title">Warning</p>
454*7f2fe78bSCy Schubert<p>After issuing this command, the old key is still valid
455*7f2fe78bSCy Schubertand is still vulnerable to (for instance) brute force
456*7f2fe78bSCy Schubertattacks.  To completely retire an old key or encryption
457*7f2fe78bSCy Schuberttype, run the kadmin <strong>purgekeys</strong> command to delete keys
458*7f2fe78bSCy Schubertwith older kvnos, ideally first making sure that all
459*7f2fe78bSCy Schuberttickets issued with the old keys have expired.</p>
460*7f2fe78bSCy Schubert</div>
461*7f2fe78bSCy Schubert<p>Only the first krbtgt key of the newest key version is used to encrypt
462*7f2fe78bSCy Schubertticket-granting tickets.  However, the set of encryption types present
463*7f2fe78bSCy Schubertin the krbtgt keys is used by default to determine the session key
464*7f2fe78bSCy Schuberttypes supported by the krbtgt service (see
465*7f2fe78bSCy Schubert<a class="reference internal" href="enctypes.html#session-key-selection"><span class="std std-ref">Session key selection</span></a>).  Because non-MIT Kerberos clients
466*7f2fe78bSCy Schubertsometimes send a limited set of encryption types when making AS
467*7f2fe78bSCy Schubertrequests, it can be important for the krbtgt service to support
468*7f2fe78bSCy Schubertmultiple encryption types.  This can be accomplished by giving the
469*7f2fe78bSCy Schubertkrbtgt principal multiple keys, which is usually as simple as not
470*7f2fe78bSCy Schubertspecifying any <strong>-e</strong> option when changing the krbtgt key, or by
471*7f2fe78bSCy Schubertsetting the <strong>session_enctypes</strong> string attribute on the krbtgt
472*7f2fe78bSCy Schubertprincipal (see <a class="reference internal" href="admin_commands/kadmin_local.html#set-string"><span class="std std-ref">set_string</span></a>).</p>
473*7f2fe78bSCy Schubert<p>Due to a bug in releases 1.8 through 1.13, renewed and forwarded
474*7f2fe78bSCy Schuberttickets may not work if the original ticket was obtained prior to a
475*7f2fe78bSCy Schubertkrbtgt key change and the modified ticket is obtained afterwards.
476*7f2fe78bSCy SchubertUpgrading the KDC to release 1.14 or later will correct this bug.</p>
477*7f2fe78bSCy Schubert</section>
478*7f2fe78bSCy Schubert<section id="incremental-database-propagation">
479*7f2fe78bSCy Schubert<span id="incr-db-prop"></span><h2>Incremental database propagation<a class="headerlink" href="#incremental-database-propagation" title="Permalink to this headline">¶</a></h2>
480*7f2fe78bSCy Schubert<section id="overview">
481*7f2fe78bSCy Schubert<h3>Overview<a class="headerlink" href="#overview" title="Permalink to this headline">¶</a></h3>
482*7f2fe78bSCy Schubert<p>At some very large sites, dumping and transmitting the database can
483*7f2fe78bSCy Schuberttake more time than is desirable for changes to propagate from the
484*7f2fe78bSCy Schubertprimary KDC to the replica KDCs.  The incremental propagation support
485*7f2fe78bSCy Schubertadded in the 1.7 release is intended to address this.</p>
486*7f2fe78bSCy Schubert<p>With incremental propagation enabled, all programs on the primary KDC
487*7f2fe78bSCy Schubertthat change the database also write information about the changes to
488*7f2fe78bSCy Schubertan “update log” file, maintained as a circular buffer of a certain
489*7f2fe78bSCy Schubertsize.  A process on each replica KDC connects to a service on the
490*7f2fe78bSCy Schubertprimary KDC (currently implemented in the <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> server) and
491*7f2fe78bSCy Schubertperiodically requests the changes that have been made since the last
492*7f2fe78bSCy Schubertcheck.  By default, this check is done every two minutes.</p>
493*7f2fe78bSCy Schubert<p>Incremental propagation uses the following entries in the per-realm
494*7f2fe78bSCy Schubertdata in the KDC config file (See <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>):</p>
495*7f2fe78bSCy Schubert<table class="docutils align-default">
496*7f2fe78bSCy Schubert<colgroup>
497*7f2fe78bSCy Schubert<col style="width: 4%" />
498*7f2fe78bSCy Schubert<col style="width: 3%" />
499*7f2fe78bSCy Schubert<col style="width: 94%" />
