| blob | 1bf95fb261c9b05ca47d01f58fd8b138f6c94e88 |
1 .\" Copyright (c) 1999 - 2005 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id$
33 .\"
34 .Dd May 4, 2005
35 .Dt KRB5.CONF 5
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm krb5.conf
39 .Nd configuration file for Kerberos 5
40 .Sh SYNOPSIS
41 .In krb5.h
42 .Sh DESCRIPTION
43 The
44 .Nm
45 file specifies several configuration parameters for the Kerberos 5
46 library, as well as for some programs.
47 .Pp
48 The file consists of one or more sections, containing a number of
49 bindings.
50 The value of each binding can be either a string or a list of other
51 bindings.
52 The grammar looks like:
53 .Bd -literal -offset indent
54 file:
55 /* empty */
56 sections
58 sections:
59 section sections
60 section
62 section:
63 '[' section_name ']' bindings
65 section_name:
66 STRING
68 bindings:
69 binding bindings
70 binding
72 binding:
73 name '=' STRING
74 name '=' '{' bindings '}'
76 name:
77 STRING
79 .Ed
80 .Li STRINGs
81 consists of one or more non-whitespace characters.
82 .Pp
83 STRINGs that are specified later in this man-page uses the following
84 notation.
85 .Bl -tag -width "xxx" -offset indent
86 .It boolean
87 values can be either yes/true or no/false.
88 .It time
89 values can be a list of year, month, day, hour, min, second.
90 Example: 1 month 2 days 30 min.
91 If no unit is given, seconds is assumed.
92 .It etypes
93 valid encryption types are: des-cbc-crc, des-cbc-md4, des-cbc-md5,
94 des3-cbc-sha1, arcfour-hmac-md5, aes128-cts-hmac-sha1-96, and
95 aes256-cts-hmac-sha1-96 .
96 .It address
97 an address can be either a IPv4 or a IPv6 address.
98 .El
99 .Pp
100 Currently recognised sections and bindings are:
101 .Bl -tag -width "xxx" -offset indent
102 .It Li [appdefaults]
103 Specifies the default values to be used for Kerberos applications.
104 You can specify defaults per application, realm, or a combination of
105 these.
106 The preference order is:
107 .Bl -enum -compact
108 .It
109 .Va application Va realm Va option
110 .It
111 .Va application Va option
112 .It
113 .Va realm Va option
114 .It
115 .Va option
116 .El
117 .Pp
118 The supported options are:
119 .Bl -tag -width "xxx" -offset indent
120 .It Li forwardable = Va boolean
121 When obtaining initial credentials, make the credentials forwardable.
122 .It Li proxiable = Va boolean
123 When obtaining initial credentials, make the credentials proxiable.
124 .It Li no-addresses = Va boolean
125 When obtaining initial credentials, request them for an empty set of
126 addresses, making the tickets valid from any address.
127 .It Li ticket_lifetime = Va time
128 Default ticket lifetime.
129 .It Li renew_lifetime = Va time
130 Default renewable ticket lifetime.
131 .It Li encrypt = Va boolean
132 Use encryption, when available.
133 .It Li forward = Va boolean
134 Forward credentials to remote host (for
135 .Xr rsh 1 ,
136 .Xr telnet 1 ,
137 etc).
138 .El
139 .It Li [libdefaults]
140 .Bl -tag -width "xxx" -offset indent
141 .It Li default_realm = Va REALM
142 Default realm to use, this is also known as your
143 .Dq local realm .
144 The default is the result of
145 .Fn krb5_get_host_realm "local hostname" .
146 .It Li allow_weak_crypto = Va boolean
147 is weaks crypto algorithms allowed to be used, among others, DES is
148 considered weak.
149 .It Li clockskew = Va time
150 Maximum time differential (in seconds) allowed when comparing
151 times.
152 Default is 300 seconds (five minutes).
153 .It Li kdc_timeout = Va time
154 Maximum time to wait for a reply from the kdc, default is 3 seconds.
155 .It Li capath = {
156 .Bl -tag -width "xxx" -offset indent
157 .It Va destination-realm Li = Va next-hop-realm
158 .It ...
159 .It Li }
160 .El
161 This is deprecated, see the
162 .Li capaths
163 section below.
164 .It Li default_cc_type = Va cctype
165 sets the default credentials type.
166 .It Li default_cc_name = Va ccname
167 the default credentials cache name.
168 If you want to change the type only use
169 .Li default_cc_type .
