*nix Documentation Project
·  Home
 +   man pages
·  Linux HOWTOs
·  FreeBSD Tips
·  *niX Forums

  man pages->OpenBSD man pages -> krb5.conf (5)              



NAME    [Toc]    [Back]

     krb5.conf - configuration file for Kerberos 5

DESCRIPTION    [Toc]    [Back]

     The krb5.conf file specifies several  configuration  parameters for the
     Kerberos 5 library, as well as for some programs.

     The file consists of one or more sections, containing a number of bindings.
  The value of each binding can be either a string or a
list of other
 bindings.  The grammar looks like:

                   /* empty */

                   section sections

                   '[' section_name ']' bindings


                   binding bindings

                   name '=' STRING
                   name '=' '{' bindings '}'


     STRINGs consists of one or more non-whitespace characters.

     STRINGs  that  are specified later in this man-page uses the
following notation.

                values can be either yes/true or no/false.

                values can be a list of year, month,  day,  hour,
min, second.
                Example: 1 month 2 days 30 min.

                valid encryption types are: des-cbc-crc, des-cbcmd4, des-cbcmd5,

                an address can be either a IPv4  or  a  IPv6  address.

     Currently recognised sections and bindings are:

                Specifies  the default values to be used for Kerberos applications.
  You can specify defaults per application,
realm, or a
                combination of these.  The preference order is:
                1.   application realm option
                2.   application option
                3.   realm option
                4.   option

                The supported options are:

                      forwardable = boolean
                           When  obtaining  initial  credentials,
make the credentials

                      proxiable = boolean
                           When  obtaining  initial  credentials,
make the credentials

                      no-addresses = boolean
                           When  obtaining  initial  credentials,
request them
                           for an empty set of addresses,  making
the tickets
                           valid from any address.

                      ticket_lifetime = time
                           Default ticket lifetime.

                      renew_lifetime = time
                           Default renewable ticket lifetime.


                      default_realm = REALM
                           Default  realm  to  use,  this is also
known as your
                           ``local realm''.  The default  is  the
result of
                           krb5_get_host_realm(local hostname).

                      clockskew = time
                           Maximum time differential (in seconds)
allowed when
                           comparing times.  Default is 300  seconds (five minutes).

                      kdc_timeout = time
                           Maximum  time to wait for a reply from
the kdc, default
 is 3 seconds.


                           These are described in the
                           krb5_425_conv_principal(3)      manual

                      capath = {

                                 destination-realm              =

                           Normally, all requests to realms  different from the
                           one  of the current client are sent to
this KDC to
                           get cross-realm tickets.  If this  KDC
does not have
                           a  cross-realm  key  with  the desired
realm and the
                           hierarchical path to that  realm  does
not work, a
                           path  can be configured using this directive.  The
                           text shown above instructs the KDC  to
try to obtain
                           a cross-realm ticket to next-hop-realm
when the desired
  realm   is   destination-realm.
This configuration
  should preferably be done on the
KDC where it
                           will help all its clients but can also
be done on
                           the client itself.


                      default_etypes = etypes...
                           A  list of default encryption types to

                      default_etypes_des = etypes...
                           A list of default encryption types  to
use when requesting
 a DES credential.

                      default_keytab_name = keytab
                           The keytab to use if no other is specified, default
                           is                    ``FILE:/etc/kerberosV/krb5.keytab''.

                      dns_lookup_kdc = boolean
                           Use DNS SRV records to lookup KDC services location.

                      dns_lookup_realm = boolean
                           Use DNS TXT records to  lookup  domain
to realm mappings.

                      kdc_timesync = boolean
                           Try  to keep track of the time differential between
                           the local machine  and  the  KDC,  and
then compensate
                           for that when issuing requests.

                      max_retries = number
                           The max number of times to try to contact each KDC.

                      ticket_lifetime = time
                           Default ticket lifetime.

                      renew_lifetime = time
                           Default renewable ticket lifetime.

                      forwardable = boolean
                           When  obtaining  initial  credentials,
make the credentials
  forwardable.  This option is
also valid in
                           the [realms] section.

