1 .\" Copyright (c) 2003 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32 .\" $Id: kdc.8,v 1.23.2.1 2003/10/21 20:06:01 lha Exp $
42 .Oo Fl c Ar file \*(Ba Xo
43 .Fl -config-file= Ns Ar file
46 .Op Fl p | Fl -no-require-preauth
47 .Op Fl -max-request= Ns Ar size
48 .Op Fl H | Fl -enable-http
51 .Op Fl -kerberos4-cross-realm
52 .Oo Fl r Ar string \*(Ba Xo
53 .Fl -v4-realm= Ns Ar string
56 .Op Fl K | Fl -kaserver
57 .Oo Fl P Ar portspec \*(Ba Xo
58 .Fl -ports= Ns Ar portspec
62 .Op Fl -addresses= Ns Ar list of addresses
65 serves requests for tickets.
66 When it starts, it first checks the flags passed, any options that are
67 not specified with a command line flag are taken from a config file,
68 or from a default compiled-in value.
74 .Fl -config-file= Ns Ar file
76 Specifies the location of the config file, the default is
77 .Pa /var/heimdal/kdc.conf .
78 This is the only value that can't be specified in the config file.
81 .Fl -no-require-preauth
83 Turn off the requirement for pre-autentication in the initial AS-REQ
85 The use of pre-authentication makes it more difficult to do offline
87 You might want to turn it off if you have clients
88 that don't support pre-authentication.
89 Since the version 4 protocol doesn't support any pre-authentication,
90 serving version 4 clients is just about the same as not requiring
92 The default is to require pre-authentication.
93 Adding the require-preauth per principal is a more flexible way of
96 .Fl -max-request= Ns Ar size
98 Gives an upper limit on the size of the requests that the kdc is
104 Makes the kdc listen on port 80 and handle requests encapsulated in HTTP.
108 don't respond to 524 requests
112 respond to Kerberos 4 requests
114 .Fl -kerberos4-cross-realm
116 respond to Kerberos 4 requests from foreign realms.
117 This is a known security hole and should not be enabled unless you
118 understand the consequences and are willing to live with them.
121 .Fl -v4-realm= Ns Ar string
123 What realm this server should act as when dealing with version 4
125 The database can contain any number of realms, but since the version 4
126 protocol doesn't contain a realm for the server, it must be explicitly
128 The default is whatever is returned by
130 This option is only availabe if the KDC has been compiled with version
136 Enable kaserver emulation (in case it's compiled in).
139 .Fl -ports= Ns Ar portspec
141 Specifies the set of ports the KDC should listen on.
143 white-space separated list of services or port numbers.
144 .It Fl -addresses= Ns Ar list of addresses
145 The list of addresses to listen for requests on.
146 By default, the kdc will listen on all the locally configured
148 If only a subset is desired, or the automatic detection fails, this
149 option might be used.
152 All activities are logged to one or more destinations, see
156 The entity used for logging is
158 .Sh CONFIGURATION FILE
159 The configuration file has the same syntax as
161 but will be read before
163 so it may override settings found there.
164 Options specific to the KDC only are found in the
167 All the command-line options can preferably be added in the
169 The only difference is the pre-authentication flag, which has to be
172 .Dl require-preauth = no
174 (in fact you can specify the option as
175 .Fl -require-preauth=no ) .
177 And there are some configuration options which do not have
178 command-line equivalents:
179 .Bl -tag -width "xxx" -offset indent
180 .It Li check-ticket-addresses = Va boolean
181 Check the addresses in the ticket when processing TGS requests.
182 The default is FALSE.
183 .It Li allow-null-ticket-addresses = Va boolean
184 Permit tickets with no addresses.
185 This option is only relevant when check-ticket-addresses is TRUE.
186 .It Li allow-anonymous = Va boolean
187 Permit anonymous tickets with no addresses.
188 .It Li enforce-transited-policy = Va boolean
189 Always verify the transited policy, ignoring the
190 .Va disable-transited-check
191 flag if set in the KDC client request.
192 .It encode_as_rep_as_tgs_rep = Va boolean
193 Encode AS-Rep as TGS-Rep to be bug-compatible with old DCE code.
194 The Heimdal clients allow both.
195 .It kdc_warn_pwexpire = Va time
196 How long before password/principal expiration the KDC should start
197 sending out warning messages.
200 The configuration file is only read when the
203 If changes made to the configuration file are to take effect, the
205 needs to be restarted.
207 An example of a config file:
208 .Bd -literal -offset indent
215 If the machine running the KDC has new addresses added to it, the KDC
216 will have to be restarted to listen to them.
217 The reason it doesn't just listen to wildcarded (like INADDR_ANY)
218 addresses, is that the replies has to come from the same address they
219 were sent to, and most OS:es doesn't pass this information to the
221 If your normal mode of operation require that you add and remove
222 addresses, the best option is probably to listen to a wildcarded TCP
223 socket, and make sure your clients use TCP to connect.
224 For instance, this will listen to IPv4 TCP port 88 only:
225 .Bd -literal -offset indent
226 kdc --addresses=0.0.0.0 --ports="88/tcp"
229 There should be a way to specify protocol, port, and address triplets,
230 not just addresses and protocol, port tuples.