170 The string can contain variables that are expanded on runtime.
171 Only support variable now is
172 .Li %{uid}
173 that expands to the current user id.
174 .It Li default_etypes = Va etypes ...
175 A list of default encryption types to use. (Default: all enctypes if
176 allow_weak_crypto = TRUE, else all enctypes except single DES enctypes.)
177 .It Li default_as_etypes = Va etypes ...
178 A list of default encryption types to use in AS requests. (Default: the
179 value of default_etypes.)
180 .It Li default_tgs_etypes = Va etypes ...
181 A list of default encryption types to use in TGS requests. (Default:
182 the value of default_etypes.)
183 .It Li default_etypes_des = Va etypes ...
184 A list of default encryption types to use when requesting a DES credential.
185 .It Li default_keytab_name = Va keytab
186 The keytab to use if no other is specified, default is
187 .Dq FILE:/etc/krb5.keytab .
188 .It Li dns_lookup_kdc = Va boolean
189 Use DNS SRV records to lookup KDC services location.
190 .It Li dns_lookup_realm = Va boolean
191 Use DNS TXT records to lookup domain to realm mappings.
192 .It Li kdc_timesync = Va boolean
193 Try to keep track of the time differential between the local machine
194 and the KDC, and then compensate for that when issuing requests.
195 .It Li max_retries = Va number
196 The max number of times to try to contact each KDC.
197 .It Li large_msg_size = Va number
198 The threshold where protocols with tiny maximum message sizes are not
199 considered usable to send messages to the KDC.
200 .It Li ticket_lifetime = Va time
201 Default ticket lifetime.
202 .It Li renew_lifetime = Va time
203 Default renewable ticket lifetime.
204 .It Li forwardable = Va boolean
205 When obtaining initial credentials, make the credentials forwardable.
206 This option is also valid in the [realms] section.
207 .It Li proxiable = Va boolean
208 When obtaining initial credentials, make the credentials proxiable.
209 This option is also valid in the [realms] section.
210 .It Li verify_ap_req_nofail = Va boolean
211 If enabled, failure to verify credentials against a local key is a
212 fatal error.
213 The application has to be able to read the corresponding service key
214 for this to work.
215 Some applications, like
216 .Xr su 1 ,
217 enable this option unconditionally.
218 .It Li warn_pwexpire = Va time
219 How soon to warn for expiring password.
220 Default is seven days.
221 .It Li http_proxy = Va proxy-spec
222 A HTTP-proxy to use when talking to the KDC via HTTP.
223 .It Li dns_proxy = Va proxy-spec
224 Enable using DNS via HTTP.
225 .It Li extra_addresses = Va address ...
226 A list of addresses to get tickets for along with all local addresses.
227 .It Li time_format = Va string
228 How to print time strings in logs, this string is passed to
229 .Xr strftime 3 .
230 .It Li date_format = Va string
231 How to print date strings in logs, this string is passed to
232 .Xr strftime 3 .
233 .It Li log_utc = Va boolean
234 Write log-entries using UTC instead of your local time zone.
235 .It Li scan_interfaces = Va boolean
236 Scan all network interfaces for addresses, as opposed to simply using
237 the address associated with the system's host name.
238 .It Li fcache_version = Va int
239 Use file credential cache format version specified.
240 .It Li fcc-mit-ticketflags = Va boolean
241 Use MIT compatible format for file credential cache.
242 It's the field ticketflags that is stored in reverse bit order for
243 older than Heimdal 0.7.
244 Setting this flag to
245 .Dv TRUE
246 make it store the MIT way, this is default for Heimdal 0.7.
247 .It Li check-rd-req-server
248 If set to "ignore", the framework will ignore any the server input to
249 .Xr krb5_rd_req 3,
250 this is very useful when the GSS-API server input the
251 wrong server name into the gss_accept_sec_context call.
252 .It Li k5login_directory = Va directory
253 Alternative location for user .k5login files. This option is provided
254 for compatibility with MIT krb5 configuration files.
255 .It Li k5login_authoritative = Va boolean
256 If true then if a principal is not found in k5login files then
257 .Xr krb5_userok 3
258 will not fallback on principal to username mapping. This option is
259 provided for compatibility with MIT krb5 configuration files.
260 .It Li kuserok = Va rule ...
261 Specifies
262 .Xr krb5_userok 3
263 behavior. If multiple values are given, then
264 .Xr krb5_userok 3
265 will evaluate them in order until one succeeds or all fail. Rules are
266 implemented by plugins, with three built-in plugins
267 described below. Default: USER-K5LOGIN SIMPLE DENY.
