Mercurial > repos > rliterman > csp2

comparison CSP2/CSP2_env/env-d9b9114564458d9d-741b3de822f2aaca6c6caa4325c4afce/share/man/man5/krb5.conf.5 @ 68:5028fdace37b

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
planemo upload commit 2e9511a184a1ca667c7be0c6321a36dc4e3d116d
author jpayne
date Tue, 18 Mar 2025 16:23:26 -0400
parents
children
comparison
equal deleted inserted replaced
67:0e9998148a16 68:5028fdace37b
1 .\" Man page generated from reStructuredText.
2 .
3 .TH "KRB5.CONF" "5" " " "1.20.1" "MIT Kerberos"
4 .SH NAME
5 krb5.conf \- Kerberos configuration file
6 .
7 .nr rst2man-indent-level 0
8 .
9 .de1 rstReportMargin
10 \\$1 \\n[an-margin]
11 level \\n[rst2man-indent-level]
12 level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
13 -
14 \\n[rst2man-indent0]
15 \\n[rst2man-indent1]
16 \\n[rst2man-indent2]
17 ..
18 .de1 INDENT
19 .\" .rstReportMargin pre:
20 . RS \\$1
21 . nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
22 . nr rst2man-indent-level +1
23 .\" .rstReportMargin post:
24 ..
25 .de UNINDENT
26 . RE
27 .\" indent \\n[an-margin]
28 .\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
29 .nr rst2man-indent-level -1
30 .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
31 .in \\n[rst2man-indent\\n[rst2man-indent-level]]u
32 ..
33 .sp
34 The krb5.conf file contains Kerberos configuration information,
35 including the locations of KDCs and admin servers for the Kerberos
36 realms of interest, defaults for the current realm and for Kerberos
37 applications, and mappings of hostnames onto Kerberos realms.
38 Normally, you should install your krb5.conf file in the directory
39 \fB/etc\fP\&. You can override the default location by setting the
40 environment variable \fBKRB5_CONFIG\fP\&. Multiple colon\-separated
41 filenames may be specified in \fBKRB5_CONFIG\fP; all files which are
42 present will be read. Starting in release 1.14, directory names can
43 also be specified in \fBKRB5_CONFIG\fP; all files within the directory
44 whose names consist solely of alphanumeric characters, dashes, or
45 underscores will be read.
46 .SH STRUCTURE
47 .sp
48 The krb5.conf file is set up in the style of a Windows INI file.
49 Lines beginning with \(aq#\(aq or \(aq;\(aq (possibly after initial whitespace)
50 are ignored as comments. Sections are headed by the section name, in
51 square brackets. Each section may contain zero or more relations, of
52 the form:
53 .INDENT 0.0
54 .INDENT 3.5
55 .sp
56 .nf
57 .ft C
58 foo = bar
59 .ft P
60 .fi
61 .UNINDENT
62 .UNINDENT
63 .sp
64 or:
65 .INDENT 0.0
66 .INDENT 3.5
67 .sp
68 .nf
69 .ft C
70 fubar = {
71 foo = bar
72 baz = quux
73 }
74 .ft P
75 .fi
76 .UNINDENT
77 .UNINDENT
78 .sp
79 Placing a \(aq*\(aq after the closing bracket of a section name indicates
80 that the section is \fIfinal\fP, meaning that if the same section appears
81 within a later file specified in \fBKRB5_CONFIG\fP, it will be ignored.
82 A subsection can be marked as final by placing a \(aq*\(aq after either the
83 tag name or the closing brace.
84 .sp
85 The krb5.conf file can include other files using either of the
86 following directives at the beginning of a line:
87 .INDENT 0.0
88 .INDENT 3.5
89 .sp
90 .nf
91 .ft C
92 include FILENAME
93 includedir DIRNAME
94 .ft P
95 .fi
96 .UNINDENT
97 .UNINDENT
98 .sp
99 \fIFILENAME\fP or \fIDIRNAME\fP should be an absolute path. The named file or
100 directory must exist and be readable. Including a directory includes
101 all files within the directory whose names consist solely of
102 alphanumeric characters, dashes, or underscores. Starting in release
103 1.15, files with names ending in ".conf" are also included, unless the
104 name begins with ".". Included profile files are syntactically
105 independent of their parents, so each included file must begin with a
106 section header. Starting in release 1.17, files are read in
107 alphanumeric order; in previous releases, they may be read in any
108 order.
109 .sp
110 The krb5.conf file can specify that configuration should be obtained
111 from a loadable module, rather than the file itself, using the
112 following directive at the beginning of a line before any section
113 headers:
114 .INDENT 0.0
115 .INDENT 3.5
116 .sp
117 .nf
118 .ft C
119 module MODULEPATH:RESIDUAL
120 .ft P
121 .fi
122 .UNINDENT
123 .UNINDENT
124 .sp
125 \fIMODULEPATH\fP may be relative to the library path of the krb5
126 installation, or it may be an absolute path. \fIRESIDUAL\fP is provided
127 to the module at initialization time. If krb5.conf uses a module
128 directive, kdc.conf(5) should also use one if it exists.
129 .SH SECTIONS
130 .sp
131 The krb5.conf file may contain the following sections:
132 .TS
133 center;
134 |l|l|.
135 _
136 T{
137 \fI\%[libdefaults]\fP
138 T} T{
139 Settings used by the Kerberos V5 library
140 T}
141 _
142 T{
143 \fI\%[realms]\fP
144 T} T{
145 Realm\-specific contact information and settings
146 T}
147 _
148 T{
149 \fI\%[domain_realm]\fP
150 T} T{
151 Maps server hostnames to Kerberos realms
152 T}
153 _
154 T{
155 \fI\%[capaths]\fP
156 T} T{
157 Authentication paths for non\-hierarchical cross\-realm
158 T}
159 _
160 T{
161 \fI\%[appdefaults]\fP
162 T} T{
163 Settings used by some Kerberos V5 applications
164 T}
165 _
166 T{
167 \fI\%[plugins]\fP
168 T} T{
169 Controls plugin module registration
170 T}
171 _
172 .TE
173 .sp
174 Additionally, krb5.conf may include any of the relations described in
175 kdc.conf(5), but it is not a recommended practice.
176 .SS [libdefaults]
177 .sp
178 The libdefaults section may contain any of the following relations:
179 .INDENT 0.0
180 .TP
181 \fBallow_weak_crypto\fP
182 If this flag is set to false, then weak encryption types (as noted
183 in Encryption_types in kdc.conf(5)) will be filtered
184 out of the lists \fBdefault_tgs_enctypes\fP,
185 \fBdefault_tkt_enctypes\fP, and \fBpermitted_enctypes\fP\&. The default
186 value for this tag is false.
187 .TP
188 \fBcanonicalize\fP
189 If this flag is set to true, initial ticket requests to the KDC
190 will request canonicalization of the client principal name, and
191 answers with different client principals than the requested
192 principal will be accepted. The default value is false.
193 .TP
194 \fBccache_type\fP
195 This parameter determines the format of credential cache types
196 created by kinit(1) or other programs. The default value
197 is 4, which represents the most current format. Smaller values
198 can be used for compatibility with very old implementations of
199 Kerberos which interact with credential caches on the same host.
200 .TP
201 \fBclockskew\fP
202 Sets the maximum allowable amount of clockskew in seconds that the
203 library will tolerate before assuming that a Kerberos message is
204 invalid. The default value is 300 seconds, or five minutes.
