From dd8c4b424d9b48a1eed3be491e5b10f81deb4dec Mon Sep 17 00:00:00 2001 From: Ben Kaduk Date: Tue, 16 Oct 2012 16:40:20 -0400 Subject: Regenerate man pages Catch up to the RST content updates. Lots of .sp vertical space macros are removed, and the output engine spelles "restructuredText" correctly, now. --- src/man/kdc.conf.man | 344 ++++++++++++++++++++++----------------------------- 1 file changed, 148 insertions(+), 196 deletions(-) (limited to 'src/man/kdc.conf.man') diff --git a/src/man/kdc.conf.man b/src/man/kdc.conf.man index 9cbf09bc81..c82119032e 100644 --- a/src/man/kdc.conf.man +++ b/src/man/kdc.conf.man @@ -28,7 +28,7 @@ level margin: \\n[rst2man-indent\\n[rst2man-indent-level]] .\" new: \\n[rst2man-indent\\n[rst2man-indent-level]] .in \\n[rst2man-indent\\n[rst2man-indent-level]]u .. -.\" Man page generated from reStructeredText. +.\" Man page generated from reStructuredText. . .sp The kdc.conf file supplements \fIkrb5.conf(5)\fP for programs which @@ -39,6 +39,9 @@ Relations documented here may also be specified in krb5.conf. Normally, the kdc.conf file is found in the KDC state directory, \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP. You can override the default location by setting the environment variable \fBKRB5_KDC_PROFILE\fP. +.sp +Please note that you need to restart the KDC daemon for any configuration +changes to take effect. .SH STRUCTURE .sp The kdc.conf file is set up in the same format as the @@ -63,12 +66,6 @@ Realm\-specific database configuration and settings T} _ T{ -\fI\%[logging]\fP -T} T{ -Controls how Kerberos daemons perform logging -T} -_ -T{ \fI\%[dbdefaults]\fP T} T{ Default database settings @@ -80,6 +77,12 @@ T} T{ Per\-database settings T} _ +T{ +\fI\%[logging]\fP +T} T{ +Controls how Kerberos daemons perform logging +T} +_ .TE .SS [kdcdefaults] .sp @@ -89,53 +92,44 @@ subsection does not contain a relation for the tag. See the \fI\%[realms]\fP section for the definitions of these relations. .INDENT 0.0 .IP \(bu 2 -. \fBhost_based_services\fP .IP \(bu 2 -. \fBkdc_ports\fP .IP \(bu 2 -. \fBkdc_tcp_ports\fP .IP \(bu 2 -. \fBno_host_referral\fP .IP \(bu 2 -. \fBrestrict_anonymous_to_tgt\fP .UNINDENT .INDENT 0.0 .TP .B \fBkdc_max_dgram_reply_size\fP -.sp Specifies the maximum packet size that can be sent over UDP. The default value is 4096 bytes. .UNINDENT .SS [realms] .sp -Each tag in the [realms] section of the file names a Kerberos realm. -The value of the tag is a subsection where the relations in that -subsection define KDC parameters for that particular realm. +Each tag in the [realms] section is the name of a Kerberos realm. +The value of the tag is a subsection where the relations define KDC +parameters for that particular realm. .sp -For each realm, the following tags may be specified in the [realms] -subsection: +For each realm, the following tags may be specified: .INDENT 0.0 .TP .B \fBacl_file\fP -.sp (String.) Location of the access control list file that \fIkadmind(8)\fP uses to determine which principals are allowed -which permissions on the database. The default value is -\fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP. +which permissions on the Kerberos database. The default value is +\fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP. For more information on Kerberos ACL +file see \fIkadm5.acl(5)\fP. .TP .B \fBdatabase_module\fP -.sp This relation indicates the name of the configuration section under \fI\%[dbmodules]\fP for database specific parameters used by the loadable database library. .TP .B \fBdatabase_name\fP -.sp (String.) This string specifies the location of the Kerberos database for this realm, if the DB2 back\-end is being used. If a \fBdatabase_module\fP is specified for the realm and the @@ -144,13 +138,11 @@ value will