268 .It Li kuserok = Va DENY
269 If set and evaluated then
270 .Xr krb5_userok 3
271 will deny access to the given username no matter what the principal name
272 might be.
273 .It Li kuserok = Va SIMPLE
274 If set and evaluated then
275 .Xr krb5_userok 3
276 will use principal to username mapping (see auth_to_local below). If
277 the principal maps to the requested username then access is allowed.
278 .It Li kuserok = Va SYSTEM-K5LOGIN[:directory]
279 If set and evaluated then
280 .Xr krb5_userok 3
281 will use k5login files named after the
282 .Va luser
283 argument to
284 .Xr krb5_userok 3
285 in the given directory or in
286 .Pa /etc/k5login.d/ .
287 K5login files are text files, with each line containing just a principal
288 name; principals apearing in a user's k5login file are permitted access
289 to the user's account. Note: this rule performs no ownership nor
290 permissions checks on k5login files; proper ownership and
291 permissions/ACLs are expected due to the system k5login location being a
292 system location.
293 .It Li kuserok = Va USER-K5LOGIN
294 If set and evaluated then
295 .Xr krb5_userok 3
296 will use
297 .Pa ~luser/.k5login
298 and
299 .Pa ~luser/.k5login.d/* .
300 User k5login files and directories must be owned by the user and must
301 not have world nor group write permissions.
302 .It Li aname2lname-text-db = Va filename
303 The named file must be a sorted (in increasing order) text file where
304 every line consists of an unparsed principal name optionally followed by
305 whitespace and a username. The aname2lname function will do a binary
306 search on this file, if configured, looking for lines that match the
307 given principal name, and if found the given username will be used, or,
308 if the username is missing, an error will be returned. If the file
309 doesn't exist, or if no matching line is found then other plugins will
310 be allowed to run.
311 .It Li fcache_strict_checking
312 strict checking in FILE credential caches that owner, no symlink and
313 permissions is correct.
314 .It Li name_canon_rules = Va rules
315 One or more service principal name canonicalization rules. Each rule
316 consists of one or more tokens separated by colon (':'). Currently
317 these rules are used only for hostname canonicalization (usually when
318 getting a service ticket, from a ccache or a TGS, but also when
319 acquiring GSS initiator credentials from a keytab). These rules can be
320 used to implement DNS resolver-like search lists without having to use
321 DNS.
322 .Pp
323 NOTE: Name canonicalization rules are an experimental feature.
324 .Pp
325 The first token is a rule type, one of:
326 .Va as-is,
327 .Va qualify, or
328 .Va nss.
329 .Pp
330 Any remaining tokens must be options tokens:
331 .Va use_fast
332 (use FAST to protect TGS exchanges; currently not supported),
333 .Va use_dnssec
334 (use DNSSEC to protect hostname lookups; currently not supported),
335 .Va ccache_only
336 ,
337 .Va use_referrals,
338 .Va no_referrals,
339 .Va lookup_realm,
340 .Va mindots=N,
341 .Va maxdots=N,
342 .Va order=N,
343 domain=
344 .Va domain,
345 realm=
346 .Va realm,
347 match_domain=
348 .Va domain,
349 and match_realm=
350 .Va realm.
351 .Pp
352 When trying to obtain a service ticket for a host-based service
353 principal name, name canonicalization rules are applied to that name in
354 the order given, one by one, until one succeds (a service ticket is
355 obtained), or all fail. Similarly when acquiring GSS initiator
356 credentials from a keytab, and when comparing a non-canonical GSS name
357 to a canonical one.
358 .Pp
359 For each rule the system checks that the hostname has at least
360 .Va mindots
361 periods (if given) in it, at most
362 .Va maxdots
363 periods (if given), that the hostname ends in the given
364 .Va match_domain
365 (if given),
366 and that the realm of the principal matches the
367 .Va match_realm
368 (if given).
369 .Pp
370 .Va As-is
371 rules leave the hostname unmodified but may set a realm.
372 .Va Qualify
373 rules qualify the hostname with the given
374 .Va domain
375 and also may set the realm.
376 The
377 .Va nss
378 rule uses the system resolver to lookup the host's canonical name and is
379 usually not secure. Note that using the
380 .Va nss
381 rule type implies having to have principal aliases in the HDB (though
382 not necessarily in keytabs).
