summaryrefslogtreecommitdiffstats
path: root/doc/admin
Commit message (Collapse)AuthorAgeFilesLines
* Remove indent workaround in man page RST sourcesGreg Hudson2014-07-0211-180/+66
| | | | | | | | | | docutils 0.10 properly adds indentation to example blocks in man pages, so we do not need to force an extra indentation level. Get rid of the workaround wherever we use it. ticket: 7954 (new) target_version: 1.12.2 tags: pullup
* Consolidate DB option documentationGreg Hudson2014-06-183-68/+24
| | | | | | | | | | | Document DB options in the kadmin/kadmin.local man page, in their own section. Refer to that section from the documentation of the -x parameter of each other command which supports DB options. Add documentation for the "dbname" DB2 option. ticket: 7946 (new) target_version: 1.12.2 tags: pullup
* Update the kadm5.acl exampleBen Kaduk2014-06-161-16/+18
| | | | | | | | | | | | | | | | | | | | | | Make the example and documentation a closer match to reality. In particular, the list permission is all-or-nothing; it is not restricted in scope by the target_principal field. Change the table entry to try and indicate this fact, and do not put list permissions on any example line that is scoped by a target_principal pattern. While here, remove the nonsensical granting of global inquire permissions to */* (inaccurately described as "all principals"), and the granting of privileges to foreign-realm principals. It is not possible to obtain an initial ticket (as required by the kadmin service) for a principal in a different realm, and the current kadmind implementation can serve only a single realm at a time -- this permission literally has no effect. Replace it with a (presumably automated) "Service Management System" example, where it might make sense to limit the principals which are automatically created. ticket: 7939
* Remove pkinit_win2k_require_binding optionGreg Hudson2014-06-131-5/+0
| | | | | | | | | | | | When constructing a draft9 PKINIT request, always include KRB5_PADATA_AS_CHECKSUM padata to ask for an RFC 4556 ReplyKeyPack. Do not accept a draft9 ReplyKeyPack in the KDC response. For now, retain the krb5_reply_key_pack_draft9 ASN.1 codec and the KDC support for generating a draft9 ReplyKeyPack when a draft9 PKINIT request does not contain KRB5_PADATA_AS_CHECKSUM. ticket: 7933
* Remove PKINIT longhorn compatibility optionGreg Hudson2014-06-121-3/+0
| | | | | | | | Remove the PKINIT Windows Server 2008 beta compatibility code conditionalized under the "longhorn" variable. It is not required to interoperate with any released version of Windows. ticket: 7934 (new)
* Improve PKINIT certificate documentationGreg Hudson2014-06-122-34/+86
| | | | | | | | | | | | | | Describe how to use a commercially-issued server certificate for anonymous PKINIT. Separate the KDC and client configuration instructions so that the steps necessary for anonymous PKINIT are not combined with the additional steps necessary for regular PKINIT. Describe kpServerAuth as the EKU used in commercially issued server certificates, not as the value used by Microsoft (which does not appear to be true according to [MS-PKCA]). ticket: 7931 (new) target_version: 1.12.2 tags: pullup
* Do not document pkinit_win2kGreg Hudson2014-06-111-5/+0
| | | | | | | | | This variable was never used in the PKINIT code as it was contributed; there was only code to read its value. ticket: 7932 (new) target_version: 1.12.2 tags: pullup
* Do not document pkinit_mapping_fileGreg Hudson2014-06-031-4/+0
| | | | | | | | | This feature was never implemented in the PKINIT code as it was contributed; there was only stub support for reading the filename. ticket: 7928 (new) target_version: 1.12.2 tags: pullup
* Add some longer-form docs for HTTPSNalin Dahyabhai2014-06-022-0/+49
| | | | | | | | | Add some longer-form documentation for the new HTTPS support, walking a prospective administrator through generating a bare minimal signing setup, deploying a WSGI-based proxy server onto an Apache httpd server using mod_ssl and mod_wsgi, and configuring clients to use it. ticket: 7929
* Load custom anchors when using KKDCPNalin Dahyabhai2014-06-021-0/+26
| | | | | | | | Add an http_anchors per-realm setting which we'll apply when using an HTTPS proxy, more or less mimicking the syntax of its similarly-named PKINIT counterpart. We only check the [realms] section, though. ticket: 7929
* Change example module name in host_config.rstGreg Hudson2014-06-011-3/+3
| | | | | | | | | | Don't use "otp" as the example clpreauth module name in host_config.rst, since we now ship an effectively built-in otp clpreauth module. Instead use "mypreauth". ticket: 7920 (new) target_version: 1.12.2 tags: pullup
* Correct documentation of 'x' in kadm5.aclBen Kaduk2014-05-291-1/+1
| | | | | It really is all privileges, including setting keys and disallowing the propagation of the principal database.
