Mercurial > repos > rliterman > csp2

comparison CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/share/man/man5/kdc.conf.5 @ 68:5028fdace37b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
planemo upload commit 2e9511a184a1ca667c7be0c6321a36dc4e3d116d
author jpayne
date Tue, 18 Mar 2025 16:23:26 -0400
parents
children
comparison
equal deleted inserted replaced
67:0e9998148a16 68:5028fdace37b
1 .\" Man page generated from reStructuredText.
2 .
3 .TH "KDC.CONF" "5" " " "1.20.1" "MIT Kerberos"
4 .SH NAME
5 kdc.conf \- Kerberos V5 KDC configuration file
6 .
7 .nr rst2man-indent-level 0
8 .
9 .de1 rstReportMargin
10 \\$1 \\n[an-margin]
11 level \\n[rst2man-indent-level]
12 level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
13 -
14 \\n[rst2man-indent0]
15 \\n[rst2man-indent1]
16 \\n[rst2man-indent2]
17 ..
18 .de1 INDENT
19 .\" .rstReportMargin pre:
20 . RS \\$1
21 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
22 . nr rst2man-indent-level +1
23 .\" .rstReportMargin post:
24 ..
25 .de UNINDENT
26 . RE
27 .\" indent \\n[an-margin]
28 .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
29 .nr rst2man-indent-level -1
30 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
31 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
32 ..
33 .sp
34 The kdc.conf file supplements krb5.conf(5) for programs which
35 are typically only used on a KDC, such as the krb5kdc(8) and
36 kadmind(8) daemons and the kdb5_util(8) program.
37 Relations documented here may also be specified in krb5.conf; for the
38 KDC programs mentioned, krb5.conf and kdc.conf will be merged into a
39 single configuration profile.
40 .sp
41 Normally, the kdc.conf file is found in the KDC state directory,
42 \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\&. You can override the default location by setting the
43 environment variable \fBKRB5_KDC_PROFILE\fP\&.
44 .sp
45 Please note that you need to restart the KDC daemon for any configuration
46 changes to take effect.
47 .SH STRUCTURE
48 .sp
49 The kdc.conf file is set up in the same format as the
50 krb5.conf(5) file.
51 .SH SECTIONS
52 .sp
53 The kdc.conf file may contain the following sections:
54 .TS
55 center;
56 |l|l|.
57 _
58 T{
59 \fI\%[kdcdefaults]\fP
60 T} T{
61 Default values for KDC behavior
62 T}
63 _
64 T{
65 \fI\%[realms]\fP
66 T} T{
67 Realm\-specific database configuration and settings
68 T}
69 _
70 T{
71 \fI\%[dbdefaults]\fP
72 T} T{
73 Default database settings
74 T}
75 _
76 T{
77 \fI\%[dbmodules]\fP
78 T} T{
79 Per\-database settings
80 T}
81 _
82 T{
83 \fI\%[logging]\fP
84 T} T{
85 Controls how Kerberos daemons perform logging
86 T}
87 _
88 .TE
89 .SS [kdcdefaults]
90 .sp
91 Some relations in the [kdcdefaults] section specify default values for
92 realm variables, to be used if the [realms] subsection does not
93 contain a relation for the tag. See the \fI\%[realms]\fP section for
94 the definitions of these relations.
95 .INDENT 0.0
96 .IP \(bu 2
97 \fBhost_based_services\fP
98 .IP \(bu 2
99 \fBkdc_listen\fP
100 .IP \(bu 2
101 \fBkdc_ports\fP
102 .IP \(bu 2
103 \fBkdc_tcp_listen\fP
104 .IP \(bu 2
105 \fBkdc_tcp_ports\fP
106 .IP \(bu 2
107 \fBno_host_referral\fP
108 .IP \(bu 2
109 \fBrestrict_anonymous_to_tgt\fP
110 .UNINDENT
111 .sp
112 The following [kdcdefaults] variables have no per\-realm equivalent:
113 .INDENT 0.0
114 .TP
115 \fBkdc_max_dgram_reply_size\fP
116 Specifies the maximum packet size that can be sent over UDP. The
117 default value is 4096 bytes.
118 .TP
119 \fBkdc_tcp_listen_backlog\fP
120 (Integer.) Set the size of the listen queue length for the KDC
121 daemon. The value may be limited by OS settings. The default
122 value is 5.
123 .TP
124 \fBspake_preauth_kdc_challenge\fP
125 (String.) Specifies the group for a SPAKE optimistic challenge.
126 See the \fBspake_preauth_groups\fP variable in libdefaults
127 for possible values. The default is not to issue an optimistic
128 challenge. (New in release 1.17.)
129 .UNINDENT
130 .SS [realms]
131 .sp
132 Each tag in the [realms] section is the name of a Kerberos realm. The
133 value of the tag is a subsection where the relations define KDC
134 parameters for that particular realm. The following example shows how
135 to define one parameter for the ATHENA.MIT.EDU realm:
136 .INDENT 0.0
137 .INDENT 3.5
138 .sp
139 .nf
140 .ft C
141 [realms]
142 ATHENA.MIT.EDU = {
143 max_renewable_life = 7d 0h 0m 0s
144 }
145 .ft P
146 .fi
147 .UNINDENT
148 .UNINDENT
149 .sp
150 The following tags may be specified in a [realms] subsection:
151 .INDENT 0.0
152 .TP
153 \fBacl_file\fP
154 (String.) Location of the access control list file that
155 kadmind(8) uses to determine which principals are allowed
156 which permissions on the Kerberos database. To operate without an
157 ACL file, set this relation to the empty string with \fBacl_file =
158 ""\fP\&. The default value is \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP\&. For more
159 information on Kerberos ACL file see kadm5.acl(5)\&.
160 .TP
161 \fBdatabase_module\fP
162 (String.) This relation indicates the name of the configuration
163 section under \fI\%[dbmodules]\fP for database\-specific parameters
164 used by the loadable database library. The default value is the
165 realm name. If this configuration section does not exist, default
166 values will be used for all database parameters.