500*7f2fe78bSCy Schubert</colgroup>
501*7f2fe78bSCy Schubert<tbody>
502*7f2fe78bSCy Schubert<tr class="row-odd"><td><p>iprop_enable</p></td>
503*7f2fe78bSCy Schubert<td><p><em>boolean</em></p></td>
504*7f2fe78bSCy Schubert<td><p>If <em>true</em>, then incremental propagation is enabled, and (as noted below) normal kprop propagation is disabled. The default is <em>false</em>.</p></td>
505*7f2fe78bSCy Schubert</tr>
506*7f2fe78bSCy Schubert<tr class="row-even"><td><p>iprop_master_ulogsize</p></td>
507*7f2fe78bSCy Schubert<td><p><em>integer</em></p></td>
508*7f2fe78bSCy Schubert<td><p>Indicates the number of entries that should be retained in the update log. The default is 1000; the maximum number is 2500.</p></td>
509*7f2fe78bSCy Schubert</tr>
510*7f2fe78bSCy Schubert<tr class="row-odd"><td><p>iprop_replica_poll</p></td>
511*7f2fe78bSCy Schubert<td><p><em>time interval</em></p></td>
512*7f2fe78bSCy Schubert<td><p>Indicates how often the replica should poll the primary KDC for changes to the database. The default is two minutes.</p></td>
513*7f2fe78bSCy Schubert</tr>
514*7f2fe78bSCy Schubert<tr class="row-even"><td><p>iprop_port</p></td>
515*7f2fe78bSCy Schubert<td><p><em>integer</em></p></td>
516*7f2fe78bSCy Schubert<td><p>Specifies the port number to be used for incremental propagation. This is required in both primary and replica configuration files.</p></td>
517*7f2fe78bSCy Schubert</tr>
518*7f2fe78bSCy Schubert<tr class="row-odd"><td><p>iprop_resync_timeout</p></td>
519*7f2fe78bSCy Schubert<td><p><em>integer</em></p></td>
520*7f2fe78bSCy Schubert<td><p>Specifies the number of seconds to wait for a full propagation to complete. This is optional on replica configurations.  Defaults to 300 seconds (5 minutes).</p></td>
521*7f2fe78bSCy Schubert</tr>
522*7f2fe78bSCy Schubert<tr class="row-even"><td><p>iprop_logfile</p></td>
523*7f2fe78bSCy Schubert<td><p><em>file name</em></p></td>
524*7f2fe78bSCy Schubert<td><p>Specifies where the update log file for the realm database is to be stored. The default is to use the <em>database_name</em> entry from the realms section of the config file <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>, with <em>.ulog</em> appended. (NOTE: If database_name isn’t specified in the realms section, perhaps because the LDAP database back end is being used, or the file name is specified in the <em>dbmodules</em> section, then the hard-coded default for <em>database_name</em> is used. Determination of the <em>iprop_logfile</em>  default value will not use values from the <em>dbmodules</em> section.)</p></td>
525*7f2fe78bSCy Schubert</tr>
526*7f2fe78bSCy Schubert</tbody>
527*7f2fe78bSCy Schubert</table>
528*7f2fe78bSCy Schubert<p>Both primary and replica sides must have a principal named
529*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">kiprop/hostname</span></code> (where <em>hostname</em> is the lowercase,
530*7f2fe78bSCy Schubertfully-qualified, canonical name for the host) registered in the
531*7f2fe78bSCy SchubertKerberos database, and have keys for that principal stored in the
532*7f2fe78bSCy Schubertdefault keytab file (<a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a>).  The <code class="docutils literal notranslate"><span class="pre">kiprop/hostname</span></code> principal may
533*7f2fe78bSCy Schuberthave been created automatically for the primary KDC, but it must
534*7f2fe78bSCy Schubertalways be created for replica KDCs.</p>
535*7f2fe78bSCy Schubert<p>On the primary KDC side, the <code class="docutils literal notranslate"><span class="pre">kiprop/hostname</span></code> principal must be
536*7f2fe78bSCy Schubertlisted in the kadmind ACL file <a class="reference internal" href="conf_files/kadm5_acl.html#kadm5-acl-5"><span class="std std-ref">kadm5.acl</span></a>, and given the
537*7f2fe78bSCy Schubert<strong>p</strong> privilege (see <a class="reference internal" href="#privileges"><span class="std std-ref">Privileges</span></a>).</p>
538*7f2fe78bSCy Schubert<p>On the replica KDC side, <a class="reference internal" href="admin_commands/kpropd.html#kpropd-8"><span class="std std-ref">kpropd</span></a> should be run.  When