383 .Pp
384 The empty realm denotes "ask the client's realm's TGS". The empty realm
385 may be set as well as matched.
386 .Pp
387 The order in which rules are applied is as follows: first all the rules
388 with explicit
389 .Va order
390 then all other rules in the order in which they appear. If any two
391 rules have the same explicit
392 .Va order
393 their order of appearance in krb5.conf breaks the tie. Explicitly
394 specifying order can be useful where tools read and write the
395 configuration file without preserving parameter order.
396 .Pp
397 Malformed rules are ignored.
398 .El
399 .It Li [domain_realm]
400 This is a list of mappings from DNS domain to Kerberos realm.
401 Each binding in this section looks like:
402 .Pp
403 .Dl domain = realm
404 .Pp
405 The domain can be either a full name of a host or a trailing
406 component, in the latter case the domain-string should start with a
407 period.
408 The trailing component only matches hosts that are in the same domain, ie
409 .Dq .example.com
410 matches
411 .Dq foo.example.com ,
412 but not
413 .Dq foo.test.example.com .
414 .Pp
415 The realm may be the token `dns_locate', in which case the actual
416 realm will be determined using DNS (independently of the setting
417 of the `dns_lookup_realm' option).
418 .It Li [realms]
419 .Bl -tag -width "xxx" -offset indent
420 .It Va REALM Li = {
421 .Bl -tag -width "xxx" -offset indent
422 .It Li kdc = Va [service/]host[:port]
423 Specifies a list of kdcs for this realm.
424 If the optional
425 .Va port
426 is absent, the
427 default value for the
428 .Dq kerberos/udp
429 .Dq kerberos/tcp ,
430 and
431 .Dq http/tcp
432 port (depending on service) will be used.
433 The kdcs will be used in the order that they are specified.
434 .Pp
435 The optional
436 .Va service
437 specifies over what medium the kdc should be
438 contacted.
439 Possible services are
440 .Dq udp ,
441 .Dq tcp ,
442 and
443 .Dq http .
444 Http can also be written as
445 .Dq http:// .
446 Default service is
447 .Dq udp
448 and
449 .Dq tcp .
450 .It Li admin_server = Va host[:port]
451 Specifies the admin server for this realm, where all the modifications
452 to the database are performed.
453 .It Li kpasswd_server = Va host[:port]
454 Points to the server where all the password changes are performed.
455 If there is no such entry, the kpasswd port on the admin_server host
456 will be tried.
457 .It Li tgs_require_subkey
458 a boolan variable that defaults to false.
459 Old DCE secd (pre 1.1) might need this to be true.
460 .It Li auth_to_local_names = {
461 .Bl -tag -width "xxx" -offset indent
462 .It Va principal_name = Va username
463 The given
464 .Va principal_name
465 will be mapped to the given
466 .Va username
467 if the
468 .Va REALM
469 is a default realm.
470 .El
471 .It Li }
472 .It Li auth_to_local = HEIMDAL_DEFAULT
473 Use the Heimdal default principal to username mapping.
474 Applies to principals from the
475 .Va REALM
476 if and only if
477 .Va REALM
478 is a default realm.
479 .It Li auth_to_local = DEFAULT
480 Use the MIT default principal to username mapping.
481 Applies to principals from the
482 .Va REALM
483 if and only if
484 .Va REALM
485 is a default realm.
486 .It Li auth_to_local = DB:/path/to/db.txt
487 Use a binary search of the given DB. The DB must be a flat-text
488 file sortedf in the "C" locale, with each record being a line
489 (separated by either LF or CRLF) consisting of a principal name
490 followed by whitespace followed by a username.
491 Applies to principals from the
492 .Va REALM
493 if and only if
494 .Va REALM
495 is a default realm.
496 .It Li auth_to_local = DB:/path/to/db
497 Use the given DB, if there's a plugin for it.
498 Applies to principals from the
499 .Va REALM
500 if and only if
501 .Va REALM
502 is a default realm.
503 .It Li auth_to_local = RULE:...
504 Use the given rule, if there's a plugin for it.
505 Applies to principals from the
506 .Va REALM
507 if and only if
508 .Va REALM
509 is a default realm.
510 .It Li auth_to_local = NONE
511 No additional principal to username mapping is done. Note that
512 .Va auth_to_local_names
513 and any preceding
514 .Va auth_to_local
515 rules have precedence.
516 .El
517 .It Li }
518 .El
519 .It Li [capaths]
520 .Bl -tag -width "xxx" -offset indent
521 .It Va client-realm Li = {
522 .Bl -tag -width "xxx" -offset indent
523 .It Va server-realm Li = Va hop-realm ...