                      proxiable = boolean
                           When  obtaining  initial  credentials,
make the credentials
  proxiable.   This  option is
also valid in
                           the [realms] section.

                      verify_ap_req_nofail = boolean
                           If enabled, failure to verify  credentials against a
                           local  key  is a fatal error.  The application has to
                           be able to read the corresponding service key for
                           this to work.  Some applications, like
su(8), enable
 this option unconditionally.

                      warn_pwexpire = time
                           How soon to warn  for  expiring  password.  Default is
                           seven days.

                      http_proxy = proxy-spec
                           A  HTTP-proxy  to  use when talking to
the KDC via

                      dns_proxy = proxy-spec
                           Enable using DNS via HTTP.

                      extra_addresses = address...
                           A list of  addresses  to  get  tickets
for, along with
                           all local addresses.

                      time_format = string
                           How  to  print  time  strings in logs,
this string is
                           passed to strftime(3).

                      date_format = string
                           How to print  date  strings  in  logs,
this string is
                           passed to strftime(3).

                      log_utc = boolean
                           Write log-entries using UTC instead of
your local
                           time zone.

                      scan_interfaces = boolean
                           Scan all network  interfaces  for  addresses, as opposed
  to simply using the address associated with
                           the system's host name.

                      fcache_version = int
                           Use file credential cache format  version specified.

                      krb4_get_tickets = boolean
                           Also  get Kerberos 4 tickets in kinit,
login, and
                           other programs.  This option  is  also
valid in the
                           [realms] section.

                This  is  a  list  of mappings from DNS domain to
Kerberos realm.
                Each binding in this section looks like:

                      domain = realm

                The domain can be either a full name of a host or
a trailing
                component,  in  the latter case the domain-string
should start
                with a  period.   The  realm  may  be  the  token
`dns_locate', in
                which  case  the  actual realm will be determined
using DNS (independently
    of    the    setting    of     the
`dns_lookup_realm' option).


                      REALM = {

                                 kdc = [service/]host[:port]
                                      Specifies  a  list  of kdcs
for this realm.
                                      If the optional port is absent, the default
  value for the ``kerberos/udp''
                                      ``kerberos/tcp'',       and
``http/tcp'' port
                                      (depending on service) will
be used.
                                      The kdcs will  be  used  in
the order that
                                      they are specified.

                                      The optional service specifies over what
                                      medium the  kdc  should  be
                                      Possible    services    are
``udp'', ``tcp'',
                                      and ``http''.  Http can also be written
                                      as   ``http://''.   Default
service is
                                      ``udp'' and ``tcp''.

                                 admin_server = host[:port]
                                      Specifies the admin  server
for this
                                      realm,  where all the modifications to
                                      the database are performed.

                                 kpasswd_server = host[:port]
                                      Points  to the server where
all the password
 changes are performed.
If there is
                                      no  such entry, the kpasswd
port on the
                                      admin_server host  will  be

                                 krb524_server = host[:port]
                                      Points  to  the server that
does 524 conversions.
   If  it  is  not
mentioned, the
                                      krb524  port  on  the  kdcs
will be tried.



                                      See   krb5_425_conv_principal(3).



                      entity = destination
                           Specifies  that  entity should use the
                           destination  for  logging.   See   the
                           manual page for a list of defined destinations.


                      database = {

                                 dbname = DATABASENAME
                                      Use this database for  this

                                 realm = REALM
                                      Specifies  the  realm  that
will be stored
                                      in this database.

                                 mkey_file = FILENAME
                                      Use this  keytab  file  for
the master key
                                      of  this  database.  If not
                                      DATABASENAME.mkey  will  be

                                 acl_file = PA FILENAME
                                      Use  this  file for the ACL
list of this

                                 log_file = FILENAME
                                      Use this file as the log of
changes performed
   to  the  database.
This file is
                                      used by  ipropd-master  for
                                      changes to slaves.


                      max-request = SIZE
                           Maximum size of a kdc request.

                      require-preauth = BOOL
                           If set pre-authentication is required.
Since krb4
                           requests  are  not   pre-authenticated
they will be rejected.