167 .TP
168 \fBdatabase_name\fP
169 (String, deprecated.) This relation specifies the location of the
170 Kerberos database for this realm, if the DB2 module is being used
171 and the \fI\%[dbmodules]\fP configuration section does not specify a
172 database name. The default value is \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/principal\fP\&.
173 .TP
174 \fBdefault_principal_expiration\fP
175 (abstime string.) Specifies the default expiration date of
176 principals created in this realm. The default value is 0, which
177 means no expiration date.
178 .TP
179 \fBdefault_principal_flags\fP
180 (Flag string.) Specifies the default attributes of principals
181 created in this realm. The format for this string is a
182 comma\-separated list of flags, with \(aq+\(aq before each flag that
183 should be enabled and \(aq\-\(aq before each flag that should be
184 disabled. The \fBpostdateable\fP, \fBforwardable\fP, \fBtgt\-based\fP,
185 \fBrenewable\fP, \fBproxiable\fP, \fBdup\-skey\fP, \fBallow\-tickets\fP, and
186 \fBservice\fP flags default to enabled.
187 .sp
188 There are a number of possible flags:
189 .INDENT 7.0
190 .TP
191 \fBallow\-tickets\fP
192 Enabling this flag means that the KDC will issue tickets for
193 this principal. Disabling this flag essentially deactivates
194 the principal within this realm.
195 .TP
196 \fBdup\-skey\fP
197 Enabling this flag allows the KDC to issue user\-to\-user
198 service tickets for this principal.
199 .TP
200 \fBforwardable\fP
201 Enabling this flag allows the principal to obtain forwardable
202 tickets.
203 .TP
204 \fBhwauth\fP
205 If this flag is enabled, then the principal is required to
206 preauthenticate using a hardware device before receiving any
207 tickets.
208 .TP
209 \fBno\-auth\-data\-required\fP
210 Enabling this flag prevents PAC or AD\-SIGNEDPATH data from
211 being added to service tickets for the principal.
212 .TP
213 \fBok\-as\-delegate\fP
214 If this flag is enabled, it hints the client that credentials
215 can and should be delegated when authenticating to the
216 service.
217 .TP
218 \fBok\-to\-auth\-as\-delegate\fP
219 Enabling this flag allows the principal to use S4USelf tickets.
220 .TP
221 \fBpostdateable\fP
222 Enabling this flag allows the principal to obtain postdateable
223 tickets.
224 .TP
225 \fBpreauth\fP
226 If this flag is enabled on a client principal, then that
227 principal is required to preauthenticate to the KDC before
228 receiving any tickets. On a service principal, enabling this
229 flag means that service tickets for this principal will only
230 be issued to clients with a TGT that has the preauthenticated
231 bit set.
232 .TP
233 \fBproxiable\fP
234 Enabling this flag allows the principal to obtain proxy
235 tickets.
236 .TP
237 \fBpwchange\fP
238 Enabling this flag forces a password change for this
239 principal.
240 .TP
241 \fBpwservice\fP
242 If this flag is enabled, it marks this principal as a password
243 change service. This should only be used in special cases,
244 for example, if a user\(aqs password has expired, then the user
245 has to get tickets for that principal without going through
246 the normal password authentication in order to be able to
247 change the password.
248 .TP
249 \fBrenewable\fP
250 Enabling this flag allows the principal to obtain renewable
251 tickets.
252 .TP
253 \fBservice\fP
254 Enabling this flag allows the the KDC to issue service tickets
255 for this principal. In release 1.17 and later, user\-to\-user
256 service tickets are still allowed if the \fBdup\-skey\fP flag is
257 set.
258 .TP
259 \fBtgt\-based\fP
260 Enabling this flag allows a principal to obtain tickets based
261 on a ticket\-granting\-ticket, rather than repeating the
262 authentication process that was used to obtain the TGT.
263 .UNINDENT
264 .TP
265 \fBdict_file\fP
266 (String.) Location of the dictionary file containing strings that
267 are not allowed as passwords. The file should contain one string
268 per line, with no additional whitespace. If none is specified or
269 if there is no policy assigned to the principal, no dictionary
270 checks of passwords will be performed.
271 .TP
272 \fBdisable_pac\fP
273 (Boolean value.) If true, the KDC will not issue PACs for this
274 realm, and S4U2Self and S4U2Proxy operations will be disabled.
275 The default is false, which will permit the KDC to issue PACs.
276 New in release 1.20.
277 .TP
278 \fBencrypted_challenge_indicator\fP
279 (String.) Specifies the authentication indicator value that the KDC
280 asserts into tickets obtained using FAST encrypted challenge
281 pre\-authentication. New in 1.16.
282 .TP
283 \fBhost_based_services\fP
284 (Whitespace\- or comma\-separated list.) Lists services which will
285 get host\-based referral processing even if the server principal is
286 not marked as host\-based by the client.
287 .TP
288 \fBiprop_enable\fP
289 (Boolean value.) Specifies whether incremental database
290 propagation is enabled. The default value is false.
291 .TP
292 \fBiprop_ulogsize\fP
293 (Integer.) Specifies the maximum number of log entries to be
294 retained for incremental propagation. The default value is 1000.
295 Prior to release 1.11, the maximum value was 2500. New in release
296 1.19.
297 .TP
298 \fBiprop_master_ulogsize\fP
299 The name for \fBiprop_ulogsize\fP prior to release 1.19. Its value is
300 used as a fallback if \fBiprop_ulogsize\fP is not specified.
301 .TP
302 \fBiprop_replica_poll\fP
303 (Delta time string.) Specifies how often the replica KDC polls
304 for new updates from the primary. The default value is \fB2m\fP
305 (that is, two minutes). New in release 1.17.
306 .TP
307 \fBiprop_slave_poll\fP
308 (Delta time string.) The name for \fBiprop_replica_poll\fP prior to
309 release 1.17. Its value is used as a fallback if
310 \fBiprop_replica_poll\fP is not specified.
311 .TP
312 \fBiprop_listen\fP
313 (Whitespace\- or comma\-separated list.) Specifies the iprop RPC
314 listening addresses and/or ports for the kadmind(8) daemon.