539*7f2fe78bSCy Schubertincremental propagation is enabled, it will connect to the kadmind on
540*7f2fe78bSCy Schubertthe primary KDC and start requesting updates.</p>
541*7f2fe78bSCy Schubert<p>The normal kprop mechanism is disabled by the incremental propagation
542*7f2fe78bSCy Schubertsupport.  However, if the replica has been unable to fetch changes
543*7f2fe78bSCy Schubertfrom the primary KDC for too long (network problems, perhaps), the log
544*7f2fe78bSCy Schuberton the primary may wrap around and overwrite some of the updates that
545*7f2fe78bSCy Schubertthe replica has not yet retrieved.  In this case, the replica will
546*7f2fe78bSCy Schubertinstruct the primary KDC to dump the current database out to a file
547*7f2fe78bSCy Schubertand invoke a one-time kprop propagation, with special options to also
548*7f2fe78bSCy Schubertconvey the point in the update log at which the replica should resume
549*7f2fe78bSCy Schubertfetching incremental updates.  Thus, all the keytab and ACL setup
550*7f2fe78bSCy Schubertpreviously described for kprop propagation is still needed.</p>
551*7f2fe78bSCy Schubert<p>If an environment has a large number of replicas, it may be desirable
552*7f2fe78bSCy Schubertto arrange them in a hierarchy instead of having the primary serve
553*7f2fe78bSCy Schubertupdates to every replica.  To do this, run <code class="docutils literal notranslate"><span class="pre">kadmind</span> <span class="pre">-proponly</span></code> on
554*7f2fe78bSCy Schuberteach intermediate replica, and <code class="docutils literal notranslate"><span class="pre">kpropd</span> <span class="pre">-A</span> <span class="pre">upstreamhostname</span></code> on
555*7f2fe78bSCy Schubertdownstream replicas to direct each one to the appropriate upstream
556*7f2fe78bSCy Schubertreplica.</p>
557*7f2fe78bSCy Schubert<p>There are several known restrictions in the current implementation:</p>
558*7f2fe78bSCy Schubert<ul class="simple">
559*7f2fe78bSCy Schubert<li><p>The incremental update protocol does not transport changes to policy
560*7f2fe78bSCy Schubertobjects.  Any policy changes on the primary will result in full
561*7f2fe78bSCy Schubertresyncs to all replicas.</p></li>
562*7f2fe78bSCy Schubert<li><p>The replica’s KDB module must support locking; it cannot be using the
563*7f2fe78bSCy SchubertLDAP KDB module.</p></li>
564*7f2fe78bSCy Schubert<li><p>The primary and replica must be able to initiate TCP connections in
565*7f2fe78bSCy Schubertboth directions, without an intervening NAT.</p></li>
566*7f2fe78bSCy Schubert</ul>
567*7f2fe78bSCy Schubert</section>
568*7f2fe78bSCy Schubert<section id="sun-mit-incremental-propagation-differences">
569*7f2fe78bSCy Schubert<h3>Sun/MIT incremental propagation differences<a class="headerlink" href="#sun-mit-incremental-propagation-differences" title="Permalink to this headline">¶</a></h3>
570*7f2fe78bSCy Schubert<p>Sun donated the original code for supporting incremental database
571*7f2fe78bSCy Schubertpropagation to MIT.  Some changes have been made in the MIT source
572*7f2fe78bSCy Schuberttree that will be visible to administrators.  (These notes are based
573*7f2fe78bSCy Schuberton Sun’s patches.  Changes to Sun’s implementation since then may not
574*7f2fe78bSCy Schubertbe reflected here.)</p>
575*7f2fe78bSCy Schubert<p>The Sun config file support looks for <code class="docutils literal notranslate"><span class="pre">sunw_dbprop_enable</span></code>,
576*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">sunw_dbprop_master_ulogsize</span></code>, and <code class="docutils literal notranslate"><span class="pre">sunw_dbprop_slave_poll</span></code>.</p>
577*7f2fe78bSCy Schubert<p>The incremental propagation service is implemented as an ONC RPC
578*7f2fe78bSCy Schubertservice.  In the Sun implementation, the service is registered with
579*7f2fe78bSCy Schubertrpcbind (also known as portmapper) and the client looks up the port
580*7f2fe78bSCy Schubertnumber to contact.  In the MIT implementation, where interaction with
581*7f2fe78bSCy Schubertsome modern versions of rpcbind doesn’t always work well, the port