* Document /etc/gss/mech.d/*.confGünther Deschner2014-05-221-2/+5
| | | | [ghudson@mit.edu: editorial changes]
* Update sample configs to include master_kdcGreg Hudson2014-04-151-4/+0
| | | | | | | | | | | | Where we have ATHENA.MIT.EDU stanzas in sample or test krb5.conf files which define kdc entries, also define a master_kdc entry. Remove default_domain and v4_instance_convert entries in examples as they are only needed for krb5/krb4 principal conversions. In the krb5_conf.rst example, remove enctype specifications as we don't want to encourage their use when they aren't necessary, and remove a redundant domain_realm entry. ticket: 7901 (new)
* Improve salt type display in kadmin getprincGreg Hudson2014-03-262-13/+13
| | | | | | | | | | | | | | In krb5_salttype_to_string, output the salt type name we would recognize as input. In the output of getprinc, display the enctype and salt type in a form we would accept--either enctype:salttype if the salt type is not the default, or just the enctype if it is. Update t_mkey.py and t_salt.py to expect the new output format. Update documentation examples to show the new format. ticket: 5958
* Update example kadmin getprinc enctype displayGreg Hudson2014-03-261-2/+2
| | | | | | | | | In kadmin_local.rst, update the example to reflect the new way we display enctypes after #5014. ticket: 7890 (new) target_version: 1.12.2 tags: pullup
* Update iprop_master_ulogsize documentationGreg Hudson2014-03-131-2/+2
| | | | | | | | | | When we removed the maximum number of ulog entries (#7368), we did not update the documentation for that parameter in kdc.conf. Reported by Richard Basch. ticket: 7849 target_version: 1.12.2 tags: pullup
* Correct docs for "kdb5_util load" switchesJeff D'Angelo2014-02-281-5/+3
| | | | | | | | | | | | | | | Remove obsolete parenthetical statement in the description of the "-update" switch to "kdb5_util load". Using the "-update" flag to load a second dump made using the "-ov" switch is no longer necessary now that the "-r13" format is the default. Add statement that the "-b7" dump format was the default for versions prior to 1.2.2 (to match the statement from "dump" section). [tlyu@mit.edu: commit message] ticket: 7865 tags: pullup target_version: 1.12.2
* Update kadmin set_string documentZhanna Tsitkov2014-02-262-6/+22
| | | | | Added 'otp' as an acceptable attribute name. Added examples. Also, x-ref kadmin document from otp.rst.
* Document hierarchical ipropGreg Hudson2014-02-201-6/+13
| | | | | | | Also remove an outdated caveat, but add a new one about policy changes causing full resyncs. ticket: 7855
* Implement kpropd -AGreg Hudson2014-02-201-0/+5
| | | | | | | | | | The -A option causes kpropd to contact a specified admin server (normally an intermediate slave running kadmind -proponly) instead of the master admin server. Based on code submitted by Richard Basch. ticket: 7855
* Implement kadmind -proponlyGreg Hudson2014-02-201-0/+7
| | | | | | | | | | | The -proponly option causes kadmind to only service the iprop service, not the kpasswd or kadmin services. An intermediate slave in a hierarchical iprop setup runs kadmind -proponly in order to provide incremental updates to downstream slaves. Based on code submitted by Richard Basch. ticket: 7855
* Document 1.12 changes in MIT Kerberos Features docZhanna Tsitkov2014-02-191-0/+2
| | | | ticket: 7857
* Move OTP sockets to KDC_RUN_DIRNathaniel McCallum2014-02-061-2/+3
| | | | | | | | | | | | Some system configurations expect Unix-domain sockets to live under /run or /var/run, and not other parts of /var where persistent application state lives. Define a new directory KDC_RUN_DIR using $runstatedir (new in autoconf 2.70, so fall back to $localstatedir/run if it's not set) and use that for the default socket path. [ghudson@mit.edu: commit message, otp.rst formatting fix] ticket: 7859 (new)
* Move kprop error explanation into TroubleshootingZhanna Tsitkov2013-12-192-48/+77
| | | | | | | The plan is to make Troubleshooting section of the documentation a one-stop-shop place for all error diagnostics, explanations and possible solutions. The relocation of kprop error messages descriptions is part of this consolidation effort.