205 .sp
206 The clockskew setting is also used when evaluating ticket start
207 and expiration times. For example, tickets that have reached
208 their expiration time can still be used (and renewed if they are
209 renewable tickets) if they have been expired for a shorter
210 duration than the \fBclockskew\fP setting.
211 .TP
212 \fBdefault_ccache_name\fP
213 This relation specifies the name of the default credential cache.
214 The default is \fBFILE:/tmp/krb5cc_%{uid}\fP\&. This relation is subject to parameter
215 expansion (see below). New in release 1.11.
216 .TP
217 \fBdefault_client_keytab_name\fP
218 This relation specifies the name of the default keytab for
219 obtaining client credentials. The default is \fBFILE:/opt/conda/var/krb5/user/%{euid}/client.keytab\fP\&. This
220 relation is subject to parameter expansion (see below).
221 New in release 1.11.
222 .TP
223 \fBdefault_keytab_name\fP
224 This relation specifies the default keytab name to be used by
225 application servers such as sshd. The default is \fBFILE:/etc/krb5.keytab\fP\&. This
226 relation is subject to parameter expansion (see below).
227 .TP
228 \fBdefault_rcache_name\fP
229 This relation specifies the name of the default replay cache.
230 The default is \fBdfl:\fP\&. This relation is subject to parameter
231 expansion (see below). New in release 1.18.
232 .TP
233 \fBdefault_realm\fP
234 Identifies the default Kerberos realm for the client. Set its
235 value to your Kerberos realm. If this value is not set, then a
236 realm must be specified with every Kerberos principal when
237 invoking programs such as kinit(1)\&.
238 .TP
239 \fBdefault_tgs_enctypes\fP
240 Identifies the supported list of session key encryption types that
241 the client should request when making a TGS\-REQ, in order of
242 preference from highest to lowest. The list may be delimited with
243 commas or whitespace. See Encryption_types in
244 kdc.conf(5) for a list of the accepted values for this tag.
245 Starting in release 1.18, the default value is the value of
246 \fBpermitted_enctypes\fP\&. For previous releases or if
247 \fBpermitted_enctypes\fP is not set, the default value is
248 \fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP\&.
249 .sp
250 Do not set this unless required for specific backward
251 compatibility purposes; stale values of this setting can prevent
252 clients from taking advantage of new stronger enctypes when the
253 libraries are upgraded.
254 .TP
255 \fBdefault_tkt_enctypes\fP
256 Identifies the supported list of session key encryption types that
257 the client should request when making an AS\-REQ, in order of
258 preference from highest to lowest. The format is the same as for
259 default_tgs_enctypes. Starting in release 1.18, the default
260 value is the value of \fBpermitted_enctypes\fP\&. For previous
261 releases or if \fBpermitted_enctypes\fP is not set, the default
262 value is \fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP\&.
263 .sp
264 Do not set this unless required for specific backward
265 compatibility purposes; stale values of this setting can prevent
266 clients from taking advantage of new stronger enctypes when the
267 libraries are upgraded.
268 .TP
269 \fBdns_canonicalize_hostname\fP
270 Indicate whether name lookups will be used to canonicalize
271 hostnames for use in service principal names. Setting this flag
272 to false can improve security by reducing reliance on DNS, but
273 means that short hostnames will not be canonicalized to
274 fully\-qualified hostnames. If this option is set to \fBfallback\fP (new
275 in release 1.18), DNS canonicalization will only be performed the
276 server hostname is not found with the original name when
277 requesting credentials. The default value is true.
278 .TP
279 \fBdns_lookup_kdc\fP
280 Indicate whether DNS SRV records should be used to locate the KDCs
281 and other servers for a realm, if they are not listed in the
282 krb5.conf information for the realm. (Note that the admin_server
283 entry must be in the krb5.conf realm information in order to
284 contact kadmind, because the DNS implementation for kadmin is
285 incomplete.)
286 .sp
287 Enabling this option does open up a type of denial\-of\-service
288 attack, if someone spoofs the DNS records and redirects you to
289 another server. However, it\(aqs no worse than a denial of service,
290 because that fake KDC will be unable to decode anything you send
291 it (besides the initial ticket request, which has no encrypted
292 data), and anything the fake KDC sends will not be trusted without
293 verification using some secret that it won\(aqt know.
294 .TP
295 \fBdns_uri_lookup\fP
296 Indicate whether DNS URI records should be used to locate the KDCs
297 and other servers for a realm, if they are not listed in the
298 krb5.conf information for the realm. SRV records are used as a
299 fallback if no URI records were found. The default value is true.
300 New in release 1.15.
301 .TP
302 \fBenforce_ok_as_delegate\fP
303 If this flag to true, GSSAPI credential delegation will be
304 disabled when the \fBok\-as\-delegate\fP flag is not set in the
305 service ticket. If this flag is false, the \fBok\-as\-delegate\fP
306 ticket flag is only enforced when an application specifically
307 requests enforcement. The default value is false.
308 .TP
309 \fBerr_fmt\fP
310 This relation allows for custom error message formatting. If a
311 value is set, error messages will be formatted by substituting a
312 normal error message for %M and an error code for %C in the value.
313 .TP
314 \fBextra_addresses\fP
315 This allows a computer to use multiple local addresses, in order
316 to allow Kerberos to work in a network that uses NATs while still
317 using address\-restricted tickets. The addresses should be in a
318 comma\-separated list. This option has no effect if
319 \fBnoaddresses\fP is true.
320 .TP
321 \fBforwardable\fP
322 If this flag is true, initial tickets will be forwardable by
323 default, if allowed by the KDC. The default value is false.
324 .TP
325 \fBignore_acceptor_hostname\fP
326 When accepting GSSAPI or krb5 security contexts for host\-based
327 service principals, ignore any hostname passed by the calling
328 application, and allow clients to authenticate to any service
329 principal in the keytab matching the service name and realm name
330 (if given). This option can improve the administrative
331 flexibility of server applications on multihomed hosts, but could
332 compromise the security of virtual hosting environments. The
333 default value is false. New in release 1.10.
334 .TP
335 \fBk5login_authoritative\fP
336 If this flag is true, principals must be listed in a local user\(aqs
337 k5login file to be granted login access, if a \&.k5login(5)
338 file exists. If this flag is false, a principal may still be
339 granted login access through other mechanisms even if a k5login
340 file exists but does not list the principal. The default value is
341 true.
342 .TP
343 \fBk5login_directory\fP
344 If set, the library will look for a local user\(aqs k5login file
345 within the named directory, with a filename corresponding to the
346 local username. If not set, the library will look for k5login
347 files in the user\(aqs home directory, with the filename .k5login.
348 For security reasons, .k5login files must be owned by
349 the local user or by root.
350 .TP
351 \fBkcm_mach_service\fP
352 On macOS only, determines the name of the bootstrap service used to
353 contact the KCM daemon for the KCM credential cache type. If the
354 value is \fB\-\fP, Mach RPC will not be used to contact the KCM
355 daemon. The default value is \fBorg.h5l.kcm\fP\&.
356 .TP
357 \fBkcm_socket\fP
358 Determines the path to the Unix domain socket used to access the
359 KCM daemon for the KCM credential cache type. If the value is
360 \fB\-\fP, Unix domain sockets will not be used to contact the KCM
361 daemon. The default value is
362 \fB/var/run/.heim_org.h5l.kcm\-socket\fP\&.
363 .TP
364 \fBkdc_default_options\fP
365 Default KDC options (Xored for multiple values) when requesting
366 initial tickets. By default it is set to 0x00000010
367 (KDC_OPT_RENEWABLE_OK).
