.Dd April 11, 1999 .Dt KRB5.CONF 5 .Os HEIMDAL .Sh NAME .Nm /etc/krb5.conf .Nd Configuration file for Kerberos 5 .Sh DESCRIPTION The .Nm file specifies several configuration parameters for the Kerberos 5 library, as well as for some programs.
p The file consists of one or more sections, containing a number of bindings. The value of each binding can be either a string or a list of other bindings. The grammar looks like: d -literal -offset indent file: /* empty */ sections sections: section sections section section: '[' section_name ']' bindings section_name: STRING bindings: binding bindings binding binding: name '=' STRING name '=' '{' bindings '}' name: STRING .Ed .Li STRINGs consists of one or more non-white space characters. Currently recognised sections and bindings are: l -tag -width "xxx" -offset indent t Li [libdefaults] l -tag -width "xxx" -offset indent t Li default_realm = Va REALM Default realm to use, this is also known as your .Dq local realm . The default is the result of .Fn krb5_get_host_realm "local hostname" . t Li clockskew = Va time Maximum time differential (in seconds) allowed when comparing times. Default is 300 seconds (five minutes). t Li kdc_timeout = Va time Maximum time to wait for a reply from the kdc, default is 3 seconds. t v4_name_convert t v4_instance_resolve These are decribed in the .Xr krb5_425_conv_principal 3 manual page. t Li capath = Va realm-routing-table t Li default_etypes = Va etypes... A list of default etypes to use. t Li default_etypes_des = Va etypes... A list of default etypes to use when requesting a DES credential. t Li default_keytab_name = Va keytab The keytab to use if none other is specified, default is .Dq FILE:/etc/krb5.keytab . t Li kdc_timesync = Va boolean Try to keep track of the time differential between the local machine and the KDC, and then compensate for that when issuing requests. t Li max_retries = Va number The max number of times to try to contact each KDC. t Li ticket_lifetime = Va time Default ticket lifetime. t Li renew_lifetime = Va time Default renewable ticket lifetime. t Li verify_ap_req_nofail = Va boolean Enable to make a failure to verify obtained credentials non-fatal. This can be useful if there is no keytab on a host. t Li warn_pwexpire = Va time How soon to warn for expiring password. Default is seven days. t Li http_proxy = Va proxy-spec A HTTP-proxy to use when talking to the KDC via HTTP. t Li dns_proxy = Va proxy-spec Enable using DNS via HTTP. t Li extra_addresses = Va address... A list of addresses to get tickets for along with all local addresses. t Li time_format = Va string How to print time strings in logs, this string is passed to .Xr strftime 3 . t Li log_utc = Va boolean Write log-entries using UTC instead of your local time zone. .El t Li [domain_realm] This is a list of mappings from DNS domain to Kerberos realm. Each binding in this section looks like:
p .Dl domain = realm
p The domain can be either a full name of a host or a trailing component, in the latter case the domain-string should start with a perid. t Li [realms] l -tag -width "xxx" -offset indent t Va REALM Li = { l -tag -width "xxx" -offset indent t Li kdc = Va host[:port] Specifies a kdc for this realm. If the optional port is absent, the default value for the .Dq kerberos/udp service will be used. t Li v4_instance_convert t Li v4_name_convert t Li default_domain See .Xr krb5_425_conv_principal 3 . .El t Li } .El t Li [logging] l -tag -width "xxx" -offset indent t Va entity Li = Va destination Specifies that .Va entity should use the specified .Li destination for logging. See the .Xr krb5_openlog 3 manual page for a list of defined destinations. .El .El .Sh EXAMPLE d -literal -offset indent [lib_defaults] default_domain = FOO.SE [domain_realm] .foo.se = FOO.SE .bar.se = FOO.SE [realms] FOO.SE = { kdc = kerberos.foo.se v4_name_convert = { rcmd = host } v4_instance_convert = { xyz = xyz.bar.se } default_domain = foo.se } [logging] kdc = FILE:/var/heimdal/kdc.log kdc = SYSLOG:INFO default = SYSLOG:INFO:USER .Ed .Sh SEE ALSO .Xr krb5_openlog 3 , .Xr krb5_425_conv_principal 3 , .Xr strftime 3 , .Xr Source tm