* Better keysalt docsTom Yu2013-12-095-38/+61
| | | | | | | | | | Add a new section to kdc_conf.rst to describe keysalt lists, and update other documentation to better distinguish enctype lists from keysalt lists. ticket: 7608 target_version: 1.12 tags: pullup
* Fix error message quotations in install_kdc.rstTom Yu2013-12-031-6/+5
| | | | | | | | | | | Some error messages that kprop could print were quoted incorrectly in install_kdc.rst. Also fix minor typos. ticket: 7785 (new) target_version: 1.12 tags: pullup
* Update doc for current kdb5_util dump versionTom Yu2013-11-221-1/+1
| | | | | | | | | kdb5_util.rst incorrectly describes the current default dump format version as 6 when it should be 7. Reported by Jeff D'Angelo. ticket: 7777 target_version: 1.12 tags: pullup
* Correct kadm5.acl back-reference documentationGreg Hudson2013-11-211-3/+4
| | | | | | | | | In kadm5.acl, *N in the target principal name refers to the Nth wildcard in the acting principal pattern, not the Nth component. ticket: 7774 (new) target_version: 1.12 tags: pullup
* Clarify lockout replication issues in docsGreg Hudson2013-11-181-7/+13
| | | | | | | | | | | | In the "KDC replication and account lockout" section of lockout.rst, specifically call out kprop and incremental propagation as the mechanisms which do not replicate account lockout state, and add a note that KDCs using LDAP may not be affected by that section's concerns. ticket: 7773 (new) target_version: 1.12 tags: pullup
* Clarify realm and dbmodules configuration docsGreg Hudson2013-11-061-23/+34
| | | | | | | | | | | | | In kdc_conf.rst, add examples showing how to configure a realm parameter and a database parameter. Document that the default DB configuration section is the realm name, and use that in the example. Move the db_module_dir description to the end of the [dbmodules] documentation since it is rarely used and could confuse a reader about the usual structure of the section. ticket: 7759 (new) target_version: 1.12 tags: pullup
* Clarify kpropd standalone mode documentationGreg Hudson2013-11-011-15/+12
| | | | | | | | | | | | The kpropd -S option is no longer needed to run kpropd in standalone mode, but its functionality is not deprecated; standalone mode is automatically activated when appropriate. Clarify the kpropd documentation on standalone mode to avoid giving the impression that the mode is deprecated. ticket: 7751 (new) target_version: 1.12 tags: pullup
* Document master key rolloverGreg Hudson2013-10-301-0/+51
| | | | | | | | | Add a new section to database.rst documenting the procedure for rolling the master key. ticket: 7732 (new) target_version: 1.12 tags: pullup
* Use active master key in update_princ_encryptionGreg Hudson2013-10-251-2/+2
| | | | | | | | | kdb5_util update_princ_encryption should update to the active master key version, not the most recent. ticket: 6507 target_version: 1.12 tags: pullup
* Discuss cert expiry, no-key princs in PKINIT docsGreg Hudson2013-10-172-6/+46
| | | | | | | | | | | | In pkinit.rst, add "-days" options to the example commands for creating certificate and briefly discuss the issue of expiration dates so that the administrator thinks about it. In troubleshoot.rst, add an entry for the "certificate has expired" error which results from PKINIT (when linked with OpenSSL) when a certificate has expired. ticket: 7719 (new) target_version: 1.12 tags: pullup
* Add a flag to prevent all host canonicalizationGreg Hudson2013-09-061-1/+9
| | | | | | | | If dns_canonicalize_hostname is set to false in [libdefaults], krb5_sname_to_principal will not canonicalize the hostname using either forward or reverse lookups. ticket: 7703 (new)
* Omit signedpath if no_auth_data_required is setGreg Hudson2013-08-202-2/+11