368 .TP
369 \fBkdc_timesync\fP
370 Accepted values for this relation are 1 or 0. If it is nonzero,
371 client machines will compute the difference between their time and
372 the time returned by the KDC in the timestamps in the tickets and
373 use this value to correct for an inaccurate system clock when
374 requesting service tickets or authenticating to services. This
375 corrective factor is only used by the Kerberos library; it is not
376 used to change the system clock. The default value is 1.
377 .TP
378 \fBnoaddresses\fP
379 If this flag is true, requests for initial tickets will not be
380 made with address restrictions set, allowing the tickets to be
381 used across NATs. The default value is true.
382 .TP
383 \fBpermitted_enctypes\fP
384 Identifies the encryption types that servers will permit for
385 session keys and for ticket and authenticator encryption, ordered
386 by preference from highest to lowest. Starting in release 1.18,
387 this tag also acts as the default value for
388 \fBdefault_tgs_enctypes\fP and \fBdefault_tkt_enctypes\fP\&. The
389 default value for this tag is \fBaes256\-cts\-hmac\-sha1\-96 aes128\-cts\-hmac\-sha1\-96 aes256\-cts\-hmac\-sha384\-192 aes128\-cts\-hmac\-sha256\-128 des3\-cbc\-sha1 arcfour\-hmac\-md5 camellia256\-cts\-cmac camellia128\-cts\-cmac\fP\&.
390 .TP
391 \fBplugin_base_dir\fP
392 If set, determines the base directory where krb5 plugins are
393 located. The default value is the \fBkrb5/plugins\fP subdirectory
394 of the krb5 library directory. This relation is subject to
395 parameter expansion (see below) in release 1.17 and later.
396 .TP
397 \fBpreferred_preauth_types\fP
398 This allows you to set the preferred preauthentication types which
399 the client will attempt before others which may be advertised by a
400 KDC. The default value for this setting is "17, 16, 15, 14",
401 which forces libkrb5 to attempt to use PKINIT if it is supported.
402 .TP
403 \fBproxiable\fP
404 If this flag is true, initial tickets will be proxiable by
405 default, if allowed by the KDC. The default value is false.
406 .TP
407 \fBqualify_shortname\fP
408 If this string is set, it determines the domain suffix for
409 single\-component hostnames when DNS canonicalization is not used
410 (either because \fBdns_canonicalize_hostname\fP is false or because
411 forward canonicalization failed). The default value is the first
412 search domain of the system\(aqs DNS configuration. To disable
413 qualification of shortnames, set this relation to the empty string
414 with \fBqualify_shortname = ""\fP\&. (New in release 1.18.)
415 .TP
416 \fBrdns\fP
417 If this flag is true, reverse name lookup will be used in addition
418 to forward name lookup to canonicalizing hostnames for use in
419 service principal names. If \fBdns_canonicalize_hostname\fP is set
420 to false, this flag has no effect. The default value is true.
421 .TP
422 \fBrealm_try_domains\fP
423 Indicate whether a host\(aqs domain components should be used to
424 determine the Kerberos realm of the host. The value of this
425 variable is an integer: \-1 means not to search, 0 means to try the
426 host\(aqs domain itself, 1 means to also try the domain\(aqs immediate
427 parent, and so forth. The library\(aqs usual mechanism for locating
428 Kerberos realms is used to determine whether a domain is a valid
429 realm, which may involve consulting DNS if \fBdns_lookup_kdc\fP is
430 set. The default is not to search domain components.
431 .TP
432 \fBrenew_lifetime\fP
433 (duration string.) Sets the default renewable lifetime
434 for initial ticket requests. The default value is 0.
435 .TP
436 \fBspake_preauth_groups\fP
437 A whitespace or comma\-separated list of words which specifies the
438 groups allowed for SPAKE preauthentication. The possible values
439 are:
440 .TS
441 center;
442 |l|l|.
443 _
444 T{
445 edwards25519
446 T} T{
447 Edwards25519 curve (\fI\%RFC 7748\fP)
448 T}
449 _
450 T{
451 P\-256
452 T} T{
453 NIST P\-256 curve (\fI\%RFC 5480\fP)
454 T}
455 _
456 T{
457 P\-384
458 T} T{
459 NIST P\-384 curve (\fI\%RFC 5480\fP)
460 T}
461 _
462 T{
463 P\-521
464 T} T{
465 NIST P\-521 curve (\fI\%RFC 5480\fP)
466 T}
467 _
468 .TE
469 .sp
470 The default value for the client is \fBedwards25519\fP\&. The default
471 value for the KDC is empty. New in release 1.17.
472 .TP
473 \fBticket_lifetime\fP
474 (duration string.) Sets the default lifetime for initial
475 ticket requests. The default value is 1 day.
476 .TP
477 \fBudp_preference_limit\fP
478 When sending a message to the KDC, the library will try using TCP
479 before UDP if the size of the message is above
480 \fBudp_preference_limit\fP\&. If the message is smaller than
481 \fBudp_preference_limit\fP, then UDP will be tried before TCP.
482 Regardless of the size, both protocols will be tried if the first
483 attempt fails.
484 .TP
485 \fBverify_ap_req_nofail\fP
486 If this flag is true, then an attempt to verify initial
487 credentials will fail if the client machine does not have a
488 keytab. The default value is false.
489 .TP
490 \fBclient_aware_channel_bindings\fP
491 If this flag is true, then all application protocol authentication
492 requests will be flagged to indicate that the application supports
493 channel bindings when operating over a secure channel. The
494 default value is false.
495 .UNINDENT
496 .SS [realms]
497 .sp
498 Each tag in the [realms] section of the file is the name of a Kerberos
499 realm. The value of the tag is a subsection with relations that
500 define the properties of that particular realm. For each realm, the
501 following tags may be specified in the realm\(aqs subsection:
502 .INDENT 0.0
503 .TP
504 \fBadmin_server\fP
505 Identifies the host where the administration server is running.
506 Typically, this is the primary Kerberos server. This tag must be
507 given a value in order to communicate with the kadmind(8)
508 server for the realm.
509 .TP
510 \fBauth_to_local\fP
511 This tag allows you to set a general rule for mapping principal
512 names to local user names. It will be used if there is not an
513 explicit mapping for the principal name that is being
514 translated. The possible values are:
515 .INDENT 7.0
516 .TP
517 \fBRULE:\fP\fIexp\fP
518 The local name will be formulated from \fIexp\fP\&.
519 .sp
520 The format for \fIexp\fP is \fB[\fP\fIn\fP\fB:\fP\fIstring\fP\fB](\fP\fIregexp\fP\fB)s/\fP\fIpattern\fP\fB/\fP\fIreplacement\fP\fB/g\fP\&.
521 The integer \fIn\fP indicates how many components the target
522 principal should have. If this matches, then a string will be
523 formed from \fIstring\fP, substituting the realm of the principal
524 for \fB$0\fP and the \fIn\fP\(aqth component of the principal for
525 \fB$n\fP (e.g., if the principal was \fBjohndoe/admin\fP then
526 \fB[2:$2$1foo]\fP would result in the string
527 \fBadminjohndoefoo\fP). If this string matches \fIregexp\fP, then
528 the \fBs//[g]\fP substitution command will be run over the
529 string. The optional \fBg\fP will cause the substitution to be
530 global over the \fIstring\fP, instead of replacing only the first
531 match in the \fIstring\fP\&.
