| krb5.conf.5 (55682) | krb5.conf.5 (72445) |
|---|---|
| 1.\" $Id: krb5.conf.5,v 1.7 1999/11/04 01:57:28 assar Exp $ | 1.\" $Id: krb5.conf.5,v 1.12 2001/01/19 04:53:24 assar Exp $ |
| 2.\" 3.Dd April 11, 1999 4.Dt KRB5.CONF 5 5.Os HEIMDAL 6.Sh NAME 7.Nm /etc/krb5.conf 8.Nd 9Configuration file for Kerberos 5 --- 31 unchanged lines hidden (view full) --- 41 42name: 43 STRING 44 45.Ed 46.Li STRINGs 47consists of one or more non-white space characters. 48Currently recognised sections and bindings are: | 2.\" 3.Dd April 11, 1999 4.Dt KRB5.CONF 5 5.Os HEIMDAL 6.Sh NAME 7.Nm /etc/krb5.conf 8.Nd 9Configuration file for Kerberos 5 --- 31 unchanged lines hidden (view full) --- 41 42name: 43 STRING 44 45.Ed 46.Li STRINGs 47consists of one or more non-white space characters. 48Currently recognised sections and bindings are: |
| 49 | |
| 50.Bl -tag -width "xxx" -offset indent 51.It Li [libdefaults] 52.Bl -tag -width "xxx" -offset indent 53.It Li default_realm = Va REALM 54Default realm to use, this is also known as your 55.Dq local realm . 56The default is the result of 57.Fn krb5_get_host_realm "local hostname" . 58.It Li clockskew = Va time 59Maximum time differential (in seconds) allowed when comparing 60times. Default is 300 seconds (five minutes). 61.It Li kdc_timeout = Va time 62Maximum time to wait for a reply from the kdc, default is 3 seconds. 63.It v4_name_convert 64.It v4_instance_resolve 65These are decribed in the 66.Xr krb5_425_conv_principal 3 67manual page. | 49.Bl -tag -width "xxx" -offset indent 50.It Li [libdefaults] 51.Bl -tag -width "xxx" -offset indent 52.It Li default_realm = Va REALM 53Default realm to use, this is also known as your 54.Dq local realm . 55The default is the result of 56.Fn krb5_get_host_realm "local hostname" . 57.It Li clockskew = Va time 58Maximum time differential (in seconds) allowed when comparing 59times. Default is 300 seconds (five minutes). 60.It Li kdc_timeout = Va time 61Maximum time to wait for a reply from the kdc, default is 3 seconds. 62.It v4_name_convert 63.It v4_instance_resolve 64These are decribed in the 65.Xr krb5_425_conv_principal 3 66manual page. |
| 68.It Li capath = Va realm-routing-table | 67.It Li capath = { 68.Bl -tag -width "xxx" -offset indent 69.It Va destination-realm Li = Va next-hop-realm 70.It ... 71.El 72Normally, all requests to realms different from the one of the current 73client are sent to this KDC to get cross-realm tickets. 74If this KDC does not have a cross-realm key with the desired realm and 75the hierarchical path to that realm does not work, a path can be 76configured using this directive. 77The text shown above instructs the KDC to try to obtain a cross-realm 78ticket to 79.Va next-hop-realm 80when the desired realm is 81.Va destination-realm . 82This configuration should preferably be done on the KDC where it will 83help all its clients but can also be done on the client itself. 84.It Li } |
| 69.It Li default_etypes = Va etypes... 70A list of default etypes to use. 71.It Li default_etypes_des = Va etypes... 72A list of default etypes to use when requesting a DES credential. 73.It Li default_keytab_name = Va keytab 74The keytab to use if none other is specified, default is 75.Dq FILE:/etc/krb5.keytab . 76.It Li kdc_timesync = Va boolean --- 31 unchanged lines hidden (view full) --- 108The domain can be either a full name of a host or a trailing 109component, in the latter case the domain-string should start with a 110perid. 