315 Each entry may be an interface address, a port number, or an
316 address and port number separated by a colon. If the address
317 contains colons, enclose it in square brackets. If no address is
318 specified, the wildcard address is used. If kadmind fails to bind
319 to any of the specified addresses, it will fail to start. The
320 default (when \fBiprop_enable\fP is true) is to bind to the wildcard
321 address at the port specified in \fBiprop_port\fP\&. New in release
322 1.15.
323 .TP
324 \fBiprop_port\fP
325 (Port number.) Specifies the port number to be used for
326 incremental propagation. When \fBiprop_enable\fP is true, this
327 relation is required in the replica KDC configuration file, and
328 this relation or \fBiprop_listen\fP is required in the primary
329 configuration file, as there is no default port number. Port
330 numbers specified in \fBiprop_listen\fP entries will override this
331 port number for the kadmind(8) daemon.
332 .TP
333 \fBiprop_resync_timeout\fP
334 (Delta time string.) Specifies the amount of time to wait for a
335 full propagation to complete. This is optional in configuration
336 files, and is used by replica KDCs only. The default value is 5
337 minutes (\fB5m\fP). New in release 1.11.
338 .TP
339 \fBiprop_logfile\fP
340 (File name.) Specifies where the update log file for the realm
341 database is to be stored. The default is to use the
342 \fBdatabase_name\fP entry from the realms section of the krb5 config
343 file, with \fB\&.ulog\fP appended. (NOTE: If \fBdatabase_name\fP isn\(aqt
344 specified in the realms section, perhaps because the LDAP database
345 back end is being used, or the file name is specified in the
346 [dbmodules] section, then the hard\-coded default for
347 \fBdatabase_name\fP is used. Determination of the \fBiprop_logfile\fP
348 default value will not use values from the [dbmodules] section.)
349 .TP
350 \fBkadmind_listen\fP
351 (Whitespace\- or comma\-separated list.) Specifies the kadmin RPC
352 listening addresses and/or ports for the kadmind(8) daemon.
353 Each entry may be an interface address, a port number, or an
354 address and port number separated by a colon. If the address
355 contains colons, enclose it in square brackets. If no address is
356 specified, the wildcard address is used. If kadmind fails to bind
357 to any of the specified addresses, it will fail to start. The
358 default is to bind to the wildcard address at the port specified
359 in \fBkadmind_port\fP, or the standard kadmin port (749). New in
360 release 1.15.
361 .TP
362 \fBkadmind_port\fP
363 (Port number.) Specifies the port on which the kadmind(8)
364 daemon is to listen for this realm. Port numbers specified in
365 \fBkadmind_listen\fP entries will override this port number. The
366 assigned port for kadmind is 749, which is used by default.
367 .TP
368 \fBkey_stash_file\fP
369 (String.) Specifies the location where the master key has been
370 stored (via kdb5_util stash). The default is \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/.k5.REALM\fP, where \fIREALM\fP is the Kerberos realm.
371 .TP
372 \fBkdc_listen\fP
373 (Whitespace\- or comma\-separated list.) Specifies the UDP
374 listening addresses and/or ports for the krb5kdc(8) daemon.
375 Each entry may be an interface address, a port number, or an
376 address and port number separated by a colon. If the address
377 contains colons, enclose it in square brackets. If no address is
378 specified, the wildcard address is used. If no port is specified,
379 the standard port (88) is used. If the KDC daemon fails to bind
380 to any of the specified addresses, it will fail to start. The
381 default is to bind to the wildcard address on the standard port.
382 New in release 1.15.
383 .TP
384 \fBkdc_ports\fP
385 (Whitespace\- or comma\-separated list, deprecated.) Prior to
386 release 1.15, this relation lists the ports for the
387 krb5kdc(8) daemon to listen on for UDP requests. In
388 release 1.15 and later, it has the same meaning as \fBkdc_listen\fP
389 if that relation is not defined.
390 .TP
391 \fBkdc_tcp_listen\fP
392 (Whitespace\- or comma\-separated list.) Specifies the TCP
393 listening addresses and/or ports for the krb5kdc(8) daemon.
394 Each entry may be an interface address, a port number, or an
395 address and port number separated by a colon. If the address
396 contains colons, enclose it in square brackets. If no address is
397 specified, the wildcard address is used. If no port is specified,
398 the standard port (88) is used. To disable listening on TCP, set
399 this relation to the empty string with \fBkdc_tcp_listen = ""\fP\&.
400 If the KDC daemon fails to bind to any of the specified addresses,
401 it will fail to start. The default is to bind to the wildcard
402 address on the standard port. New in release 1.15.
403 .TP
404 \fBkdc_tcp_ports\fP
405 (Whitespace\- or comma\-separated list, deprecated.) Prior to
406 release 1.15, this relation lists the ports for the
407 krb5kdc(8) daemon to listen on for UDP requests. In
408 release 1.15 and later, it has the same meaning as
409 \fBkdc_tcp_listen\fP if that relation is not defined.
410 .TP
411 \fBkpasswd_listen\fP
412 (Comma\-separated list.) Specifies the kpasswd listening addresses
413 and/or ports for the kadmind(8) daemon. Each entry may be
414 an interface address, a port number, or an address and port number
415 separated by a colon. If the address contains colons, enclose it
416 in square brackets. If no address is specified, the wildcard
417 address is used. If kadmind fails to bind to any of the specified
418 addresses, it will fail to start. The default is to bind to the
419 wildcard address at the port specified in \fBkpasswd_port\fP, or the
420 standard kpasswd port (464). New in release 1.15.
421 .TP
422 \fBkpasswd_port\fP
423 (Port number.) Specifies the port on which the kadmind(8)
424 daemon is to listen for password change requests for this realm.
425 Port numbers specified in \fBkpasswd_listen\fP entries will override
426 this port number. The assigned port for password change requests
427 is 464, which is used by default.
428 .TP
429 \fBmaster_key_name\fP
430 (String.) Specifies the name of the principal associated with the
431 master key. The default is \fBK/M\fP\&.
432 .TP
433 \fBmaster_key_type\fP
434 (Key type string.) Specifies the master key\(aqs key type. The
435 default value for this is \fBaes256\-cts\-hmac\-sha1\-96\fP\&. For a list of all possible
436 values, see \fI\%Encryption types\fP\&.