532 .TP
533 \fBDEFAULT\fP
534 The principal name will be used as the local user name. If
535 the principal has more than one component or is not in the
536 default realm, this rule is not applicable and the conversion
537 will fail.
538 .UNINDENT
539 .sp
540 For example:
541 .INDENT 7.0
542 .INDENT 3.5
543 .sp
544 .nf
545 .ft C
546 [realms]
547 ATHENA.MIT.EDU = {
548 auth_to_local = RULE:[2:$1](johndoe)s/^.*$/guest/
549 auth_to_local = RULE:[2:$1;$2](^.*;admin$)s/;admin$//
550 auth_to_local = RULE:[2:$2](^.*;root)s/^.*$/root/
551 auth_to_local = DEFAULT
552 }
553 .ft P
554 .fi
555 .UNINDENT
556 .UNINDENT
557 .sp
558 would result in any principal without \fBroot\fP or \fBadmin\fP as the
559 second component to be translated with the default rule. A
560 principal with a second component of \fBadmin\fP will become its
561 first component. \fBroot\fP will be used as the local name for any
562 principal with a second component of \fBroot\fP\&. The exception to
563 these two rules are any principals \fBjohndoe/*\fP, which will
564 always get the local name \fBguest\fP\&.
565 .TP
566 \fBauth_to_local_names\fP
567 This subsection allows you to set explicit mappings from principal
568 names to local user names. The tag is the mapping name, and the
569 value is the corresponding local user name.
570 .TP
571 \fBdefault_domain\fP
572 This tag specifies the domain used to expand hostnames when
573 translating Kerberos 4 service principals to Kerberos 5 principals
574 (for example, when converting \fBrcmd.hostname\fP to
575 \fBhost/hostname.domain\fP).
576 .TP
577 \fBdisable_encrypted_timestamp\fP
578 If this flag is true, the client will not perform encrypted
579 timestamp preauthentication if requested by the KDC. Setting this
580 flag can help to prevent dictionary attacks by active attackers,
581 if the realm\(aqs KDCs support SPAKE preauthentication or if initial
582 authentication always uses another mechanism or always uses FAST.
583 This flag persists across client referrals during initial
584 authentication. This flag does not prevent the KDC from offering
585 encrypted timestamp. New in release 1.17.
586 .TP
587 \fBhttp_anchors\fP
588 When KDCs and kpasswd servers are accessed through HTTPS proxies, this tag
589 can be used to specify the location of the CA certificate which should be
590 trusted to issue the certificate for a proxy server. If left unspecified,
591 the system\-wide default set of CA certificates is used.
592 .sp
593 The syntax for values is similar to that of values for the
594 \fBpkinit_anchors\fP tag:
595 .sp
596 \fBFILE:\fP \fIfilename\fP
597 .sp
598 \fIfilename\fP is assumed to be the name of an OpenSSL\-style ca\-bundle file.
599 .sp
600 \fBDIR:\fP \fIdirname\fP
601 .sp
602 \fIdirname\fP is assumed to be an directory which contains CA certificates.
603 All files in the directory will be examined; if they contain certificates
604 (in PEM format), they will be used.
605 .sp
606 \fBENV:\fP \fIenvvar\fP
607 .sp
608 \fIenvvar\fP specifies the name of an environment variable which has been set
609 to a value conforming to one of the previous values. For example,
610 \fBENV:X509_PROXY_CA\fP, where environment variable \fBX509_PROXY_CA\fP has
611 been set to \fBFILE:/tmp/my_proxy.pem\fP\&.
612 .TP
613 \fBkdc\fP
614 The name or address of a host running a KDC for that realm. An
615 optional port number, separated from the hostname by a colon, may
616 be included. If the name or address contains colons (for example,
617 if it is an IPv6 address), enclose it in square brackets to
618 distinguish the colon from a port separator. For your computer to
619 be able to communicate with the KDC for each realm, this tag must
620 be given a value in each realm subsection in the configuration
621 file, or there must be DNS SRV records specifying the KDCs.
622 .TP
623 \fBkpasswd_server\fP
624 Points to the server where all the password changes are performed.
625 If there is no such entry, DNS will be queried (unless forbidden
626 by \fBdns_lookup_kdc\fP). Finally, port 464 on the \fBadmin_server\fP
627 host will be tried.
628 .TP
629 \fBmaster_kdc\fP
630 The name for \fBprimary_kdc\fP prior to release 1.19. Its value is
631 used as a fallback if \fBprimary_kdc\fP is not specified.
632 .TP
633 \fBprimary_kdc\fP
634 Identifies the primary KDC(s). Currently, this tag is used in only
635 one case: If an attempt to get credentials fails because of an
636 invalid password, the client software will attempt to contact the
637 primary KDC, in case the user\(aqs password has just been changed, and
638 the updated database has not been propagated to the replica
639 servers yet. New in release 1.19.
640 .TP
641 \fBv4_instance_convert\fP
642 This subsection allows the administrator to configure exceptions
643 to the \fBdefault_domain\fP mapping rule. It contains V4 instances
644 (the tag name) which should be translated to some specific
645 hostname (the tag value) as the second component in a Kerberos V5
646 principal name.
647 .TP
648 \fBv4_realm\fP
649 This relation is used by the krb524 library routines when
650 converting a V5 principal name to a V4 principal name. It is used
651 when the V4 realm name and the V5 realm name are not the same, but
652 still share the same principal names and passwords. The tag value
653 is the Kerberos V4 realm name.
654 .UNINDENT
655 .SS [domain_realm]
656 .sp
657 The [domain_realm] section provides a translation from hostnames to
658 Kerberos realms. Each tag is a domain name, providing the mapping for
659 that domain and all subdomains. If the tag begins with a period
660 (\fB\&.\fP) then it applies only to subdomains. The Kerberos realm may be
661 identified either in the \fI\%realms\fP section or using DNS SRV records.
662 Tag names should be in lower case. For example:
663 .INDENT 0.0
664 .INDENT 3.5
665 .sp
666 .nf
667 .ft C
668 [domain_realm]
669 crash.mit.edu = TEST.ATHENA.MIT.EDU
670 .dev.mit.edu = TEST.ATHENA.MIT.EDU
671 mit.edu = ATHENA.MIT.EDU
672 .ft P
673 .fi
674 .UNINDENT
675 .UNINDENT
676 .sp
677 maps the host with the name \fBcrash.mit.edu\fP into the
678 \fBTEST.ATHENA.MIT.EDU\fP realm. The second entry maps all hosts under the
679 domain \fBdev.mit.edu\fP into the \fBTEST.ATHENA.MIT.EDU\fP realm, but not
680 the host with the name \fBdev.mit.edu\fP\&. That host is matched
681 by the third entry, which maps the host \fBmit.edu\fP and all hosts
682 under the domain \fBmit.edu\fP that do not match a preceding rule
683 into the realm \fBATHENA.MIT.EDU\fP\&.
684 .sp
685 If no translation entry applies to a hostname used for a service
686 principal for a service ticket request, the library will try to get a
687 referral to the appropriate realm from the client realm\(aqs KDC. If
688 that does not succeed, the host\(aqs realm is considered to be the
689 hostname\(aqs domain portion converted to uppercase, unless the
690 \fBrealm_try_domains\fP setting in [libdefaults] causes a different
691 parent domain to be used.
692 .SS [capaths]
693 .sp
694 In order to perform direct (non\-hierarchical) cross\-realm
695 authentication, configuration is needed to determine the
696 authentication paths between realms.