take precedence over this one. The default value is \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/principal\fP. .TP .B \fBdefault_principal_expiration\fP -.sp -(Absolute time string.) Specifies the default expiration date of +(\fIabstime\fP string.) Specifies the default expiration date of principals created in this realm. The default value is 0, which means no expiration date. .TP .B \fBdefault_principal_flags\fP -.sp (Flag string.) Specifies the default attributes of principals created in this realm. The format for this string is a comma\-separated list of flags, with \(aq+\(aq before each flag that @@ -163,69 +155,57 @@ There are a number of possible flags: .INDENT 7.0 .TP .B \fBallow\-tickets\fP -.sp Enabling this flag means that the KDC will issue tickets for this principal. Disabling this flag essentially deactivates the principal within this realm. .TP .B \fBdup\-skey\fP -.sp Enabling this flag allows the principal to obtain a session key for another user, permitting user\-to\-user authentication for this principal. .TP .B \fBforwardable\fP -.sp Enabling this flag allows the principal to obtain forwardable tickets. .TP .B \fBhwauth\fP -.sp If this flag is enabled, then the principal is required to preauthenticate using a hardware device before receiving any tickets. .TP .B \fBno\-auth\-data\-required\fP -.sp -Enabling this flag prvents PAC data from being added to the -service tickets. +Enabling this flag prevents PAC data from being added to +service tickets for the principal. .TP .B \fBok\-as\-delegate\fP -.sp If this flag is enabled, it hints the client that credentials can and should be delegated when authenticating to the service. .TP .B \fBok\-to\-auth\-as\-delegate\fP -.sp -Enabling this flag allows the principal to use S4USelf ticket. +Enabling this flag allows the principal to use S4USelf tickets. .TP .B \fBpostdateable\fP -.sp Enabling this flag allows the principal to obtain postdateable tickets. .TP .B \fBpreauth\fP -.sp If this flag is enabled on a client principal, then that principal is required to preauthenticate to the KDC before receiving any tickets. On a service principal, enabling this flag means that service tickets for this principal will only be issued to clients with a TGT that has the preauthenticated -ticket set. +bit set. .TP .B \fBproxiable\fP -.sp Enabling this flag allows the principal to obtain proxy tickets. .TP .B \fBpwchange\fP -.sp Enabling this flag forces a password change for this principal. .TP .B \fBpwservice\fP -.sp If this flag is enabled, it marks this principal as a password change service. This should only be used in special cases, for example, if a user\(aqs password has expired, then the user @@ -234,60 +214,56 @@ the normal password authentication in order to be able to change the password. .TP .B \fBrenewable\fP -.sp Enabling this flag allows the principal to obtain renewable tickets. .TP .B \fBservice\fP -.sp Enabling this flag allows the the KDC to issue service tickets for this principal. .TP .B \fBtgt\-based\fP -.sp Enabling this flag allows a principal to obtain tickets based on a ticket\-granting\-ticket, rather than repeating the authentication process that was used to obtain the TGT. .UNINDENT .TP .B \fBdict_file\fP -.sp (String.) Location of the dictionary file containing strings that are not allowed as passwords. If none is specified or if there is no policy assigned to the principal, no dictionary checks of passwords will be performed. .TP .B \fBhost_based_services\fP -.sp (Whitespace\- or comma\-separated list.) Lists services which will get host\-based referral processing even if the server principal is not marked as host\-based by the client. .TP .B \fBiprop_enable\fP -.sp (Boolean value.) Specifies whether incremental database