Created a new basic Kerberos concepts section and moved stash_file_def there

git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@25764 dc483132-0cff-0310-8789-dd5450dbe970

2 files changed, 33 insertions, 0 deletions

diff --git a/doc/rst_source/krb_basic/index.rst b/doc/rst_source/krb_basic/index.rst
new file mode 100644
index 000000000..d402f2184
--- /dev/null
+++ b/doc/rst_source/krb_basic/index.rst
@@ -0,0 +1,10 @@
+.. _basic_concepts:
+
+Basic Kerberos V5 concepts
+==========================
+
+
+.. toctree::
+   :maxdepth: 1
+
+   stash_file_def.rst
diff --git a/doc/rst_source/krb_basic/stash_file_def.rst b/doc/rst_source/krb_basic/stash_file_def.rst
new file mode 100644
index 000000000..da1cd6cc6
--- /dev/null
+++ b/doc/rst_source/krb_basic/stash_file_def.rst
@@ -0,0 +1,23 @@
+.. _stash_definition:
+
+
+stash file
+============
+
+The stash file is a local copy of the master key that resides in
+encrypted form on the KDC's local disk.  The stash file is used to
+authenticate the KDC to itself automatically before starting the
+:ref:`kadmind(8)` and :ref:`krb5kdc(8)` daemons (e.g., as part of the
+machine's boot sequence).  The stash file, like the keytab file (see
+:ref:`keytab_file`) is a potential point-of-entry for a break-in, and
+if compromised, would allow unrestricted access to the Kerberos
+database.  If you choose to install a stash file, it should be
+readable only by root, and should exist only on the KDC's local disk.
+The file should not be part of any backup of the machine, unless
+access to the backup data is secured as tightly as access to the
+master password itself.
+
+.. note:: If you choose not to install a stash file, the KDC will prompt you for the master key each time it starts up. 
+          This means that the KDC will not be able to start automatically, such as after a system reboot.
+
+