| | | | | | | | | | The no_auth_data_required bit was introduced to suppress PACs in service tickets when the back end supports them. Make it also suppress AD-SIGNEDPATH, so that the ~70-byte expansion of the ticket can be avoided for services which aren't going to do constrained delegation. ticket: 7697 (new)
* Add a note about how to apply/remove policiesBrad Davis2013-08-161-0/+9
| | | | | | | | | Put a note in the the policies section of the documentation for how to apply policies to principals. [kaduk@mit.edu: reformat commit message] ticket: 7693 (new)
* Document hostrealm interfaceGreg Hudson2013-08-151-0/+26
| | | | ticket: 7687
* Remove redundant domain_realm mappingsBen Kaduk2013-08-121-7/+11
| | | | | | | | | | | | | | | | | | | This fixes a long-standing documentation bug where we claimed that a domain_realm mapping for a host name would not affect entries under that domain name. The code has always had the behavior where a host name mapping implies the corresponding domain name mapping, since the 1.0 release. While here, replace media-lab with csail in example files, as the media lab realm is no longer in use. Also strip port 88 from KDC specifications, and drop the harmful default_{tgs,tkt}_enctypes lines from src/util/profile/krb5.conf. Further cleanup on these files to remove defunct realms may be in order. ticket: 7690 (new) tags: pullup target_version: 1.11.4
* Add kadmin support for principals without keysGreg Hudson2013-07-151-2/+8
| | | | | | | | | Add kadmin support for "addprinc -nokey", which creates a principal with no keys, and "purgekeys -all", which deletes all keys from a principal. The KDC was modified by #7630 to support principals without keys. ticket: 7679 (new)
* Add server-side otp preauth pluginNathaniel McCallum2013-07-113-0/+152
| | | | | | | | | | This plugin implements the proposal for providing OTP support by proxying requests to RADIUS. Details can be found inside the provided documentation as well as on the project page. http://k5wiki.kerberos.org/wiki/Projects/OTPOverRADIUS ticket: 7678
* Document dict_file formatGreg Hudson2013-07-011-3/+4
| | | | | Briefly describe the format of the kadmin dictionary file in kdc_conf.rst.
* Rely on module ordering for localauthGreg Hudson2013-06-271-15/+15
| | | | | | | Register built-in localauth modules in the order we want them used by default, and document accordingly. ticket: 7665
* Provide plugin module ordering guaranteesGreg Hudson2013-06-271-0/+6
| | | | | | | | Rewrite the plugin internals so that modules have a well-defined order--either the order of enable_only tags, or dynamic modules followed by the built-in modules in order of registration. ticket: 7665 (new)
* Clean up dangling antecedent in allow_weak_cryptoBen Kaduk2013-05-311-6/+6
| | | | | | | | | | The "previous three lists" are not previous any more. Say explicitly which three lists, and make the parenthetical bind to the correct noun. ticket: 7655 (new) tags: pullup target_version: 1.11.4
* Clarify retiring-des based on user feedbackBen Kaduk2013-05-311-2/+18
| | | | | | | | | Explain why DES keys should be removed from principals, and clarify that allow_weak_crypto overrides all other configuration. ticket: 7654 (new) tags: pullup target_version: 1.11.4
* Document preauth flags for service principalsBen Kaduk2013-05-311-2/+8
| | | | | | | | | These flags are overloaded to mean different things for clients and servers; previously we only documented the client behavior. ticket: 7653 (new) tags: pullup target_version: 1.11.4
* Clarify that kdc.conf and krb5.conf are mergedBen Kaduk2013-05-202-1/+14
| | | | These two files are merged into the profile for KDC applications
* Replace "First introduced" with concise "New"Zhanna Tsitkov2013-03-255-13/+10
|
generated by cgit (git 2.34.1) at 2025-09-26 12:32:08 +0000