437 .TP
438 \fBmax_life\fP
439 (duration string.) Specifies the maximum time period for
440 which a ticket may be valid in this realm. The default value is
441 24 hours.
442 .TP
443 \fBmax_renewable_life\fP
444 (duration string.) Specifies the maximum time period
445 during which a valid ticket may be renewed in this realm.
446 The default value is 0.
447 .TP
448 \fBno_host_referral\fP
449 (Whitespace\- or comma\-separated list.) Lists services to block
450 from getting host\-based referral processing, even if the client
451 marks the server principal as host\-based or the service is also
452 listed in \fBhost_based_services\fP\&. \fBno_host_referral = *\fP will
453 disable referral processing altogether.
454 .TP
455 \fBreject_bad_transit\fP
456 (Boolean value.) If set to true, the KDC will check the list of
457 transited realms for cross\-realm tickets against the transit path
458 computed from the realm names and the capaths section of its
459 krb5.conf(5) file; if the path in the ticket to be issued
460 contains any realms not in the computed path, the ticket will not
461 be issued, and an error will be returned to the client instead.
462 If this value is set to false, such tickets will be issued
463 anyways, and it will be left up to the application server to
464 validate the realm transit path.
465 .sp
466 If the disable\-transited\-check flag is set in the incoming
467 request, this check is not performed at all. Having the
468 \fBreject_bad_transit\fP option will cause such ticket requests to
469 be rejected always.
470 .sp
471 This transit path checking and config file option currently apply
472 only to TGS requests.
473 .sp
474 The default value is true.
475 .TP
476 \fBrestrict_anonymous_to_tgt\fP
477 (Boolean value.) If set to true, the KDC will reject ticket
478 requests from anonymous principals to service principals other
479 than the realm\(aqs ticket\-granting service. This option allows
480 anonymous PKINIT to be enabled for use as FAST armor tickets
481 without allowing anonymous authentication to services. The
482 default value is false. New in release 1.9.
483 .TP
484 \fBspake_preauth_indicator\fP
485 (String.) Specifies an authentication indicator value that the
486 KDC asserts into tickets obtained using SPAKE pre\-authentication.
487 The default is not to add any indicators. This option may be
488 specified multiple times. New in release 1.17.
489 .TP
490 \fBsupported_enctypes\fP
491 (List of \fIkey\fP:\fIsalt\fP strings.) Specifies the default key/salt
492 combinations of principals for this realm. Any principals created
493 through kadmin(1) will have keys of these types. The
494 default value for this tag is \fBaes256\-cts\-hmac\-sha1\-96:normal aes128\-cts\-hmac\-sha1\-96:normal\fP\&. For lists of
495 possible values, see \fI\%Keysalt lists\fP\&.
496 .UNINDENT
497 .SS [dbdefaults]
498 .sp
499 The [dbdefaults] section specifies default values for some database
500 parameters, to be used if the [dbmodules] subsection does not contain
501 a relation for the tag. See the \fI\%[dbmodules]\fP section for the
502 definitions of these relations.
503 .INDENT 0.0
504 .IP \(bu 2
505 \fBldap_kerberos_container_dn\fP
506 .IP \(bu 2
507 \fBldap_kdc_dn\fP
508 .IP \(bu 2
509 \fBldap_kdc_sasl_authcid\fP
510 .IP \(bu 2
511 \fBldap_kdc_sasl_authzid\fP
512 .IP \(bu 2
513 \fBldap_kdc_sasl_mech\fP
514 .IP \(bu 2
515 \fBldap_kdc_sasl_realm\fP
516 .IP \(bu 2
517 \fBldap_kadmind_dn\fP
518 .IP \(bu 2
519 \fBldap_kadmind_sasl_authcid\fP
520 .IP \(bu 2
521 \fBldap_kadmind_sasl_authzid\fP
522 .IP \(bu 2
523 \fBldap_kadmind_sasl_mech\fP
524 .IP \(bu 2
525 \fBldap_kadmind_sasl_realm\fP
526 .IP \(bu 2
527 \fBldap_service_password_file\fP
528 .IP \(bu 2
529 \fBldap_conns_per_server\fP
530 .UNINDENT
531 .SS [dbmodules]
532 .sp
533 The [dbmodules] section contains parameters used by the KDC database
534 library and database modules. Each tag in the [dbmodules] section is
535 the name of a Kerberos realm or a section name specified by a realm\(aqs
536 \fBdatabase_module\fP parameter. The following example shows how to
537 define one database parameter for the ATHENA.MIT.EDU realm:
538 .INDENT 0.0
539 .INDENT 3.5
540 .sp
541 .nf
542 .ft C
543 [dbmodules]
544 ATHENA.MIT.EDU = {
545 disable_last_success = true
546 }
547 .ft P
548 .fi
549 .UNINDENT
550 .UNINDENT
551 .sp
552 The following tags may be specified in a [dbmodules] subsection:
553 .INDENT 0.0
554 .TP
555 \fBdatabase_name\fP
556 This DB2\-specific tag indicates the location of the database in
557 the filesystem. The default is \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/principal\fP\&.
558 .TP
559 \fBdb_library\fP
560 This tag indicates the name of the loadable database module. The
561 value should be \fBdb2\fP for the DB2 module, \fBklmdb\fP for the LMDB
562 module, or \fBkldap\fP for the LDAP module.
563 .TP
564 \fBdisable_last_success\fP
565 If set to \fBtrue\fP, suppresses KDC updates to the "Last successful
566 authentication" field of principal entries requiring
567 preauthentication. Setting this flag may improve performance.
568 (Principal entries which do not require preauthentication never
569 update the "Last successful authentication" field.). First
570 introduced in release 1.9.
571 .TP
572 \fBdisable_lockout\fP
573 If set to \fBtrue\fP, suppresses KDC updates to the "Last failed
574 authentication" and "Failed password attempts" fields of principal
575 entries requiring preauthentication. Setting this flag may
576 improve performance, but also disables account lockout. First
577 introduced in release 1.9.
578 .TP
579 \fBldap_conns_per_server\fP
580 This LDAP\-specific tag indicates the number of connections to be
581 maintained per LDAP server.