697 .sp
698 A client will use this section to find the authentication path between
699 its realm and the realm of the server. The server will use this
700 section to verify the authentication path used by the client, by
701 checking the transited field of the received ticket.
702 .sp
703 There is a tag for each participating client realm, and each tag has
704 subtags for each of the server realms. The value of the subtags is an
705 intermediate realm which may participate in the cross\-realm
706 authentication. The subtags may be repeated if there is more then one
707 intermediate realm. A value of "." means that the two realms share
708 keys directly, and no intermediate realms should be allowed to
709 participate.
710 .sp
711 Only those entries which will be needed on the client or the server
712 need to be present. A client needs a tag for its local realm with
713 subtags for all the realms of servers it will need to authenticate to.
714 A server needs a tag for each realm of the clients it will serve, with
715 a subtag of the server realm.
716 .sp
717 For example, \fBANL.GOV\fP, \fBPNL.GOV\fP, and \fBNERSC.GOV\fP all wish to
718 use the \fBES.NET\fP realm as an intermediate realm. ANL has a sub
719 realm of \fBTEST.ANL.GOV\fP which will authenticate with \fBNERSC.GOV\fP
720 but not \fBPNL.GOV\fP\&. The [capaths] section for \fBANL.GOV\fP systems
721 would look like this:
722 .INDENT 0.0
723 .INDENT 3.5
724 .sp
725 .nf
726 .ft C
727 [capaths]
728 ANL.GOV = {
729 TEST.ANL.GOV = .
730 PNL.GOV = ES.NET
731 NERSC.GOV = ES.NET
732 ES.NET = .
733 }
734 TEST.ANL.GOV = {
735 ANL.GOV = .
736 }
737 PNL.GOV = {
738 ANL.GOV = ES.NET
739 }
740 NERSC.GOV = {
741 ANL.GOV = ES.NET
742 }
743 ES.NET = {
744 ANL.GOV = .
745 }
746 .ft P
747 .fi
748 .UNINDENT
749 .UNINDENT
750 .sp
751 The [capaths] section of the configuration file used on \fBNERSC.GOV\fP
752 systems would look like this:
753 .INDENT 0.0
754 .INDENT 3.5
755 .sp
756 .nf
757 .ft C
758 [capaths]
759 NERSC.GOV = {
760 ANL.GOV = ES.NET
761 TEST.ANL.GOV = ES.NET
762 TEST.ANL.GOV = ANL.GOV
763 PNL.GOV = ES.NET
764 ES.NET = .
765 }
766 ANL.GOV = {
767 NERSC.GOV = ES.NET
768 }
769 PNL.GOV = {
770 NERSC.GOV = ES.NET
771 }
772 ES.NET = {
773 NERSC.GOV = .
774 }
775 TEST.ANL.GOV = {
776 NERSC.GOV = ANL.GOV
777 NERSC.GOV = ES.NET
778 }
779 .ft P
780 .fi
781 .UNINDENT
782 .UNINDENT
783 .sp
784 When a subtag is used more than once within a tag, clients will use
785 the order of values to determine the path. The order of values is not
786 important to servers.
787 .SS [appdefaults]
788 .sp
789 Each tag in the [appdefaults] section names a Kerberos V5 application
790 or an option that is used by some Kerberos V5 application[s]. The
791 value of the tag defines the default behaviors for that application.
792 .sp
793 For example:
794 .INDENT 0.0
795 .INDENT 3.5
796 .sp
797 .nf
798 .ft C
799 [appdefaults]
800 telnet = {
801 ATHENA.MIT.EDU = {
802 option1 = false
803 }
804 }
805 telnet = {
806 option1 = true
807 option2 = true
808 }
809 ATHENA.MIT.EDU = {
810 option2 = false
811 }
812 option2 = true
813 .ft P
814 .fi
815 .UNINDENT
816 .UNINDENT
817 .sp
818 The above four ways of specifying the value of an option are shown in
819 order of decreasing precedence. In this example, if telnet is running
820 in the realm EXAMPLE.COM, it should, by default, have option1 and
821 option2 set to true. However, a telnet program in the realm
822 \fBATHENA.MIT.EDU\fP should have \fBoption1\fP set to false and
823 \fBoption2\fP set to true. Any other programs in ATHENA.MIT.EDU should
824 have \fBoption2\fP set to false by default. Any programs running in
825 other realms should have \fBoption2\fP set to true.
826 .sp
827 The list of specifiable options for each application may be found in
828 that application\(aqs man pages. The application defaults specified here
829 are overridden by those specified in the \fI\%realms\fP section.
830 .SS [plugins]
831 .INDENT 0.0
832 .INDENT 3.5
833 .INDENT 0.0
834 .IP \(bu 2
835 \fI\%pwqual\fP interface
836 .IP \(bu 2
837 \fI\%kadm5_hook\fP interface
838 .IP \(bu 2
839 \fI\%clpreauth\fP and \fI\%kdcpreauth\fP interfaces
840 .UNINDENT
841 .UNINDENT
842 .UNINDENT
843 .sp
844 Tags in the [plugins] section can be used to register dynamic plugin
845 modules and to turn modules on and off. Not every krb5 pluggable
846 interface uses the [plugins] section; the ones that do are documented
847 here.
848 .sp
849 New in release 1.9.
850 .sp
851 Each pluggable interface corresponds to a subsection of [plugins].
852 All subsections support the same tags:
853 .INDENT 0.0
854 .TP
855 \fBdisable\fP
856 This tag may have multiple values. If there are values for this
857 tag, then the named modules will be disabled for the pluggable
858 interface.
859 .TP
860 \fBenable_only\fP
861 This tag may have multiple values. If there are values for this
862 tag, then only the named modules will be enabled for the pluggable
863 interface.
864 .TP
865 \fBmodule\fP
866 This tag may have multiple values. Each value is a string of the
867 form \fBmodulename:pathname\fP, which causes the shared object
868 located at \fIpathname\fP to be registered as a dynamic module named
869 \fImodulename\fP for the pluggable interface. If \fIpathname\fP is not an
870 absolute path, it will be treated as relative to the
871 \fBplugin_base_dir\fP value from \fI\%[libdefaults]\fP\&.
872 .UNINDENT
873 .sp
874 For pluggable interfaces where module order matters, modules
875 registered with a \fBmodule\fP tag normally come first, in the order
876 they are registered, followed by built\-in modules in the order they
877 are documented below. If \fBenable_only\fP tags are used, then the
878 order of those tags overrides the normal module order.
879 .sp
880 The following subsections are currently supported within the [plugins]
881 section:
882 .SS ccselect interface
883 .sp
884 The ccselect subsection controls modules for credential cache
885 selection within a cache collection. In addition to any registered
886 dynamic modules, the following built\-in modules exist (and may be
887 disabled with the disable tag):
888 .INDENT 0.0
889 .TP
890 \fBk5identity\fP
891 Uses a .k5identity file in the user\(aqs home directory to select a
892 client principal
893 .TP
894 \fBrealm\fP
895 Uses the service realm to guess an appropriate cache from the
896 collection
897 .TP
898 \fBhostname\fP
899 If the service principal is host\-based, uses the service hostname
900 to guess an appropriate cache from the collection
901 .UNINDENT
902 .SS pwqual interface
903 .sp
904 The pwqual subsection controls modules for the password quality
905 interface, which is used to reject weak passwords when passwords are
906 changed. The following built\-in modules exist for this interface:
907 .INDENT 0.0
908 .TP
909 \fBdict\fP
910 Checks against the realm dictionary file
911 .TP
912 \fBempty\fP
913 Rejects empty passwords
914 .TP
915 \fBhesiod\fP
916 Checks against user information stored in Hesiod (only if Kerberos
917 was built with Hesiod support)
918 .TP
919 \fBprinc\fP
920 Checks against components of the principal name
921 .UNINDENT
922 .SS kadm5_hook interface
923 .sp
924 The kadm5_hook interface provides plugins with information on
925 principal creation, modification, password changes and deletion. This
926 interface can be used to write a plugin to synchronize MIT Kerberos
927 with another database such as Active Directory. No plugins are built
928 in for this interface.