111.It Li [realms] 112.Bl -tag -width "xxx" -offset indent 113.It Va REALM Li = { 114.Bl -tag -width "xxx" -offset indent 115.It Li kdc = Va host[:port] | 85.It Li default_etypes = Va etypes... 86A list of default etypes to use. 87.It Li default_etypes_des = Va etypes... 88A list of default etypes to use when requesting a DES credential. 89.It Li default_keytab_name = Va keytab 90The keytab to use if none other is specified, default is 91.Dq FILE:/etc/krb5.keytab . 92.It Li kdc_timesync = Va boolean --- 31 unchanged lines hidden (view full) --- 124The domain can be either a full name of a host or a trailing 125component, in the latter case the domain-string should start with a 126perid. 127.It Li [realms] 128.Bl -tag -width "xxx" -offset indent 129.It Va REALM Li = { 130.Bl -tag -width "xxx" -offset indent 131.It Li kdc = Va host[:port] |
| 116Specifies a kdc for this realm. If the optional port is absent, the | 132Specifies a list of kdcs for this realm. If the optional port is absent, the |
| 117default value for the 118.Dq kerberos/udp 119service will be used. | 133default value for the 134.Dq kerberos/udp 135service will be used. |
| 136The kdcs will be used in the order that they are specified. 137.It Li admin_server = Va host[:port] 138Specifies the admin server for this realm, where all the modifications 139to the database are perfomed. 140.It Li kpasswd_server = Va host[:port] 141Points to the server where all the password changes are perfomed. 142If there is no such entry, the kpasswd port on the admin_server host 143will be tried. |
|
| 120.It Li v4_instance_convert 121.It Li v4_name_convert 122.It Li default_domain 123See 124.Xr krb5_425_conv_principal 3 . 125.El 126.It Li } 127.El 128.It Li [logging] 129.Bl -tag -width "xxx" -offset indent 130.It Va entity Li = Va destination 131Specifies that 132.Va entity 133should use the specified 134.Li destination 135for logging. See the 136.Xr krb5_openlog 3 137manual page for a list of defined destinations. 138.El | 144.It Li v4_instance_convert 145.It Li v4_name_convert 146.It Li default_domain 147See 148.Xr krb5_425_conv_principal 3 . 149.El 150.It Li } 151.El 152.It Li [logging] 153.Bl -tag -width "xxx" -offset indent 154.It Va entity Li = Va destination 155Specifies that 156.Va entity 157should use the specified 158.Li destination 159for logging. See the 160.Xr krb5_openlog 3 161manual page for a list of defined destinations. 162.El |
| 163.It Li [kdc] 164.Bl -tag -width "xxx" -offset indent 165.It database Li = { 166.Bl -tag -width "xxx" -offset indent 167.It dbname Li = Va DATABASENAME 168use this database for this realm. 169.It realm Li = Va REALM 170specifies the realm that will be stored in this database. 171.It mkey_file Li = Pa FILENAME 172use this keytab file for the master key of this database. 173If not specified 174.Va DATABASENAME Ns .mkey 175will be used. 176.It acl_file Li = PA FILENAME 177use this file for the ACL list of this database. 178.It log_file Li = Pa FILENAME 179use this file as the log of changes performed to the database. This 180file is used by 181.Nm ipropd-master 182for propagating changes to slaves. |
|
| 139.El | 183.El |