582 .TP
583 \fBldap_kdc_dn\fP and \fBldap_kadmind_dn\fP
584 These LDAP\-specific tags indicate the default DN for binding to
585 the LDAP server. The krb5kdc(8) daemon uses
586 \fBldap_kdc_dn\fP, while the kadmind(8) daemon and other
587 administrative programs use \fBldap_kadmind_dn\fP\&. The kadmind DN
588 must have the rights to read and write the Kerberos data in the
589 LDAP database. The KDC DN must have the same rights, unless
590 \fBdisable_lockout\fP and \fBdisable_last_success\fP are true, in
591 which case it only needs to have rights to read the Kerberos data.
592 These tags are ignored if a SASL mechanism is set with
593 \fBldap_kdc_sasl_mech\fP or \fBldap_kadmind_sasl_mech\fP\&.
594 .TP
595 \fBldap_kdc_sasl_mech\fP and \fBldap_kadmind_sasl_mech\fP
596 These LDAP\-specific tags specify the SASL mechanism (such as
597 \fBEXTERNAL\fP) to use when binding to the LDAP server. New in
598 release 1.13.
599 .TP
600 \fBldap_kdc_sasl_authcid\fP and \fBldap_kadmind_sasl_authcid\fP
601 These LDAP\-specific tags specify the SASL authentication identity
602 to use when binding to the LDAP server. Not all SASL mechanisms
603 require an authentication identity. If the SASL mechanism
604 requires a secret (such as the password for \fBDIGEST\-MD5\fP), these
605 tags also determine the name within the
606 \fBldap_service_password_file\fP where the secret is stashed. New
607 in release 1.13.
608 .TP
609 \fBldap_kdc_sasl_authzid\fP and \fBldap_kadmind_sasl_authzid\fP
610 These LDAP\-specific tags specify the SASL authorization identity
611 to use when binding to the LDAP server. In most circumstances
612 they do not need to be specified. New in release 1.13.
613 .TP
614 \fBldap_kdc_sasl_realm\fP and \fBldap_kadmind_sasl_realm\fP
615 These LDAP\-specific tags specify the SASL realm to use when
616 binding to the LDAP server. In most circumstances they do not
617 need to be set. New in release 1.13.
618 .TP
619 \fBldap_kerberos_container_dn\fP
620 This LDAP\-specific tag indicates the DN of the container object
621 where the realm objects will be located.
622 .TP
623 \fBldap_servers\fP
624 This LDAP\-specific tag indicates the list of LDAP servers that the
625 Kerberos servers can connect to. The list of LDAP servers is
626 whitespace\-separated. The LDAP server is specified by a LDAP URI.
627 It is recommended to use \fBldapi:\fP or \fBldaps:\fP URLs to connect
628 to the LDAP server.
629 .TP
630 \fBldap_service_password_file\fP
631 This LDAP\-specific tag indicates the file containing the stashed
632 passwords (created by \fBkdb5_ldap_util stashsrvpw\fP) for the
633 \fBldap_kdc_dn\fP and \fBldap_kadmind_dn\fP objects, or for the
634 \fBldap_kdc_sasl_authcid\fP or \fBldap_kadmind_sasl_authcid\fP names
635 for SASL authentication. This file must be kept secure.
636 .TP
637 \fBmapsize\fP
638 This LMDB\-specific tag indicates the maximum size of the two
639 database environments in megabytes. The default value is 128.
640 Increase this value to address "Environment mapsize limit reached"
641 errors. New in release 1.17.
642 .TP
643 \fBmax_readers\fP
644 This LMDB\-specific tag indicates the maximum number of concurrent
645 reading processes for the databases. The default value is 128.
646 New in release 1.17.
647 .TP
648 \fBnosync\fP
649 This LMDB\-specific tag can be set to improve the throughput of
650 kadmind and other administrative agents, at the expense of
651 durability (recent database changes may not survive a power outage
652 or other sudden reboot). It does not affect the throughput of the
653 KDC. The default value is false. New in release 1.17.
654 .TP
655 \fBunlockiter\fP
656 If set to \fBtrue\fP, this DB2\-specific tag causes iteration
657 operations to release the database lock while processing each
658 principal. Setting this flag to \fBtrue\fP can prevent extended
659 blocking of KDC or kadmin operations when dumps of large databases
660 are in progress. First introduced in release 1.13.
661 .UNINDENT
662 .sp
663 The following tag may be specified directly in the [dbmodules]
664 section to control where database modules are loaded from:
665 .INDENT 0.0
666 .TP
667 \fBdb_module_dir\fP
668 This tag controls where the plugin system looks for database
669 modules. The value should be an absolute path.
670 .UNINDENT
671 .SS [logging]
672 .sp
673 The [logging] section indicates how krb5kdc(8) and
674 kadmind(8) perform logging. It may contain the following
675 relations:
676 .INDENT 0.0
677 .TP
678 \fBadmin_server\fP
679 Specifies how kadmind(8) performs logging.
680 .TP
681 \fBkdc\fP
682 Specifies how krb5kdc(8) performs logging.
683 .TP
684 \fBdefault\fP
685 Specifies how either daemon performs logging in the absence of
686 relations specific to the daemon.
687 .TP
688 \fBdebug\fP
689 (Boolean value.) Specifies whether debugging messages are
690 included in log outputs other than SYSLOG. Debugging messages are
691 always included in the system log output because syslog performs
692 its own priority filtering. The default value is false. New in
693 release 1.15.
694 .UNINDENT
695 .sp
696 Logging specifications may have the following forms:
697 .INDENT 0.0
698 .TP
699 \fBFILE=\fP\fIfilename\fP or \fBFILE:\fP\fIfilename\fP
700 This value causes the daemon\(aqs logging messages to go to the
701 \fIfilename\fP\&. If the \fB=\fP form is used, the file is overwritten.
702 If the \fB:\fP form is used, the file is appended to.
703 .TP
704 \fBSTDERR\fP
705 This value causes the daemon\(aqs logging messages to go to its
706 standard error stream.
707 .TP
708 \fBCONSOLE\fP
709 This value causes the daemon\(aqs logging messages to go to the
710 console, if the system supports it.
