Open Source Kerberos Tooling

NAME

krb5_admind.conf - configuration file for krb5_admind(8)

SYNOPSIS

krb5_admind.conf

DESCRIPTION

krb5_admind.conf is the configuration file for krb5_admind(8). The syntax is a Perl snippet which is evaluated and is expected to set the following variables:

$allow_fetch

is a boolean value which indicates whether krb5_admind(8) is willing to allow clients to directly fetch keys from the Kerberos database. Setting this to true may be necessary at some sites but is generally discouraged as it reduces certain security guarantees. Also see krb5_keytab(8)'s configuration variable $use_fetch. This value defaults to false.

$allow_fetch_old

is a boolean value which indicates whether krb5_admind(8) is willing to allow clients to directly fetch old keys from the Kerberos database. Old keys are those whose version number is smaller than the highest key version number. This makes it possible to recover keys for outstanding tickets after creating a new key. Key recovery makes possible decryption of past traffic, and if possible should not be enabled. This value defaults to false.

$enable_host_subdomain

is a boolean variable that if true allows hosts to manage keys for services whose instance is a direct subdomain of the host. This supports multiple service namespaces on the same machine provided the subdomains all map to the same address (as with e.g. a wildcard *.hostname A record).

%xrealm_bootstrap

is a hash which has keys that are Kerberos realms with values that are an array ref of Kerberos realms. If a host authenticates to krb5_admind(8) with a host principal in the key's realm then it will be authenticated to retrieve Kerberos host principals with a matching hostname in any of the realms listed in the value. E.g.

        %xrealm_bootstrap = (
                'REALM1'  => ['REALM2', 'REALM3'],
        );

means that host/foo@REALM1 can retrieve keys for host/foo@REALM2 and host/foo@REALM3.

%win_xrealm_bootstrap

is a hash that maps a Windows principal to a list of host principals which it may retrieve. The Windows principal's components must be lower case. This hash can be used when migrating from using Windows Active Directory to provide Kerberos for UNIX hosts to a strictly UNIX KDC framework.

%prestash_xrealm

is a hash that maps a principal's realm to a list of realms on which the principal is allowed to be prestashed. E.g.

        %prestash_xrealm = (
                'REALM1' => ['REALM2', 'REALM3'],
        );

means that principals in REALM1 may be prestashed on hosts that are in REALM2 or REALM3.

Syntax errors will terminate parsing causing all subsequent configuration to be ignored and so it is critical that they not be present.

SEE ALSO

krb5_admind(8).

AUTHORS

krb5_admind.conf was written by Roland C. Dowdeswell.