propagation is enabled. The default value is false. .TP .B \fBiprop_master_ulogsize\fP -.sp (Integer.) Specifies the maximum number of log entries to be retained for incremental propagation. The maximum value is 2500; the default value is 1000. .TP .B \fBiprop_slave_poll\fP -.sp (Delta time string.) Specifies how often the slave KDC polls for new updates from the master. The default value is \fB2m\fP (that is, two minutes). .TP .B \fBiprop_port\fP -.sp (Port number.) Specifies the port number to be used for incremental propagation. This is required in both master and slave configuration files. .TP +.B \fBiprop_resync_timeout\fP +(Delta time string.) Specifies the amount of time to wait for a +full propagation to complete. This is optional in configuration +files, and is used by slave KDCs only. The default value is 5 +minutes (\fB5m\fP). +.TP .B \fBiprop_logfile\fP -.sp (File name.) Specifies where the update log file for the realm database is to be stored. The default is to use the \fBdatabase_name\fP entry from the realms section of the krb5 config @@ -299,18 +275,15 @@ back end is being used, or the file name is specified in the default value will not use values from the [dbmodules] section.) .TP .B \fBkadmind_port\fP -.sp (Port number.) Specifies the port on which the \fIkadmind(8)\fP daemon is to listen for this realm. The assigned port for kadmind -is 749. +is 749, which is used by default. .TP .B \fBkey_stash_file\fP -.sp (String.) Specifies the location where the master key has been stored (via kdb5_util stash). The default is \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/.k5.REALM\fP, where \fIREALM\fP is the Kerberos realm. .TP .B \fBkdc_ports\fP -.sp (Whitespace\- or comma\-separated list.) Lists the ports on which the Kerberos server should listen for UDP requests, as a comma\-separated list of integers. The default value is @@ -318,7 +291,6 @@ comma\-separated list of integers. The default value is historically used by Kerberos V4. .TP .B \fBkdc_tcp_ports\fP -.sp (Whitespace\- or comma\-separated list.) Lists the ports on which the Kerberos server should listen for TCP connections, as a comma\-separated list of integers. If this relation is not @@ -330,38 +302,39 @@ has little protection against denial\-of\-service attacks), the standard port number assigned for Kerberos TCP traffic is port 88. .TP .B \fBmaster_key_name\fP -.sp (String.) Specifies the name of the principal associated with the master key. The default is \fBK/M\fP. .TP .B \fBmaster_key_type\fP -.sp (Key type string.) Specifies the master key\(aqs key type. The default value for this is \fBaes256\-cts\-hmac\-sha1\-96\fP. For a list of all possible values, see \fI\%Encryption and salt types\fP. .TP .B \fBmax_life\fP -.sp -(Delta time string.) Specifies the maximum time period for which -a ticket may be valid in this realm. The default value is 24 -hours. +(\fIduration\fP string.) Specifies the maximum time period for +which a ticket may be valid in this realm. The default value is +24 hours. .TP .B \fBmax_renewable_life\fP -.sp -(Delta time string.) Specifies the maximum time period during -which a valid ticket may be renewed in this realm. The default -value is 0. +(\fIduration\fP string.) Specifies the maximum time period +during which a valid ticket may be renewed in this realm. +The default value is 0. .TP .B \fBno_host_referral\fP -.sp (Whitespace\- or comma\-separated list.) Lists services to block from getting host\-based referral processing, even if the client marks the server principal as host\-based or the service is also listed in \fBhost_based_services\fP. \fBno_host_referral = *\fP will disable referral processing altogether. .TP +.B \fBdes_crc_session_supported\fP +(Boolean value). If set to true, the KDC will assume