524 This serves two purposes. First the first listed
525 .Va hop-realm
526 tells a client which realm it should contact in order to ultimately
527 obtain credentials for a service in the
528 .Va server-realm .
529 Secondly, it tells the KDC (and other servers) which realms are
530 allowed in a multi-hop traversal from
531 .Va client-realm
532 to
533 .Va server-realm .
534 Except for the client case, the order of the realms are not important.
535 .El
536 .It Va }
537 .El
538 .It Li [logging]
539 .Bl -tag -width "xxx" -offset indent
540 .It Va entity Li = Va destination
541 Specifies that
542 .Va entity
543 should use the specified
544 .Li destination
545 for logging.
546 See the
547 .Xr krb5_openlog 3
548 manual page for a list of defined destinations.
549 .El
550 .It Li [kdc]
551 .Bl -tag -width "xxx" -offset indent
552 .It Li database Li = {
553 .Bl -tag -width "xxx" -offset indent
554 .It Li dbname Li = Va DATABASENAME
555 Use this database for this realm.
556 See the info documetation how to configure different database backends.
557 .It Li realm Li = Va REALM
558 Specifies the realm that will be stored in this database.
559 It realm isn't set, it will used as the default database, there can
560 only be one entry that doesn't have a
561 .Li realm
562 stanza.
563 .It Li mkey_file Li = Pa FILENAME
564 Use this keytab file for the master key of this database.
565 If not specified
566 .Va DATABASENAME Ns .mkey
567 will be used.
568 .It Li acl_file Li = PA FILENAME
569 Use this file for the ACL list of this database.
570 .It Li log_file Li = Pa FILENAME
571 Use this file as the log of changes performed to the database.
572 This file is used by
573 .Nm ipropd-master
574 for propagating changes to slaves.
575 .El
576 .It Li }
577 .It Li max-request = Va SIZE
578 Maximum size of a kdc request.
579 .It Li require-preauth = Va BOOL
580 If set pre-authentication is required.
581 .It Li ports = Va "list of ports"
582 List of ports the kdc should listen to.
583 .It Li addresses = Va "list of interfaces"
584 List of addresses the kdc should bind to.
585 .It Li enable-http = Va BOOL
586 Should the kdc answer kdc-requests over http.
587 .It Li tgt-use-strongest-session-key = Va BOOL
588 If this is TRUE then the KDC will prefer the strongest key from the
589 client's AS-REQ or TGS-REQ enctype list for the ticket session key that
590 is supported by the KDC and the target principal when the target
591 principal is a krbtgt principal. Else it will prefer the first key from
592 the client's AS-REQ enctype list that is also supported by the KDC and
593 the target principal. Defaults to FALSE.
594 .It Li svc-use-strongest-session-key = Va BOOL
595 Like tgt-use-strongest-session-key, but applies to the session key
596 enctype of tickets for services other than krbtgt principals. Defaults
597 to FALSE.
598 .It Li preauth-use-strongest-session-key = Va BOOL
599 If TRUE then select the strongest possible enctype from the client's
600 AS-REQ for PA-ETYPE-INFO2 (i.e., for password-based pre-authentication).
601 Else pick the first supported enctype from the client's AS-REQ. Defaults
602 to FALSE.
603 .It Li use-strongest-server-key = Va BOOL
604 If TRUE then the KDC picks, for the ticket encrypted part's key, the
605 first supported enctype from the target service principal's hdb entry's
606 current keyset. Else the KDC picks the first supported enctype from the
607 target service principal's hdb entry's current keyset. Defaults to TRUE.
608 .It Li check-ticket-addresses = Va BOOL
609 Verify the addresses in the tickets used in tgs requests.
610 .\" XXX
611 .It Li allow-null-ticket-addresses = Va BOOL
612 Allow address-less tickets.
613 .\" XXX
614 .It Li allow-anonymous = Va BOOL
615 If the kdc is allowed to hand out anonymous tickets.
616 .It Li encode_as_rep_as_tgs_rep = Va BOOL
617 Encode as-rep as tgs-rep tobe compatible with mistakes older DCE secd did.
618 .\" XXX
619 .It Li kdc_warn_pwexpire = Va TIME
620 The time before expiration that the user should be warned that her
621 password is about to expire.