711 .TP
712 \fBDEVICE=\fP\fI<devicename>\fP
713 This causes the daemon\(aqs logging messages to go to the specified
714 device.
715 .TP
716 \fBSYSLOG\fP[\fB:\fP\fIseverity\fP[\fB:\fP\fIfacility\fP]]
717 This causes the daemon\(aqs logging messages to go to the system log.
718 .sp
719 For backward compatibility, a severity argument may be specified,
720 and must be specified in order to specify a facility. This
721 argument will be ignored.
722 .sp
723 The facility argument specifies the facility under which the
724 messages are logged. This may be any of the following facilities
725 supported by the syslog(3) call minus the LOG_ prefix: \fBKERN\fP,
726 \fBUSER\fP, \fBMAIL\fP, \fBDAEMON\fP, \fBAUTH\fP, \fBLPR\fP, \fBNEWS\fP,
727 \fBUUCP\fP, \fBCRON\fP, and \fBLOCAL0\fP through \fBLOCAL7\fP\&. If no
728 facility is specified, the default is \fBAUTH\fP\&.
729 .UNINDENT
730 .sp
731 In the following example, the logging messages from the KDC will go to
732 the console and to the system log under the facility LOG_DAEMON, and
733 the logging messages from the administrative server will be appended
734 to the file \fB/var/adm/kadmin.log\fP and sent to the device
735 \fB/dev/tty04\fP\&.
736 .INDENT 0.0
737 .INDENT 3.5
738 .sp
739 .nf
740 .ft C
741 [logging]
742 kdc = CONSOLE
743 kdc = SYSLOG:INFO:DAEMON
744 admin_server = FILE:/var/adm/kadmin.log
745 admin_server = DEVICE=/dev/tty04
746 .ft P
747 .fi
748 .UNINDENT
749 .UNINDENT
750 .sp
751 If no logging specification is given, the default is to use syslog.
752 To disable logging entirely, specify \fBdefault = DEVICE=/dev/null\fP\&.
753 .SS [otp]
754 .sp
755 Each subsection of [otp] is the name of an OTP token type. The tags
756 within the subsection define the configuration required to forward a
757 One Time Password request to a RADIUS server.
758 .sp
759 For each token type, the following tags may be specified:
760 .INDENT 0.0
761 .TP
762 \fBserver\fP
763 This is the server to send the RADIUS request to. It can be a
764 hostname with optional port, an ip address with optional port, or
765 a Unix domain socket address. The default is
766 \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/<name>.socket\fP\&.
767 .TP
768 \fBsecret\fP
769 This tag indicates a filename (which may be relative to \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP)
770 containing the secret used to encrypt the RADIUS packets. The
771 secret should appear in the first line of the file by itself;
772 leading and trailing whitespace on the line will be removed. If
773 the value of \fBserver\fP is a Unix domain socket address, this tag
774 is optional, and an empty secret will be used if it is not
775 specified. Otherwise, this tag is required.
776 .TP
777 \fBtimeout\fP
778 An integer which specifies the time in seconds during which the
779 KDC should attempt to contact the RADIUS server. This tag is the
780 total time across all retries and should be less than the time
781 which an OTP value remains valid for. The default is 5 seconds.
782 .TP
783 \fBretries\fP
784 This tag specifies the number of retries to make to the RADIUS
785 server. The default is 3 retries (4 tries).
786 .TP
787 \fBstrip_realm\fP
788 If this tag is \fBtrue\fP, the principal without the realm will be
789 passed to the RADIUS server. Otherwise, the realm will be
790 included. The default value is \fBtrue\fP\&.
791 .TP
792 \fBindicator\fP
793 This tag specifies an authentication indicator to be included in
794 the ticket if this token type is used to authenticate. This
795 option may be specified multiple times. (New in release 1.14.)
796 .UNINDENT
797 .sp
798 In the following example, requests are sent to a remote server via UDP:
799 .INDENT 0.0
800 .INDENT 3.5
801 .sp
802 .nf
803 .ft C
804 [otp]
805 MyRemoteTokenType = {
806 server = radius.mydomain.com:1812
807 secret = SEmfiajf42$
808 timeout = 15
809 retries = 5
810 strip_realm = true
811 }
812 .ft P
813 .fi
814 .UNINDENT
815 .UNINDENT
816 .sp
817 An implicit default token type named \fBDEFAULT\fP is defined for when
818 the per\-principal configuration does not specify a token type. Its
819 configuration is shown below. You may override this token type to
820 something applicable for your situation:
821 .INDENT 0.0
822 .INDENT 3.5
823 .sp
824 .nf
825 .ft C
826 [otp]
827 DEFAULT = {
828 strip_realm = false
829 }
830 .ft P
831 .fi
832 .UNINDENT
833 .UNINDENT
834 .SH PKINIT OPTIONS
835 .sp
836 \fBNOTE:\fP
837 .INDENT 0.0
838 .INDENT 3.5
839 The following are pkinit\-specific options. These values may
840 be specified in [kdcdefaults] as global defaults, or within
841 a realm\-specific subsection of [realms]. Also note that a
842 realm\-specific value over\-rides, does not add to, a generic
843 [kdcdefaults] specification. The search order is:
844 .UNINDENT
845 .UNINDENT
846 .INDENT 0.0
847 .IP 1. 3
848 realm\-specific subsection of [realms]:
849 .INDENT 3.0
850 .INDENT 3.5
851 .sp
852 .nf
853 .ft C
854 [realms]
855 EXAMPLE.COM = {
856 pkinit_anchors = FILE:/usr/local/example.com.crt
857 }
858 .ft P
859 .fi
860 .UNINDENT
861 .UNINDENT
862 .IP 2. 3
863 generic value in the [kdcdefaults] section:
864 .INDENT 3.0
865 .INDENT 3.5
866 .sp
867 .nf
868 .ft C
869 [kdcdefaults]
870 pkinit_anchors = DIR:/usr/local/generic_trusted_cas/
871 .ft P
872 .fi
873 .UNINDENT
874 .UNINDENT
875 .UNINDENT
876 .sp
877 For information about the syntax of some of these options, see
878 Specifying PKINIT identity information in
879 krb5.conf(5)\&.