929 .SS kadm5_auth interface
930 .sp
931 The kadm5_auth section (introduced in release 1.16) controls modules
932 for the kadmin authorization interface, which determines whether a
933 client principal is allowed to perform a kadmin operation. The
934 following built\-in modules exist for this interface:
935 .INDENT 0.0
936 .TP
937 \fBacl\fP
938 This module reads the kadm5.acl(5) file, and authorizes
939 operations which are allowed according to the rules in the file.
940 .TP
941 \fBself\fP
942 This module authorizes self\-service operations including password
943 changes, creation of new random keys, fetching the client\(aqs
944 principal record or string attributes, and fetching the policy
945 record associated with the client principal.
946 .UNINDENT
947 .SS clpreauth and kdcpreauth interfaces
948 .sp
949 The clpreauth and kdcpreauth interfaces allow plugin modules to
950 provide client and KDC preauthentication mechanisms. The following
951 built\-in modules exist for these interfaces:
952 .INDENT 0.0
953 .TP
954 \fBpkinit\fP
955 This module implements the PKINIT preauthentication mechanism.
956 .TP
957 \fBencrypted_challenge\fP
958 This module implements the encrypted challenge FAST factor.
959 .TP
960 \fBencrypted_timestamp\fP
961 This module implements the encrypted timestamp mechanism.
962 .UNINDENT
963 .SS hostrealm interface
964 .sp
965 The hostrealm section (introduced in release 1.12) controls modules
966 for the host\-to\-realm interface, which affects the local mapping of
967 hostnames to realm names and the choice of default realm. The following
968 built\-in modules exist for this interface:
969 .INDENT 0.0
970 .TP
971 \fBprofile\fP
972 This module consults the [domain_realm] section of the profile for
973 authoritative host\-to\-realm mappings, and the \fBdefault_realm\fP
974 variable for the default realm.
975 .TP
976 \fBdns\fP
977 This module looks for DNS records for fallback host\-to\-realm
978 mappings and the default realm. It only operates if the
979 \fBdns_lookup_realm\fP variable is set to true.
980 .TP
981 \fBdomain\fP
982 This module applies heuristics for fallback host\-to\-realm
983 mappings. It implements the \fBrealm_try_domains\fP variable, and
984 uses the uppercased parent domain of the hostname if that does not
985 produce a result.
986 .UNINDENT
987 .SS localauth interface
988 .sp
989 The localauth section (introduced in release 1.12) controls modules
990 for the local authorization interface, which affects the relationship
991 between Kerberos principals and local system accounts. The following
992 built\-in modules exist for this interface:
993 .INDENT 0.0
994 .TP
995 \fBdefault\fP
996 This module implements the \fBDEFAULT\fP type for \fBauth_to_local\fP
997 values.
998 .TP
999 \fBrule\fP
1000 This module implements the \fBRULE\fP type for \fBauth_to_local\fP
1001 values.
1002 .TP
1003 \fBnames\fP
1004 This module looks for an \fBauth_to_local_names\fP mapping for the
1005 principal name.
1006 .TP
1007 \fBauth_to_local\fP
1008 This module processes \fBauth_to_local\fP values in the default
1009 realm\(aqs section, and applies the default method if no
1010 \fBauth_to_local\fP values exist.
1011 .TP
1012 \fBk5login\fP
1013 This module authorizes a principal to a local account according to
1014 the account\(aqs \&.k5login(5) file.
1015 .TP
1016 \fBan2ln\fP
1017 This module authorizes a principal to a local account if the
1018 principal name maps to the local account name.
1019 .UNINDENT
1020 .SS certauth interface
1021 .sp
1022 The certauth section (introduced in release 1.16) controls modules for
1023 the certificate authorization interface, which determines whether a
1024 certificate is allowed to preauthenticate a user via PKINIT. The
1025 following built\-in modules exist for this interface:
1026 .INDENT 0.0
1027 .TP
1028 \fBpkinit_san\fP
1029 This module authorizes the certificate if it contains a PKINIT
1030 Subject Alternative Name for the requested client principal, or a
1031 Microsoft UPN SAN matching the principal if \fBpkinit_allow_upn\fP
1032 is set to true for the realm.
1033 .TP
1034 \fBpkinit_eku\fP
1035 This module rejects the certificate if it does not contain an
1036 Extended Key Usage attribute consistent with the
1037 \fBpkinit_eku_checking\fP value for the realm.
1038 .TP
1039 \fBdbmatch\fP
1040 This module authorizes or rejects the certificate according to
1041 whether it matches the \fBpkinit_cert_match\fP string attribute on
1042 the client principal, if that attribute is present.
1043 .UNINDENT
1044 .SH PKINIT OPTIONS
1045 .sp
1046 \fBNOTE:\fP
1047 .INDENT 0.0
1048 .INDENT 3.5
1049 The following are PKINIT\-specific options. These values may
1050 be specified in [libdefaults] as global defaults, or within
1051 a realm\-specific subsection of [libdefaults], or may be
1052 specified as realm\-specific values in the [realms] section.
1053 A realm\-specific value overrides, not adds to, a generic
1054 [libdefaults] specification. The search order is:
1055 .UNINDENT
1056 .UNINDENT
1057 .INDENT 0.0
1058 .IP 1. 3
1059 realm\-specific subsection of [libdefaults]:
1060 .INDENT 3.0
1061 .INDENT 3.5
1062 .sp
1063 .nf
1064 .ft C
1065 [libdefaults]
1066 EXAMPLE.COM = {
1067 pkinit_anchors = FILE:/usr/local/example.com.crt
1068 }
1069 .ft P
1070 .fi
1071 .UNINDENT
1072 .UNINDENT
1073 .IP 2. 3
1074 realm\-specific value in the [realms] section:
1075 .INDENT 3.0
1076 .INDENT 3.5
1077 .sp
1078 .nf
1079 .ft C
1080 [realms]
1081 OTHERREALM.ORG = {
1082 pkinit_anchors = FILE:/usr/local/otherrealm.org.crt
1083 }
1084 .ft P
1085 .fi
1086 .UNINDENT
1087 .UNINDENT
1088 .IP 3. 3
1089 generic value in the [libdefaults] section:
1090 .INDENT 3.0
1091 .INDENT 3.5
1092 .sp
1093 .nf
1094 .ft C
1095 [libdefaults]
1096 pkinit_anchors = DIR:/usr/local/generic_trusted_cas/
1097 .ft P
1098 .fi
1099 .UNINDENT
1100 .UNINDENT
1101 .UNINDENT
1102 .SS Specifying PKINIT identity information
1103 .sp
1104 The syntax for specifying Public Key identity, trust, and revocation
1105 information for PKINIT is as follows:
1106 .INDENT 0.0
1107 .TP
1108 \fBFILE:\fP\fIfilename\fP[\fB,\fP\fIkeyfilename\fP]
1109 This option has context\-specific behavior.
1110 .sp
1111 In \fBpkinit_identity\fP or \fBpkinit_identities\fP, \fIfilename\fP
1112 specifies the name of a PEM\-format file containing the user\(aqs
1113 certificate. If \fIkeyfilename\fP is not specified, the user\(aqs
1114 private key is expected to be in \fIfilename\fP as well. Otherwise,
1115 \fIkeyfilename\fP is the name of the file containing the private key.