that service +principals support des\-cbc\-crc for session key enctype negotiation +purposes. If \fBallow_weak_crypto\fP in \fIlibdefaults\fP is +false, or if des\-cbc\-crc is not a permitted enctype, then this +variable has no effect. Defaults to true. +.TP .B \fBreject_bad_transit\fP -.sp (Boolean value.) If set to true, the KDC will check the list of transited realms for cross\-realm tickets against the transit path computed from the realm names and the capaths section of its @@ -383,7 +356,6 @@ only to TGS requests. The default value is true. .TP .B \fBrestrict_anonymous_to_tgt\fP -.sp (Boolean value.) If set to true, the KDC will reject ticket requests from anonymous principals to service principals other than the realm\(aqs ticket\-granting service. This option allows @@ -392,97 +364,12 @@ without allowing anonymous authentication to services. The default value is false. .TP .B \fBsupported_enctypes\fP -.sp (List of \fIkey\fP:\fIsalt\fP strings.) Specifies the default key/salt combinations of principals for this realm. Any principals created through \fIkadmin(1)\fP will have keys of these types. The default value for this tag is \fBaes256\-cts\-hmac\-sha1\-96:normal aes128\-cts\-hmac\-sha1\-96:normal des3\-cbc\-sha1:normal arcfour\-hmac\-md5:normal\fP. For lists of possible values, see \fI\%Encryption and salt types\fP. .UNINDENT -.SS [logging] -.sp -The [logging] section indicates how \fIkrb5kdc(8)\fP and -\fIkadmind(8)\fP perform logging. The keys in this section are -daemon names, which may be one of: -.INDENT 0.0 -.TP -.B \fBadmin_server\fP -.sp -Specifies how \fIkadmind(8)\fP performs logging. -.TP -.B \fBkdc\fP -.sp -Specifies how \fIkrb5kdc(8)\fP performs logging. -.TP -.B \fBdefault\fP -.sp -Specifies how either daemon performs logging in the absence of -relations specific to the daemon. -.UNINDENT -.sp -Values are of the following forms: -.INDENT 0.0 -.TP -.B \fBFILE=\fP\fIfilename\fP or \fBFILE:\fP\fIfilename\fP -.sp -This value causes the daemon\(aqs logging messages to go to the -\fIfilename\fP. If the \fB=\fP form is used, the file is overwritten. -If the \fB:\fP form is used, the file is appended to. -.TP -.B \fBSTDERR\fP -.sp -This value causes the daemon\(aqs logging messages to go to its -standard error stream. -.TP -.B \fBCONSOLE\fP -.sp -This value causes the daemon\(aqs logging messages to go to the -console, if the system supports it. -.TP -.B \fBDEVICE=\fP\fI\fP -.sp -This causes the daemon\(aqs logging messages to go to the specified -device. -.TP -.B \fBSYSLOG\fP[\fB:\fP\fIseverity\fP[\fB:\fP\fIfacility\fP]] -.sp -This causes the daemon\(aqs logging messages to go to the system log. -.sp -The severity argument specifies the default severity of system log -messages. This may be any of the following severities supported -by the syslog(3) call, minus the \fBLOG_\fP prefix: \fBEMERG\fP, -\fBALERT\fP, \fBCRIT\fP, \fBERR\fP, \fBWARNING\fP, \fBNOTICE\fP, \fBINFO\fP, -and \fBDEBUG\fP. -.sp -The facility argument specifies the facility under which the -messages are logged. This may be any of the following facilities -supported by the syslog(3) call minus the LOG_ prefix: \fBKERN\fP, -\fBUSER\fP, \fBMAIL\fP, \fBDAEMON\fP, \fBAUTH\fP, \fBLPR\fP, \fBNEWS\fP, -\fBUUCP\fP, \fBCRON\fP, and \fBLOCAL0\fP through \fBLOCAL7\fP. -.sp -If no severity is specified, the default is \fBERR\fP. If no -facility is specified, the default is \fBAUTH\fP. -.UNINDENT -.sp -In the following example, the logging messages from the KDC will go to -the console and to the system log under the facility LOG_DAEMON with -default severity of LOG_INFO; and the logging messages from the -administrative server will be appended to the file -\fB/var/adm/kadmin.log\fP and sent to the device \fB/dev/tty04\fP. -.INDENT 0.0 -.INDENT 3.5 -.sp -.nf -.ft C -[logging] - kdc = CONSOLE - kdc = SYSLOG:INFO:DAEMON - admin_server = FILE:/var/adm/kadmin.log - admin_server = DEVICE=/dev/tty04 -.ft P -.fi -.UNINDENT -.UNINDENT .SS [dbdefaults] .sp The [dbdefaults] section specifies default values for some database @@ -491,33 +378,27 @@ a relation for the tag. See the \fI\%[dbmodules]\fP section for the definitions of these relations. .INDENT 0.0 .IP \(bu 2 -. \fBldap_kerberos_container_dn\fP .IP \(bu 2 -. \fBldap_kdc_dn\fP .IP \(bu 2 -. \fBldap_kadmind_dn\fP .IP \(bu 2 -. \fBldap_service_password_file\fP .IP \(bu 2 -. \fBldap_servers\fP .IP \(bu 2 -. \fBldap_conns_per_server\fP .UNINDENT .SS [dbmodules] .sp The [dbmodules] section contains parameters used by the KDC database -library and database modules. The following tag may be specified -in the [dbmodules] section: +library and database modules. +.sp +The following tag may be specified in the [dbmodules] section: .INDENT 0.0 .TP .B \fBdb_module_dir\fP -.sp This tag controls where the plugin system looks for modules. The value should be an absolute path. .UNINDENT @@ -529,45 +410,40 @@ the subsection: .INDENT 0.0 .TP .B \fBdatabase_name\fP -.sp This DB2\-specific tag indicates the location of the database in the filesystem. The default is \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/principal\fP. .TP .B \fBdb_library\fP -.sp This tag indicates the name of the loadable database module. The value should be \fBdb2\fP for the DB2 module and \fBkldap\fP for the LDAP module. .TP .B \fBdisable_last_success\fP -.sp If set to \fBtrue\fP, suppresses KDC updates to the "Last successful authentication" field of principal entries requiring preauthentication. Setting this flag may improve performance. (Principal entries which do not require preauthentication never -update the "Last successful authentication" field.). +update the "Last successful authentication" field.). First +introduced in version 1.9. .TP .B \fBdisable_lockout\fP -.sp If set to \fBtrue\fP, suppresses KDC updates to the "Last failed authentication" and "Failed password attempts" fields of principal entries requiring preauthentication. Setting this flag may -improve performance, but also disables account lockout. +improve performance, but also disables account lockout. First +introduced in version 1.9. .TP .B \fBldap_conns_per_server\fP -.sp This LDAP\-specific tag indicates the number of connections to be maintained per LDAP server. .TP .B \fBldap_kadmind_dn\fP -.sp This LDAP\-specific tag indicates the default bind DN for the \fIkadmind(8)\fP daemon. kadmind does a login to the directory as this object. This object should have the rights to read and write the Kerberos data in the LDAP database. .TP .B \fBldap_kdc_dn\fP -.sp This LDAP\-specific tag indicates the default bind DN for the \fIkrb5kdc(8)\fP daemon. The KDC does a login to the directory as this object. This object should have the rights to read the @@ -575,12 +451,10 @@ Kerberos data in the LDAP database, and to write data unless \fBdisable_lockout\fP and \fBdisable_last_success\fP are true. .TP .B \fBldap_kerberos_container_dn\fP -.sp This LDAP\-specific tag indicates the DN of the container object where the realm objects will be located. .TP .B \fBldap_servers\fP -.sp This LDAP\-specific tag indicates the list of LDAP servers that the Kerberos servers can connect to. The list of LDAP servers is whitespace\-separated. The LDAP server is specified by a LDAP URI. @@ -588,15 +462,89 @@ It is recommended to use \fBldapi:\fP or \fBldaps:\fP URLs to connect to the LDAP server. .TP .B \fBldap_service_password_file\fP -.sp This LDAP\-specific tag indicates the file containing the stashed passwords (created by \fBkdb5_ldap_util stashsrvpw\fP) for the \fBldap_kadmind_dn\fP and \fBldap_kdc_dn\fP objects. This file must be kept secure. .UNINDENT +.SS [logging] +.sp +The [logging] section indicates how \fIkrb5kdc(8)\fP and +\fIkadmind(8)\fP perform logging. The keys in this section are +daemon names, which may be one of: +.INDENT 0.0 +.TP +.B \fBadmin_server\fP +Specifies how \fIkadmind(8)\fP performs logging. +.TP +.B \fBkdc\fP +Specifies how \fIkrb5kdc(8)\fP performs logging. +.TP +.B \fBdefault\fP +Specifies how either daemon performs logging in the absence of +relations specific to the daemon. +.UNINDENT +.sp +Values are of the following forms: +.INDENT 0.0 +.TP +.B \fBFILE=\fP\fIfilename\fP or \fBFILE:\fP\fIfilename\fP +This value causes the daemon\(aqs logging messages to go to the +\fIfilename\fP. If the \fB=\fP form is used, the file is overwritten. +If the \fB:\fP form is used, the file is appended to. +.TP +.B \fBSTDERR\fP +This value causes the daemon\(aqs logging messages to go to its +standard error stream. +.TP +.B \fBCONSOLE\fP +This value causes the daemon\(aqs logging messages to go to the +console, if the system supports it. +.TP +.B \fBDEVICE=\fP\fI\fP +This causes the daemon\(aqs logging messages to go to the specified +device. +.TP +.B \fBSYSLOG\fP[\fB:\fP\fIseverity\fP[\fB:\fP\fIfacility\fP]] +This causes the daemon\(aqs logging messages to go to the system log. +.sp +The severity argument specifies the default severity of system log +messages. This may be any of the following severities supported +by the syslog(3) call, minus the \fBLOG_\fP prefix: \fBEMERG\fP, +\fBALERT\fP, \fBCRIT\fP, \fBERR\fP, \fBWARNING\fP, \fBNOTICE\fP, \fBINFO\fP, +and \fBDEBUG\fP. +.sp +The facility argument specifies the facility under which the +messages are logged. This may be any of the following facilities +supported by the syslog(3) call minus the LOG_ prefix: \fBKERN\fP, +\fBUSER\fP, \fBMAIL\fP, \fBDAEMON\fP, \fBAUTH\fP, \fBLPR\fP, \fBNEWS\fP, +\fBUUCP\fP, \fBCRON\fP, and \fBLOCAL0\fP through \fBLOCAL7\fP. +.sp +If no severity is specified, the default is \fBERR\fP. If no +facility is specified, the default is \fBAUTH\fP. +.UNINDENT +.sp +In the following example, the logging messages from the KDC will go to +the console and to the system log under the facility LOG_DAEMON with +default severity of LOG_INFO; and the logging messages from the +administrative server will be appended to the file +\fB/var/adm/kadmin.log\fP and sent to the device \fB/dev/tty04\fP. +.INDENT 0.0 +.INDENT 3.5 +.sp +.nf +.ft C +[logging] + kdc = CONSOLE + kdc = SYSLOG:INFO:DAEMON + admin_server = FILE:/var/adm/kadmin.log + admin_server = DEVICE=/dev/tty04 +.ft P +.fi +.UNINDENT +.UNINDENT .SH PKINIT OPTIONS .IP Note -. The following are pkinit\-specific options. These values may be specified in [kdcdefaults] as global defaults, or within a realm\-specific subsection of [realms]. Also note that a @@ -605,7 +553,6 @@ realm\-specific value over\-rides, does not add to, a generic .RE .INDENT 0.0 .IP 1. 3 -. realm\-specific subsection of [realms], .INDENT 3.0 .INDENT 3.5 @@ -614,14 +561,13 @@ realm\-specific subsection of [realms], .ft C [realms] EXAMPLE.COM = { - pkinit_anchors = FILE\e:/usr/local/example.com.crt + pkinit_anchors = FILE:/usr/local/example.com.crt } .ft P .fi .UNINDENT .UNINDENT .IP 2. 