582*7f2fe78bSCy Schubertnumber must be specified in the config file on both the primary and
583*7f2fe78bSCy Schubertreplica sides.</p>
584*7f2fe78bSCy Schubert<p>The Sun implementation hard-codes pathnames in <code class="docutils literal notranslate"><span class="pre">/var/krb5</span></code> for the
585*7f2fe78bSCy Schubertupdate log and the per-replica kprop dump files.  In the MIT
586*7f2fe78bSCy Schubertimplementation, the pathname for the update log is specified in the
587*7f2fe78bSCy Schubertconfig file, and the per-replica dump files are stored in
588*7f2fe78bSCy Schubert<a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal notranslate"><span class="pre">/krb5kdc</span></code><code class="docutils literal notranslate"><span class="pre">/replica_datatrans_hostname</span></code>.</p>
589*7f2fe78bSCy Schubert</section>
590*7f2fe78bSCy Schubert</section>
591*7f2fe78bSCy Schubert</section>
592*7f2fe78bSCy Schubert
593*7f2fe78bSCy Schubert
594*7f2fe78bSCy Schubert            <div class="clearer"></div>
595*7f2fe78bSCy Schubert          </div>
596*7f2fe78bSCy Schubert        </div>
597*7f2fe78bSCy Schubert      </div>
598*7f2fe78bSCy Schubert        </div>
599*7f2fe78bSCy Schubert        <div class="sidebar">
600*7f2fe78bSCy Schubert
601*7f2fe78bSCy Schubert    <h2>On this page</h2>
602*7f2fe78bSCy Schubert    <ul>
603*7f2fe78bSCy Schubert<li><a class="reference internal" href="#">Database administration</a><ul>
604*7f2fe78bSCy Schubert<li><a class="reference internal" href="#principals">Principals</a></li>
605*7f2fe78bSCy Schubert<li><a class="reference internal" href="#policies">Policies</a><ul>
606*7f2fe78bSCy Schubert<li><a class="reference internal" href="#updating-the-history-key">Updating the history key</a></li>
607*7f2fe78bSCy Schubert</ul>
608*7f2fe78bSCy Schubert</li>
609*7f2fe78bSCy Schubert<li><a class="reference internal" href="#privileges">Privileges</a></li>
610*7f2fe78bSCy Schubert<li><a class="reference internal" href="#operations-on-the-kerberos-database">Operations on the Kerberos database</a><ul>
611*7f2fe78bSCy Schubert<li><a class="reference internal" href="#dumping-and-loading-a-kerberos-database">Dumping and loading a Kerberos database</a></li>
612*7f2fe78bSCy Schubert<li><a class="reference internal" href="#updating-the-master-key">Updating the master key</a></li>
613*7f2fe78bSCy Schubert</ul>
614*7f2fe78bSCy Schubert</li>
615*7f2fe78bSCy Schubert<li><a class="reference internal" href="#operations-on-the-ldap-database">Operations on the LDAP database</a><ul>
616*7f2fe78bSCy Schubert<li><a class="reference internal" href="#ticket-policy-operations">Ticket Policy operations</a></li>
617*7f2fe78bSCy Schubert</ul>
618*7f2fe78bSCy Schubert</li>
619*7f2fe78bSCy Schubert<li><a class="reference internal" href="#cross-realm-authentication">Cross-realm authentication</a></li>
620*7f2fe78bSCy Schubert<li><a class="reference internal" href="#changing-the-krbtgt-key">Changing the krbtgt key</a></li>
621*7f2fe78bSCy Schubert<li><a class="reference internal" href="#incremental-database-propagation">Incremental database propagation</a><ul>
622*7f2fe78bSCy Schubert<li><a class="reference internal" href="#overview">Overview</a></li>
623*7f2fe78bSCy Schubert<li><a class="reference internal" href="#sun-mit-incremental-propagation-differences">Sun/MIT incremental propagation differences</a></li>
624*7f2fe78bSCy Schubert</ul>
625*7f2fe78bSCy Schubert</li>
626*7f2fe78bSCy Schubert</ul>
627*7f2fe78bSCy Schubert</li>
628*7f2fe78bSCy Schubert</ul>
629*7f2fe78bSCy Schubert
630*7f2fe78bSCy Schubert    <br/>
631*7f2fe78bSCy Schubert    <h2>Table of contents</h2>
632*7f2fe78bSCy Schubert    <ul class="current">
633*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li>
634*7f2fe78bSCy Schubert<li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current">
635*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li>
636*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li>
637*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li>
638*7f2fe78bSCy Schubert<li class="toctree-l2 current"><a class="current reference internal" href="#">Database administration</a></li>