1116 .sp
1117 In \fBpkinit_anchors\fP or \fBpkinit_pool\fP, \fIfilename\fP is assumed to
1118 be the name of an OpenSSL\-style ca\-bundle file.
1119 .TP
1120 \fBDIR:\fP\fIdirname\fP
1121 This option has context\-specific behavior.
1122 .sp
1123 In \fBpkinit_identity\fP or \fBpkinit_identities\fP, \fIdirname\fP
1124 specifies a directory with files named \fB*.crt\fP and \fB*.key\fP
1125 where the first part of the file name is the same for matching
1126 pairs of certificate and private key files. When a file with a
1127 name ending with \fB\&.crt\fP is found, a matching file ending with
1128 \fB\&.key\fP is assumed to contain the private key. If no such file
1129 is found, then the certificate in the \fB\&.crt\fP is not used.
1130 .sp
1131 In \fBpkinit_anchors\fP or \fBpkinit_pool\fP, \fIdirname\fP is assumed to
1132 be an OpenSSL\-style hashed CA directory where each CA cert is
1133 stored in a file named \fBhash\-of\-ca\-cert.#\fP\&. This infrastructure
1134 is encouraged, but all files in the directory will be examined and
1135 if they contain certificates (in PEM format), they will be used.
1136 .sp
1137 In \fBpkinit_revoke\fP, \fIdirname\fP is assumed to be an OpenSSL\-style
1138 hashed CA directory where each revocation list is stored in a file
1139 named \fBhash\-of\-ca\-cert.r#\fP\&. This infrastructure is encouraged,
1140 but all files in the directory will be examined and if they
1141 contain a revocation list (in PEM format), they will be used.
1142 .TP
1143 \fBPKCS12:\fP\fIfilename\fP
1144 \fIfilename\fP is the name of a PKCS #12 format file, containing the
1145 user\(aqs certificate and private key.
1146 .TP
1147 \fBPKCS11:\fP[\fBmodule_name=\fP]\fImodname\fP[\fB:slotid=\fP\fIslot\-id\fP][\fB:token=\fP\fItoken\-label\fP][\fB:certid=\fP\fIcert\-id\fP][\fB:certlabel=\fP\fIcert\-label\fP]
1148 All keyword/values are optional. \fImodname\fP specifies the location
1149 of a library implementing PKCS #11. If a value is encountered
1150 with no keyword, it is assumed to be the \fImodname\fP\&. If no
1151 module\-name is specified, the default is \fBopensc\-pkcs11.so\fP\&.
1152 \fBslotid=\fP and/or \fBtoken=\fP may be specified to force the use of
1153 a particular smard card reader or token if there is more than one
1154 available. \fBcertid=\fP and/or \fBcertlabel=\fP may be specified to
1155 force the selection of a particular certificate on the device.
1156 See the \fBpkinit_cert_match\fP configuration option for more ways
1157 to select a particular certificate to use for PKINIT.
1158 .TP
1159 \fBENV:\fP\fIenvvar\fP
1160 \fIenvvar\fP specifies the name of an environment variable which has
1161 been set to a value conforming to one of the previous values. For
1162 example, \fBENV:X509_PROXY\fP, where environment variable
1163 \fBX509_PROXY\fP has been set to \fBFILE:/tmp/my_proxy.pem\fP\&.
1164 .UNINDENT
1165 .SS PKINIT krb5.conf options
1166 .INDENT 0.0
1167 .TP
1168 \fBpkinit_anchors\fP
1169 Specifies the location of trusted anchor (root) certificates which
1170 the client trusts to sign KDC certificates. This option may be
1171 specified multiple times. These values from the config file are
1172 not used if the user specifies X509_anchors on the command line.
1173 .TP
1174 \fBpkinit_cert_match\fP
1175 Specifies matching rules that the client certificate must match
1176 before it is used to attempt PKINIT authentication. If a user has
1177 multiple certificates available (on a smart card, or via other
1178 media), there must be exactly one certificate chosen before
1179 attempting PKINIT authentication. This option may be specified
1180 multiple times. All the available certificates are checked
1181 against each rule in order until there is a match of exactly one
1182 certificate.
1183 .sp
1184 The Subject and Issuer comparison strings are the \fI\%RFC 2253\fP
1185 string representations from the certificate Subject DN and Issuer
1186 DN values.
1187 .sp
1188 The syntax of the matching rules is:
1189 .INDENT 7.0
1190 .INDENT 3.5
1191 [\fIrelation\-operator\fP]\fIcomponent\-rule\fP ...
1192 .UNINDENT
1193 .UNINDENT
1194 .sp
1195 where:
1196 .INDENT 7.0
1197 .TP
1198 .B \fIrelation\-operator\fP
1199 can be either \fB&&\fP, meaning all component rules must match,
1200 or \fB||\fP, meaning only one component rule must match. The
1201 default is \fB&&\fP\&.
1202 .TP
1203 .B \fIcomponent\-rule\fP
1204 can be one of the following. Note that there is no
1205 punctuation or whitespace between component rules.
1206 .INDENT 7.0
1207 .INDENT 3.5
1208 .nf
1209 \fB<SUBJECT>\fP\fIregular\-expression\fP
1210 \fB<ISSUER>\fP\fIregular\-expression\fP
1211 \fB<SAN>\fP\fIregular\-expression\fP
1212 \fB<EKU>\fP\fIextended\-key\-usage\-list\fP
1213 \fB<KU>\fP\fIkey\-usage\-list\fP
1214 .fi
1215 .sp
1216 .UNINDENT
1217 .UNINDENT
1218 .sp
1219 \fIextended\-key\-usage\-list\fP is a comma\-separated list of
1220 required Extended Key Usage values. All values in the list
1221 must be present in the certificate. Extended Key Usage values
1222 can be:
1223 .INDENT 7.0
1224 .IP \(bu 2
1225 pkinit
1226 .IP \(bu 2
1227 msScLogin
1228 .IP \(bu 2
1229 clientAuth
1230 .IP \(bu 2
1231 emailProtection
1232 .UNINDENT
1233 .sp
1234 \fIkey\-usage\-list\fP is a comma\-separated list of required Key
1235 Usage values. All values in the list must be present in the
1236 certificate. Key Usage values can be:
1237 .INDENT 7.0
1238 .IP \(bu 2
1239 digitalSignature
1240 .IP \(bu 2
1241 keyEncipherment
1242 .UNINDENT
1243 .UNINDENT
1244 .sp
1245 Examples:
1246 .INDENT 7.0
1247 .INDENT 3.5
1248 .sp
1249 .nf
1250 .ft C
1251 pkinit_cert_match = ||<SUBJECT>.*DoE.*<SAN>.*@EXAMPLE.COM
1252 pkinit_cert_match = &&<EKU>msScLogin,clientAuth<ISSUER>.*DoE.*
1253 pkinit_cert_match = <EKU>msScLogin,clientAuth<KU>digitalSignature
1254 .ft P
1255 .fi
1256 .UNINDENT
1257 .UNINDENT
1258 .TP
1259 \fBpkinit_eku_checking\fP
1260 This option specifies what Extended Key Usage value the KDC
1261 certificate presented to the client must contain. (Note that if
1262 the KDC certificate has the pkinit SubjectAlternativeName encoded
1263 as the Kerberos TGS name, EKU checking is not necessary since the
1264 issuing CA has certified this as a KDC certificate.) The values
1265 recognized in the krb5.conf file are:
1266 .INDENT 7.0
1267 .TP
1268 \fBkpKDC\fP
1269 This is the default value and specifies that the KDC must have
1270 the id\-pkinit\-KPKdc EKU as defined in \fI\%RFC 4556\fP\&.