3 -. generic value in the [kdcdefaults] section. .INDENT 3.0 .INDENT 3.5 @@ -629,7 +575,7 @@ generic value in the [kdcdefaults] section. .nf .ft C [kdcdefaults] - pkinit_anchors = DIR\e:/usr/local/generic_trusted_cas/ + pkinit_anchors = DIR:/usr/local/generic_trusted_cas/ .ft P .fi .UNINDENT @@ -642,19 +588,16 @@ For information about the syntax of some of these options, see .INDENT 0.0 .TP .B \fBpkinit_anchors\fP -.sp Specifies the location of trusted anchor (root) certificates which the KDC trusts to sign client certificates. This option is required if pkinit is to be supported by the KDC. This option may be specified multiple times. .TP .B \fBpkinit_dh_min_bits\fP -.sp Specifies the minimum number of bits the KDC is willing to accept for a client\(aqs Diffie\-Hellman key. The default is 2048. .TP .B \fBpkinit_allow_upn\fP -.sp Specifies that the KDC is willing to accept client certificates with the Microsoft UserPrincipalName (UPN) Subject Alternative Name (SAN). This means the KDC accepts the binding of the UPN in @@ -666,60 +609,50 @@ the id\-pkinit\-san as defined in \fI\%RFC 4556\fP. There is currently no option to disable SAN checking in the KDC. .TP .B \fBpkinit_eku_checking\fP -.sp This option specifies what Extended Key Usage (EKU) values the KDC is willing to accept in client certificates. The values recognized in the kdc.conf file are: .INDENT 7.0 .TP .B \fBkpClientAuth\fP -.sp This is the default value and specifies that client certificates must have the id\-pkinit\-KPClientAuth EKU as defined in \fI\%RFC 4556\fP. .TP .B \fBscLogin\fP -.sp If scLogin is specified, client certificates with the Microsoft Smart Card Login EKU (id\-ms\-kp\-sc\-logon) will be accepted. .TP .B \fBnone\fP -.sp If none is specified, then client certificates will not be checked to verify they have an acceptable EKU. The use of this option is not recommended. .UNINDENT .TP .B \fBpkinit_identity\fP -.sp Specifies the location of the KDC\(aqs X.509 identity information. This option is required if pkinit is to be supported by the KDC. .TP .B \fBpkinit_kdc_ocsp\fP -.sp Specifies the location of the KDC\(aqs OCSP. .TP .B \fBpkinit_mapping_file\fP -.sp Specifies the name of the ACL pkinit mapping file. This file maps principals to the certificates that they can use. .TP .B \fBpkinit_pool\fP -.sp Specifies the location of intermediate certificates which may be used by the KDC to complete the trust chain between a client\(aqs certificate and a trusted anchor. This option may be specified multiple times. .TP .B \fBpkinit_revoke\fP -.sp Specifies the location of Certificate Revocation List (CRL) information to be used by the KDC when verifying the validity of client certificates. This option may be specified multiple times. .TP .B \fBpkinit_require_crl_checking\fP -.sp The default certificate verification process will always check the available revocation information to see if a certificate has been revoked. If a match is found for the certificate in a CRL, @@ -916,11 +849,30 @@ Here\(aqs an example of a kdc.conf file: max_renewable_life = 7d 0h 0m 0s master_key_type = des3\-hmac\-sha1 supported_enctypes = des3\-hmac\-sha1:normal des\-cbc\-crc:normal des\-cbc\-crc:v4 + database_module = openldap_ldapconf } [logging] kdc = FILE:/usr/local/var/krb5kdc/kdc.log admin_server = FILE:/usr/local/var/krb5kdc/kadmin.log + +[dbdefaults] + ldap_kerberos_container_dn = cn=krbcontainer,dc=mit,dc=edu + +[dbmodules] + openldap_ldapconf = { + db_library = kldap + disable_last_success = true + ldap_kdc_dn = "cn=krbadmin,dc=mit,dc=edu" + # this object needs to have read rights on + # the realm container and principal subtrees + ldap_kadmind_dn = "cn=krbadmin,dc=mit,dc=edu" + # this object needs to have read and write rights on + # the realm container and principal subtrees + ldap_service_password_file = /etc/kerberos/service.keyfile + ldap_servers = ldaps://kerberos.mit.edu + ldap_conns_per_server = 5 + } .ft P .fi .UNINDENT @@ -930,10 +882,10 @@ Here\(aqs an example of a kdc.conf file: \fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kdc.conf\fP .SH SEE ALSO .sp -\fIkrb5.conf(5)\fP, \fIkrb5kdc(8)\fP +\fIkrb5.conf(5)\fP, \fIkrb5kdc(8)\fP, \fIkadm5.acl(5)\fP .SH AUTHOR MIT .SH COPYRIGHT -2011, MIT +2012, MIT .\" Generated by docutils manpage writer. . -- cgit