639*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li>
640*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li>
641*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li>
642*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li>
643*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li>
644*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li>
645*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li>
646*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li>
647*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li>
648*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li>
649*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li>
650*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li>
651*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li>
652*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li>
653*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration  programs</a></li>
654*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li>
655*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li>
656*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li>
657*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li>
658*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li>
659*7f2fe78bSCy Schubert</ul>
660*7f2fe78bSCy Schubert</li>
661*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li>
662*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li>
663*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li>
664*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li>
665*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li>
666*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li>
667*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li>
668*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li>
669*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li>
670*7f2fe78bSCy Schubert</ul>
671*7f2fe78bSCy Schubert
672*7f2fe78bSCy Schubert    <br/>
673*7f2fe78bSCy Schubert    <h4><a href="../index.html">Full Table of Contents</a></h4>
674*7f2fe78bSCy Schubert    <h4>Search</h4>
675*7f2fe78bSCy Schubert    <form class="search" action="../search.html" method="get">
676*7f2fe78bSCy Schubert      <input type="text" name="q" size="18" />
677*7f2fe78bSCy Schubert      <input type="submit" value="Go" />
678*7f2fe78bSCy Schubert      <input type="hidden" name="check_keywords" value="yes" />
679*7f2fe78bSCy Schubert      <input type="hidden" name="area" value="default" />
680*7f2fe78bSCy Schubert    </form>
681*7f2fe78bSCy Schubert
682*7f2fe78bSCy Schubert        </div>
683*7f2fe78bSCy Schubert        <div class="clearer"></div>
684*7f2fe78bSCy Schubert      </div>
685*7f2fe78bSCy Schubert    </div>
686*7f2fe78bSCy Schubert
687*7f2fe78bSCy Schubert    <div class="footer-wrapper">
688*7f2fe78bSCy Schubert        <div class="footer" >
689*7f2fe78bSCy Schubert            <div class="right" ><i>Release: 1.21.3</i><br />
690*7f2fe78bSCy Schubert                &copy; <a href="../copyright.html">Copyright</a> 1985-2024, MIT.
691*7f2fe78bSCy Schubert            </div>
692*7f2fe78bSCy Schubert            <div class="left">
693*7f2fe78bSCy Schubert
694*7f2fe78bSCy Schubert        <a href="../index.html" title="Full Table of Contents"
695*7f2fe78bSCy Schubert            >Contents</a> |
696*7f2fe78bSCy Schubert        <a href="realm_config.html" title="Realm configuration decisions"
697*7f2fe78bSCy Schubert            >previous</a> |
698*7f2fe78bSCy Schubert        <a href="dbtypes.html" title="Database types"
699*7f2fe78bSCy Schubert            >next</a> |
700*7f2fe78bSCy Schubert        <a href="../genindex.html" title="General Index"
701*7f2fe78bSCy Schubert            >index</a> |
702*7f2fe78bSCy Schubert        <a href="../search.html" title="Enter search criteria"
703*7f2fe78bSCy Schubert            >Search</a> |
704*7f2fe78bSCy Schubert    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Database administration">feedback</a>
705*7f2fe78bSCy Schubert            </div>
706*7f2fe78bSCy Schubert        </div>
707*7f2fe78bSCy Schubert    </div>
708*7f2fe78bSCy Schubert
709*7f2fe78bSCy Schubert  </body>
710*7f2fe78bSCy Schubert</html>