1271 .TP
1272 \fBkpServerAuth\fP
1273 If \fBkpServerAuth\fP is specified, a KDC certificate with the
1274 id\-kp\-serverAuth EKU will be accepted. This key usage value
1275 is used in most commercially issued server certificates.
1276 .TP
1277 \fBnone\fP
1278 If \fBnone\fP is specified, then the KDC certificate will not be
1279 checked to verify it has an acceptable EKU. The use of this
1280 option is not recommended.
1281 .UNINDENT
1282 .TP
1283 \fBpkinit_dh_min_bits\fP
1284 Specifies the size of the Diffie\-Hellman key the client will
1285 attempt to use. The acceptable values are 1024, 2048, and 4096.
1286 The default is 2048.
1287 .TP
1288 \fBpkinit_identities\fP
1289 Specifies the location(s) to be used to find the user\(aqs X.509
1290 identity information. If this option is specified multiple times,
1291 each value is attempted in order until certificates are found.
1292 Note that these values are not used if the user specifies
1293 \fBX509_user_identity\fP on the command line.
1294 .TP
1295 \fBpkinit_kdc_hostname\fP
1296 The presence of this option indicates that the client is willing
1297 to accept a KDC certificate with a dNSName SAN (Subject
1298 Alternative Name) rather than requiring the id\-pkinit\-san as
1299 defined in \fI\%RFC 4556\fP\&. This option may be specified multiple
1300 times. Its value should contain the acceptable hostname for the
1301 KDC (as contained in its certificate).
1302 .TP
1303 \fBpkinit_pool\fP
1304 Specifies the location of intermediate certificates which may be
1305 used by the client to complete the trust chain between a KDC
1306 certificate and a trusted anchor. This option may be specified
1307 multiple times.
1308 .TP
1309 \fBpkinit_require_crl_checking\fP
1310 The default certificate verification process will always check the
1311 available revocation information to see if a certificate has been
1312 revoked. If a match is found for the certificate in a CRL,
1313 verification fails. If the certificate being verified is not
1314 listed in a CRL, or there is no CRL present for its issuing CA,
1315 and \fBpkinit_require_crl_checking\fP is false, then verification
1316 succeeds.
1317 .sp
1318 However, if \fBpkinit_require_crl_checking\fP is true and there is
1319 no CRL information available for the issuing CA, then verification
1320 fails.
1321 .sp
1322 \fBpkinit_require_crl_checking\fP should be set to true if the
1323 policy is such that up\-to\-date CRLs must be present for every CA.
1324 .TP
1325 \fBpkinit_revoke\fP
1326 Specifies the location of Certificate Revocation List (CRL)
1327 information to be used by the client when verifying the validity
1328 of the KDC certificate presented. This option may be specified
1329 multiple times.
1330 .UNINDENT
1331 .SH PARAMETER EXPANSION
1332 .sp
1333 Starting with release 1.11, several variables, such as
1334 \fBdefault_keytab_name\fP, allow parameters to be expanded.
1335 Valid parameters are:
1336 .INDENT 0.0
1337 .INDENT 3.5
1338 .TS
1339 center;
1340 |l|l|.
1341 _
1342 T{
1343 %{TEMP}
1344 T} T{
1345 Temporary directory
1346 T}
1347 _
1348 T{
1349 %{uid}
1350 T} T{
1351 Unix real UID or Windows SID
1352 T}
1353 _
1354 T{
1355 %{euid}
1356 T} T{
1357 Unix effective user ID or Windows SID
1358 T}
1359 _
1360 T{
1361 %{USERID}
1362 T} T{
1363 Same as %{uid}
1364 T}
1365 _
1366 T{
1367 %{null}
1368 T} T{
1369 Empty string
1370 T}
1371 _
1372 T{
1373 %{LIBDIR}
1374 T} T{
1375 Installation library directory
1376 T}
1377 _
1378 T{
1379 %{BINDIR}
1380 T} T{
1381 Installation binary directory
1382 T}
1383 _
1384 T{
1385 %{SBINDIR}
1386 T} T{
1387 Installation admin binary directory
1388 T}
1389 _
1390 T{
1391 %{username}
1392 T} T{
1393 (Unix) Username of effective user ID
1394 T}
1395 _
1396 T{
1397 %{APPDATA}
1398 T} T{
1399 (Windows) Roaming application data for current user
1400 T}
1401 _
1402 T{
1403 %{COMMON_APPDATA}
1404 T} T{
1405 (Windows) Application data for all users
1406 T}
1407 _
1408 T{
1409 %{LOCAL_APPDATA}
1410 T} T{
1411 (Windows) Local application data for current user
1412 T}
1413 _
1414 T{
1415 %{SYSTEM}
1416 T} T{
1417 (Windows) Windows system folder
1418 T}
1419 _
1420 T{
1421 %{WINDOWS}
1422 T} T{
1423 (Windows) Windows folder
1424 T}
1425 _
1426 T{
1427 %{USERCONFIG}
1428 T} T{
1429 (Windows) Per\-user MIT krb5 config file directory
1430 T}
1431 _
1432 T{
1433 %{COMMONCONFIG}
1434 T} T{
1435 (Windows) Common MIT krb5 config file directory
1436 T}
1437 _
1438 .TE
1439 .UNINDENT
1440 .UNINDENT
1441 .SH SAMPLE KRB5.CONF FILE
1442 .sp
1443 Here is an example of a generic krb5.conf file:
1444 .INDENT 0.0
1445 .INDENT 3.5
1446 .sp
1447 .nf
1448 .ft C
1449 [libdefaults]
1450 default_realm = ATHENA.MIT.EDU
1451 dns_lookup_kdc = true
1452 dns_lookup_realm = false
1453
1454 [realms]
1455 ATHENA.MIT.EDU = {
1456 kdc = kerberos.mit.edu
1457 kdc = kerberos\-1.mit.edu
1458 kdc = kerberos\-2.mit.edu
1459 admin_server = kerberos.mit.edu
1460 primary_kdc = kerberos.mit.edu
1461 }
1462 EXAMPLE.COM = {
1463 kdc = kerberos.example.com
1464 kdc = kerberos\-1.example.com
1465 admin_server = kerberos.example.com
1466 }
1467
1468 [domain_realm]
1469 mit.edu = ATHENA.MIT.EDU
1470
1471 [capaths]
1472 ATHENA.MIT.EDU = {
1473 EXAMPLE.COM = .
1474 }
1475 EXAMPLE.COM = {
1476 ATHENA.MIT.EDU = .
1477 }
1478 .ft P
1479 .fi
1480 .UNINDENT
1481 .UNINDENT
1482 .SH FILES
1483 .sp
1484 \fB/etc/krb5.conf\fP
1485 .SH SEE ALSO
1486 .sp
1487 syslog(3)
1488 .SH AUTHOR
1489 MIT
1490 .SH COPYRIGHT
1491 1985-2022, MIT
1492 .\" Generated by docutils manpage writer.
1493 .