NAME

kdc.conf - Kerberos V5 KDC configuration file

The kdc.conf file supplements krb5.conf(5) for programs which are typically only used on a KDC, such as the krb5kdc(8) and kadmind(8) daemons and the kdb5_util(8) program. Relations documented here may also be specified in krb5.conf; for the KDC programs mentioned, krb5.conf and kdc.conf will be merged into a single configuration profile.

Normally, the kdc.conf file is found in the KDC state directory, /etc/krb5kdc. You can override the default location by setting the environment variable KRB5_KDC_PROFILE.

Please note that you need to restart the KDC daemon for any configuration changes to take effect.

STRUCTURE

The kdc.conf file is set up in the same format as the krb5.conf(5) file.

SECTIONS

The kdc.conf file may contain the following sections:

[realms]


    ATHENA.MIT.EDU = {


        max_renewable_life = 7d 0h 0m 0s


    }

[dbmodules]


    ATHENA.MIT.EDU = {


        disable_last_success = true


    }

[logging]


    kdc = CONSOLE


    kdc = SYSLOG:INFO:DAEMON


    admin_server = FILE:/var/adm/kadmin.log


    admin_server = DEVICE=/dev/tty04

[otp]


    MyRemoteTokenType = {


        server = radius.mydomain.com:1812


        secret = SEmfiajf42$


        timeout = 15


        retries = 5


        strip_realm = true


    }

[otp]


    DEFAULT = {


        strip_realm = false


    }

PKINIT OPTIONS

NOTE:

[realms]


    EXAMPLE.COM = {


        pkinit_anchors = FILE:/usr/local/example.com.crt


    }

[kdcdefaults]


    pkinit_anchors = DIR:/usr/local/generic_trusted_cas/

For information about the syntax of some of these options, see Specifying PKINIT identity information in krb5.conf(5).

ENCRYPTION TYPES

Any tag in the configuration files which requires a list of encryption types can be set to some combination of the following strings. Encryption types marked as "weak" and "deprecated" are available for compatibility but not recommended for use.

The string DEFAULT can be used to refer to the default set of types for the variable in question. Types or families can be removed from the current list by prefixing them with a minus sign ("-"). Types or families can be prefixed with a plus sign ("+") for symmetry; it has the same meaning as just listing the type or family. For example, "DEFAULT -rc4" would be the default set of encryption types with RC4 types removed, and "des3 DEFAULT" would be the default set of encryption types with triple DES types moved to the front.

While aes128-cts and aes256-cts are supported for all Kerberos operations, they are not supported by very old versions of our GSSAPI implementation (krb5-1.3.1 and earlier). Services running versions of krb5 without AES support must not be given keys of these encryption types in the KDC database.

The aes128-sha2 and aes256-sha2 encryption types are new in release 1.15. Services running versions of krb5 without support for these newer encryption types must not be given keys of these encryption types in the KDC database.

KEYSALT LISTS

Kerberos keys for users are usually derived from passwords. Kerberos commands and configuration parameters that affect generation of keys take lists of enctype-salttype ("keysalt") pairs, known as keysalt lists. Each keysalt pair is an enctype name followed by a salttype name, in the format enc:salt. Individual keysalt list members are separated by comma (",") characters or space characters. For example:

kadmin -e aes256-cts:normal,aes128-cts:normal

would start up kadmin so that by default it would generate password-derived keys for the aes256-cts and aes128-cts encryption types, using a normal salt.

To ensure that people who happen to pick the same password do not have the same key, Kerberos 5 incorporates more information into the key using something called a salt. The supported salt types are as follows:

SAMPLE KDC.CONF FILE

Here's an example of a kdc.conf file:

[kdcdefaults]


    kdc_listen = 88


    kdc_tcp_listen = 88
[realms]


    ATHENA.MIT.EDU = {


        kadmind_port = 749


        max_life = 12h 0m 0s


        max_renewable_life = 7d 0h 0m 0s


        master_key_type = aes256-cts-hmac-sha1-96


        supported_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal


        database_module = openldap_ldapconf


    }
[logging]


    kdc = FILE:/usr/local/var/krb5kdc/kdc.log


    admin_server = FILE:/usr/local/var/krb5kdc/kadmin.log
[dbdefaults]


    ldap_kerberos_container_dn = cn=krbcontainer,dc=mit,dc=edu
[dbmodules]


    openldap_ldapconf = {


        db_library = kldap


        disable_last_success = true


        ldap_kdc_dn = "cn=krbadmin,dc=mit,dc=edu"


            # this object needs to have read rights on


            # the realm container and principal subtrees


        ldap_kadmind_dn = "cn=krbadmin,dc=mit,dc=edu"


            # this object needs to have read and write rights on


            # the realm container and principal subtrees


        ldap_service_password_file = /etc/kerberos/service.keyfile


        ldap_servers = ldaps://kerberos.mit.edu


        ldap_conns_per_server = 5


    }

FILES

/etc/krb5kdc/kdc.conf

SEE ALSO

krb5.conf(5), krb5kdc(8), kadm5.acl(5)

AUTHOR

MIT

COPYRIGHT

1985-2022, MIT