                      ports = list of ports
                           List  of  ports  the kdc should listen

                      addresses = list of interfaces
                           List of addresses the kdc should  bind

                      enable-kerberos4 = BOOL
                           Turn on Kerberos 4 support.

                      v4-realm = REALM
                           To  what  realm  v4 requests should be

                      enable-524 = BOOL
                           Should the Kerberos 524 converting facility be
                           turned  on.   Default  is  the same as

                      enable-http = BOOL
                           Should  the  kdc  answer  kdc-requests
over http.

                      enable-kaserver = BOOL
                           If  this  kdc  should  emulate the AFS

                      check-ticket-addresses = BOOL
                           Verify the addresses  in  the  tickets
used in tgs requests.

                      allow-null-ticket-addresses = BOOL
                           Allow address-less tickets.

                      allow-anonymous = BOOL
                           If  the  kdc  is  allowed  to hand out
anonymous tickets.

                      encode_as_rep_as_tgs_rep = BOOL
                           Encode as-rep as tgs-rep tobe compatible with mistakes
 older DCE secd did.

                      kdc_warn_pwexpire = TIME
                           The  time  before  expiration that the
user should be
                           warned that her password is  about  to

                      logging = Logging
                           What  type  of  logging the kdc should
use, see also

                      use_2b = principal list
                           List of principals to use AFS  2b  tokens for.


                      require-preauth = BOOL
                           If  pre-authentication  is required to
talk to the
                           kadmin server.

                      default_keys = keytypes...
                           For each entry in default_keys try  to
parse it as a
                           sequence of etype:salttype:salt syntax
of this if
                           something like:


                           If  etype  is  omitted it means everything, and if
                           string is omitted it means the default
salt string
                           (for  that  principal  and  encryption
type).  Additional
 special values of keytypes are:

                                 v5   The Kerberos 5 salt pw-salt

                                 v4     The   Kerberos   4   salt

                      use_v4_salt = BOOL
                           When true, this is the same as

                           default_keys = des3:pw-salt v4

                           and is only left for backwards compatibility.

ENVIRONMENT    [Toc]    [Back]

     KRB5_CONFIG points to the configuration file to read.

EXAMPLE    [Toc]    [Back]

                   default_realm = FOO.SE
                   .foo.se = FOO.SE
                   .bar.se = FOO.SE
                   FOO.SE = {
                           kdc = kerberos.foo.se
                           v4_name_convert = {
                                   rcmd = host
                           v4_instance_convert = {
                                   xyz = xyz.bar.se
                           default_domain = foo.se
                   kdc = FILE:/var/heimdal/kdc.log
                   kdc = SYSLOG:INFO
                   default = SYSLOG:INFO:USER

DIAGNOSTICS    [Toc]    [Back]

     Since krb5.conf is read and  parsed  by  the  krb5  library,
there is not a
     lot  of  opportunities for programs to report parsing errors
in any useful
     format.  To help overcome this problem, there is a program
     verify_krb5_conf that reads krb5.conf and tries to emit useful diagnostics
  from  parsing errors.  Note that this program does not
have any way
     of knowing what options are actually used  and  thus  cannot
warn about unknown
 or misspelled ones.

SEE ALSO    [Toc]    [Back]

     kinit(1), krb5_425_conv_principal(3), krb5_openlog(3), strftime(3),

 HEIMDAL                              April       11,        1999
[ Back ]
 Similar pages
Name OS Title
krb5.conf HP-UX Kerberos configuration file
pamkrbval HP-UX validates the PAM Kerberos configuration.
krb_set_tkt_string NetBSD set Kerberos ticket cache file name
ktutil HP-UX Kerberos keytab file maintenance utility
kdestroy Tru64 Destroys valid or nonvalid Kerberos tickets and removes the cache file
amd.conf FreeBSD amd configuration file
man.conf OpenBSD configuration file for man(1)
apt.conf Linux Configuration file for APT
resolv.conf OpenBSD resolver configuration file
sensorsd.conf OpenBSD configuration file for sensorsd(8)
Copyright © 2004-2005 DeniX Solutions SRL
newsletter delivery service