880 .INDENT 0.0
881 .TP
882 \fBpkinit_anchors\fP
883 Specifies the location of trusted anchor (root) certificates which
884 the KDC trusts to sign client certificates. This option is
885 required if pkinit is to be supported by the KDC. This option may
886 be specified multiple times.
887 .TP
888 \fBpkinit_dh_min_bits\fP
889 Specifies the minimum number of bits the KDC is willing to accept
890 for a client\(aqs Diffie\-Hellman key. The default is 2048.
891 .TP
892 \fBpkinit_allow_upn\fP
893 Specifies that the KDC is willing to accept client certificates
894 with the Microsoft UserPrincipalName (UPN) Subject Alternative
895 Name (SAN). This means the KDC accepts the binding of the UPN in
896 the certificate to the Kerberos principal name. The default value
897 is false.
898 .sp
899 Without this option, the KDC will only accept certificates with
900 the id\-pkinit\-san as defined in \fI\%RFC 4556\fP\&. There is currently
901 no option to disable SAN checking in the KDC.
902 .TP
903 \fBpkinit_eku_checking\fP
904 This option specifies what Extended Key Usage (EKU) values the KDC
905 is willing to accept in client certificates. The values
906 recognized in the kdc.conf file are:
907 .INDENT 7.0
908 .TP
909 \fBkpClientAuth\fP
910 This is the default value and specifies that client
911 certificates must have the id\-pkinit\-KPClientAuth EKU as
912 defined in \fI\%RFC 4556\fP\&.
913 .TP
914 \fBscLogin\fP
915 If scLogin is specified, client certificates with the
916 Microsoft Smart Card Login EKU (id\-ms\-kp\-sc\-logon) will be
917 accepted.
918 .TP
919 \fBnone\fP
920 If none is specified, then client certificates will not be
921 checked to verify they have an acceptable EKU. The use of
922 this option is not recommended.
923 .UNINDENT
924 .TP
925 \fBpkinit_identity\fP
926 Specifies the location of the KDC\(aqs X.509 identity information.
927 This option is required if pkinit is to be supported by the KDC.
928 .TP
929 \fBpkinit_indicator\fP
930 Specifies an authentication indicator to include in the ticket if
931 pkinit is used to authenticate. This option may be specified
932 multiple times. (New in release 1.14.)
933 .TP
934 \fBpkinit_pool\fP
935 Specifies the location of intermediate certificates which may be
936 used by the KDC to complete the trust chain between a client\(aqs
937 certificate and a trusted anchor. This option may be specified
938 multiple times.
939 .TP
940 \fBpkinit_revoke\fP
941 Specifies the location of Certificate Revocation List (CRL)
942 information to be used by the KDC when verifying the validity of
943 client certificates. This option may be specified multiple times.
944 .TP
945 \fBpkinit_require_crl_checking\fP
946 The default certificate verification process will always check the
947 available revocation information to see if a certificate has been
948 revoked. If a match is found for the certificate in a CRL,
949 verification fails. If the certificate being verified is not
950 listed in a CRL, or there is no CRL present for its issuing CA,
951 and \fBpkinit_require_crl_checking\fP is false, then verification
952 succeeds.
953 .sp
954 However, if \fBpkinit_require_crl_checking\fP is true and there is
955 no CRL information available for the issuing CA, then verification
956 fails.
957 .sp
958 \fBpkinit_require_crl_checking\fP should be set to true if the
959 policy is such that up\-to\-date CRLs must be present for every CA.
960 .TP
961 \fBpkinit_require_freshness\fP
962 Specifies whether to require clients to include a freshness token
963 in PKINIT requests. The default value is false. (New in release
964 1.17.)
965 .UNINDENT
966 .SH ENCRYPTION TYPES
967 .sp
968 Any tag in the configuration files which requires a list of encryption
969 types can be set to some combination of the following strings.
970 Encryption types marked as "weak" and "deprecated" are available for
971 compatibility but not recommended for use.
972 .TS
973 center;
974 |l|l|.
975 _
976 T{
977 des3\-cbc\-raw
978 T} T{
979 Triple DES cbc mode raw (weak)
980 T}
981 _
982 T{
983 des3\-cbc\-sha1 des3\-hmac\-sha1 des3\-cbc\-sha1\-kd
984 T} T{
985 Triple DES cbc mode with HMAC/sha1 (deprecated)
986 T}
987 _
988 T{
989 aes256\-cts\-hmac\-sha1\-96 aes256\-cts aes256\-sha1
990 T} T{
991 AES\-256 CTS mode with 96\-bit SHA\-1 HMAC
992 T}
993 _
994 T{
995 aes128\-cts\-hmac\-sha1\-96 aes128\-cts aes128\-sha1
996 T} T{
997 AES\-128 CTS mode with 96\-bit SHA\-1 HMAC
998 T}
999 _
1000 T{
1001 aes256\-cts\-hmac\-sha384\-192 aes256\-sha2
1002 T} T{
1003 AES\-256 CTS mode with 192\-bit SHA\-384 HMAC
1004 T}
1005 _
1006 T{
1007 aes128\-cts\-hmac\-sha256\-128 aes128\-sha2
1008 T} T{
1009 AES\-128 CTS mode with 128\-bit SHA\-256 HMAC
1010 T}
1011 _
1012 T{
1013 arcfour\-hmac rc4\-hmac arcfour\-hmac\-md5
1014 T} T{
1015 RC4 with HMAC/MD5 (deprecated)
1016 T}
1017 _
1018 T{
1019 arcfour\-hmac\-exp rc4\-hmac\-exp arcfour\-hmac\-md5\-exp
1020 T} T{
1021 Exportable RC4 with HMAC/MD5 (weak)
1022 T}
1023 _
1024 T{
1025 camellia256\-cts\-cmac camellia256\-cts
1026 T} T{
1027 Camellia\-256 CTS mode with CMAC
1028 T}
1029 _
1030 T{
1031 camellia128\-cts\-cmac camellia128\-cts
1032 T} T{
1033 Camellia\-128 CTS mode with CMAC
1034 T}
1035 _
1036 T{
1037 des3
1038 T} T{
1039 The triple DES family: des3\-cbc\-sha1
1040 T}
1041 _
1042 T{
1043 aes
1044 T} T{
1045 The AES family: aes256\-cts\-hmac\-sha1\-96, aes128\-cts\-hmac\-sha1\-96, aes256\-cts\-hmac\-sha384\-192, and aes128\-cts\-hmac\-sha256\-128
1046 T}
1047 _
1048 T{
1049 rc4
1050 T} T{
1051 The RC4 family: arcfour\-hmac
1052 T}
1053 _
1054 T{
1055 camellia
1056 T} T{
1057 The Camellia family: camellia256\-cts\-cmac and camellia128\-cts\-cmac
1058 T}
1059 _
1060 .TE
1061 .sp
1062 The string \fBDEFAULT\fP can be used to refer to the default set of
1063 types for the variable in question. Types or families can be removed
1064 from the current list by prefixing them with a minus sign ("\-").