| 184.It Li } 185.It max-request = Va SIZE 186Maximum size of a kdc request. 187.It require-preauth = Va BOOL 188If set pre-authentication is required. Since krb4 requests are not 189pre-authenticated they will be rejected. 190.It ports = Va "list of ports" 191list of ports the kdc should listen to. 192.It addresses = Va "list of interfaces" 193list of addresses the kdc should bind to. 194.It enable-kerberos4 = Va BOOL 195turn on kerberos4 support. 196.It v4-realm = Va REALM 197to what realm v4 requests should be mapped. 198.It enable-524 = Va BOOL 199should the Kerberos 524 converting facility be turned on. Default is same as 200.Va enable-kerberos4 . 201.It enable-http = Va BOOL 202should the kdc answer kdc-requests over http. 203.It enable-kaserver = Va BOOL 204if this kdc should emulate the AFS kaserver. 205.It check-ticket-addresses = Va BOOL 206verify the addresses in the tickets used in tgs requests. 207.\" XXX 208.It allow-null-ticket-addresses = Va BOOL 209allow addresses-less tickets. 210.\" XXX 211.It allow-anonymous = Va BOOL 212if the kdc is allowed to hand out anonymous tickets. 213.It encode_as_rep_as_tgs_rep = Va BOOL 214encode as-rep as tgs-rep tobe compatible with mistakes older DCE secd did. 215.\" XXX 216.It kdc_warn_pwexpire = Va TIME 217the time before expiration that the user should be warned that her 218password is about to expire. 219.It logging = Va Logging 220What type of logging the kdc should use, see also [logging]/kdc. 221.El 222.It Li [kadmin] 223.Bl -tag -width "xxx" -offset indent 224.It require-preauth = Va BOOL 225If pre-authentication is required to talk to the kadmin server. 226.It default_keys = Va keytypes... 227for each entry in 228.Va default_keys 229try to parse it as a sequence of 230.Va etype:salttype:salt 231syntax of this if something like: 232.Pp 233[(des|des3|etype):](pw-salt|afs3-salt)[:string] 234.Pp 235if 236.Ar etype 237is omitted it means everything, and if string is omitted is means the default string (for that principal). Additional special values of keyttypes are: 238.Bl -tag -width "xxx" -offset indent 239.It v5 240The kerberos 5 salt 241.Va pw-salt 242.It v4 243The kerberos 4 type 244.Va des:pw-salt: 245.El 246.It use_v4_salt = Va BOOL 247When true, this is the same as 248.Pp 249.Va default_keys = Va des3:pw-salt Va v4 250.Pp 251and is only left for backwards compatability. 252.El 253.El 254.Sh ENVIRONMENT 255.Ev KRB5_CONFIG 256points to the configuration file to read. |
|
| 140.Sh EXAMPLE 141.Bd -literal -offset indent 142[lib_defaults] 143 default_domain = FOO.SE 144[domain_realm] 145 .foo.se = FOO.SE 146 .bar.se = FOO.SE 147[realms] --- 7 unchanged lines hidden (view full) --- 155 } 156 default_domain = foo.se 157 } 158[logging] 159 kdc = FILE:/var/heimdal/kdc.log 160 kdc = SYSLOG:INFO 161 default = SYSLOG:INFO:USER 162.Ed | 257.Sh EXAMPLE 258.Bd -literal -offset indent 259[lib_defaults] 260 default_domain = FOO.SE 261[domain_realm] 262 .foo.se = FOO.SE 263 .bar.se = FOO.SE 264[realms] --- 7 unchanged lines hidden (view full) --- 272 } 273 default_domain = foo.se 274 } 275[logging] 276 kdc = FILE:/var/heimdal/kdc.log 277 kdc = SYSLOG:INFO 278 default = SYSLOG:INFO:USER 279.Ed |
| 280.Sh DIAGNOSTICS 281Since 282.Nm 283is read and parsed by the krb5 library, there is not a lot of 284opportunities for programs to report parsing errors in any useful 285format. 286To help overcome this problem, there is a program 287.Nm verify_krb5_conf 288that reads 289.Nm 290and tries to emit useful diagnostics from parsing errors. Note that 291this program does not have any way of knowing what options are 292actually used and thus cannot warn about unknown or misspelt ones. |
|
| 163.Sh SEE ALSO | 293.Sh SEE ALSO |
| 294.Xr verify_krb5_conf 8 , |
|
| 164.Xr krb5_openlog 3 , 165.Xr krb5_425_conv_principal 3 , 166.Xr strftime 3 , 167.Xr Source tm | 295.Xr krb5_openlog 3 , 296.Xr krb5_425_conv_principal 3 , 297.Xr strftime 3 , 298.Xr Source tm |