1065 Types or families can be prefixed with a plus sign ("+") for symmetry;
1066 it has the same meaning as just listing the type or family. For
1067 example, "\fBDEFAULT \-rc4\fP" would be the default set of encryption
1068 types with RC4 types removed, and "\fBdes3 DEFAULT\fP" would be the
1069 default set of encryption types with triple DES types moved to the
1070 front.
1071 .sp
1072 While \fBaes128\-cts\fP and \fBaes256\-cts\fP are supported for all Kerberos
1073 operations, they are not supported by very old versions of our GSSAPI
1074 implementation (krb5\-1.3.1 and earlier). Services running versions of
1075 krb5 without AES support must not be given keys of these encryption
1076 types in the KDC database.
1077 .sp
1078 The \fBaes128\-sha2\fP and \fBaes256\-sha2\fP encryption types are new in
1079 release 1.15. Services running versions of krb5 without support for
1080 these newer encryption types must not be given keys of these
1081 encryption types in the KDC database.
1082 .SH KEYSALT LISTS
1083 .sp
1084 Kerberos keys for users are usually derived from passwords. Kerberos
1085 commands and configuration parameters that affect generation of keys
1086 take lists of enctype\-salttype ("keysalt") pairs, known as \fIkeysalt
1087 lists\fP\&. Each keysalt pair is an enctype name followed by a salttype
1088 name, in the format \fIenc\fP:\fIsalt\fP\&. Individual keysalt list members are
1089 separated by comma (",") characters or space characters. For example:
1090 .INDENT 0.0
1091 .INDENT 3.5
1092 .sp
1093 .nf
1094 .ft C
1095 kadmin \-e aes256\-cts:normal,aes128\-cts:normal
1096 .ft P
1097 .fi
1098 .UNINDENT
1099 .UNINDENT
1100 .sp
1101 would start up kadmin so that by default it would generate
1102 password\-derived keys for the \fBaes256\-cts\fP and \fBaes128\-cts\fP
1103 encryption types, using a \fBnormal\fP salt.
1104 .sp
1105 To ensure that people who happen to pick the same password do not have
1106 the same key, Kerberos 5 incorporates more information into the key
1107 using something called a salt. The supported salt types are as
1108 follows:
1109 .TS
1110 center;
1111 |l|l|.
1112 _
1113 T{
1114 normal
1115 T} T{
1116 default for Kerberos Version 5
1117 T}
1118 _
1119 T{
1120 norealm
1121 T} T{
1122 same as the default, without using realm information
1123 T}
1124 _
1125 T{
1126 onlyrealm
1127 T} T{
1128 uses only realm information as the salt
1129 T}
1130 _
1131 T{
1132 special
1133 T} T{
1134 generate a random salt
1135 T}
1136 _
1137 .TE
1138 .SH SAMPLE KDC.CONF FILE
1139 .sp
1140 Here\(aqs an example of a kdc.conf file:
1141 .INDENT 0.0
1142 .INDENT 3.5
1143 .sp
1144 .nf
1145 .ft C
1146 [kdcdefaults]
1147 kdc_listen = 88
1148 kdc_tcp_listen = 88
1149 [realms]
1150 ATHENA.MIT.EDU = {
1151 kadmind_port = 749
1152 max_life = 12h 0m 0s
1153 max_renewable_life = 7d 0h 0m 0s
1154 master_key_type = aes256\-cts\-hmac\-sha1\-96
1155 supported_enctypes = aes256\-cts\-hmac\-sha1\-96:normal aes128\-cts\-hmac\-sha1\-96:normal
1156 database_module = openldap_ldapconf
1157 }
1158
1159 [logging]
1160 kdc = FILE:/usr/local/var/krb5kdc/kdc.log
1161 admin_server = FILE:/usr/local/var/krb5kdc/kadmin.log
1162
1163 [dbdefaults]
1164 ldap_kerberos_container_dn = cn=krbcontainer,dc=mit,dc=edu
1165
1166 [dbmodules]
1167 openldap_ldapconf = {
1168 db_library = kldap
1169 disable_last_success = true
1170 ldap_kdc_dn = "cn=krbadmin,dc=mit,dc=edu"
1171 # this object needs to have read rights on
1172 # the realm container and principal subtrees
1173 ldap_kadmind_dn = "cn=krbadmin,dc=mit,dc=edu"
1174 # this object needs to have read and write rights on
1175 # the realm container and principal subtrees
1176 ldap_service_password_file = /etc/kerberos/service.keyfile
1177 ldap_servers = ldaps://kerberos.mit.edu
1178 ldap_conns_per_server = 5
1179 }
1180 .ft P
1181 .fi
1182 .UNINDENT
1183 .UNINDENT
1184 .SH FILES
1185 .sp
1186 \fB/mnt/c/Users/crash/Documents/BobLiterman/CSP2_Galaxy/CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/var\fP\fB/krb5kdc\fP\fB/kdc.conf\fP
1187 .SH SEE ALSO
1188 .sp
1189 krb5.conf(5), krb5kdc(8), kadm5.acl(5)
1190 .SH AUTHOR
1191 MIT
1192 .SH COPYRIGHT
1193 1985-2022, MIT
1194 .\" Generated by docutils manpage writer.
1195 .