622 .It Li logging = Va Logging
623 What type of logging the kdc should use, see also [logging]/kdc.
624 .It Li hdb-ldap-structural-object Va structural object
625 If the LDAP backend is used for storing principals, this is the
626 structural object that will be used when creating and when reading
627 objects.
628 The default value is account .
629 .It Li hdb-ldap-create-base Va creation dn
630 is the dn that will be appended to the principal when creating entries.
631 Default value is the search dn.
632 .It Li enable-digest = Va BOOL
633 Should the kdc answer digest requests. The default is FALSE.
634 .It Li digests_allowed = Va list of digests
635 Specifies the digests the kdc will reply to. The default is
636 .Li ntlm-v2 .
637 .It Li kx509_ca = Va file
638 Specifies the PEM credentials for the kx509 certification authority.
639 .It Li require_initial_kca_tickets = Va boolean
640 Specified whether to require that tickets for the
641 .Li kca_service
642 service principal be INITIAL.
643 This may be set on a per-realm basis as well as globally.
644 Defaults to true for the global setting.
645 .It Li kx509_include_pkinit_san = Va boolean
646 If true then the kx509 client principal's name and realm will be
647 included in an
648 .Li id-pkinit-san
649 certificate extension.
650 This can be set on a per-realm basis as well as globally.
651 Defaults to true for the global setting.
652 .It Li kx509_template = Va file
653 Specifies the PEM file with a template for the certificates to be
654 issued.
655 The following variables can be interpolated in the subject name using
656 ${variable} syntax:
657 .Bl -tag -width "xxx" -offset indent
658 .It principal-name
659 The full name of the kx509 client principal.
660 .It principal-name-without-realm
661 The full name of the kx509 client principal, excluding the realm name.
662 .It principal-name-realm
663 The name of the client principal's realm.
664 .El
665 .El
666 The
667 .Li kx509 ,
668 .Li kx509_template ,
669 .Li kx509_include_pkinit_san ,
670 and
671 .Li require_initial_kca_tickets
672 parameters may be set on a per-realm basis as well.
673 .It Li [kadmin]
674 .Bl -tag -width "xxx" -offset indent
675 .It Li password_lifetime = Va time
676 If a principal already have its password set for expiration, this is
677 the time it will be valid for after a change.
678 .It Li default_keys = Va keytypes...
679 For each entry in
680 .Va default_keys
681 try to parse it as a sequence of
682 .Va etype:salttype:salt
683 syntax of this if something like:
684 .Pp
685 [(des|des3|etype):](pw-salt|afs3-salt)[:string]
686 .Pp
687 If
688 .Ar etype
689 is omitted it means everything, and if string is omitted it means the
690 default salt string (for that principal and encryption type).
691 Additional special values of keytypes are:
692 .Bl -tag -width "xxx" -offset indent
693 .It Li v5
694 The Kerberos 5 salt
695 .Va pw-salt
696 .El
697 .It Li default_key_rules = Va {
698 .Bl -tag -width "xxx" -offset indent
699 .It Va globing-rule Li = Va keytypes...
700 a globbing rule to matching a principal, and when true, use the
701 keytypes as specified the same format as [kadmin]default_keys .
702 .El
703 .It Li }
704 .El
705 .It Li use_v4_salt = Va BOOL
706 When true, this is the same as
707 .Pp
708 .Va default_keys = Va des3:pw-salt Va v4
709 .Pp
710 and is only left for backwards compatibility.
711 .It Li [password_quality]
712 Check the Password quality assurance in the info documentation for
713 more information.
714 .Bl -tag -width "xxx" -offset indent
715 .It Li check_library = Va library-name
716 Library name that contains the password check_function
717 .It Li check_function = Va function-name
718 Function name for checking passwords in check_library
719 .It Li policy_libraries = Va library1 ... libraryN
720 List of libraries that can do password policy checks
721 .It Li policies = Va policy1 ... policyN
722 List of policy names to apply to the password. Builtin policies are
723 among other minimum-length, character-class, external-check.
724 .El
725 .El
726 .Sh ENVIRONMENT
727 .Ev KRB5_CONFIG
728 points to the configuration file to read.
729 .Sh FILES
730 .Bl -tag -width "/etc/krb5.conf"
731 .It Pa /etc/krb5.conf
732 configuration file for Kerberos 5.
733 .El
734 .Sh EXAMPLES
735 .Bd -literal -offset indent
736 [libdefaults]
737 default_realm = FOO.SE
738 name_canon_rules = as-is:realm=FOO.SE
739 name_canon_rules = qualify:domain=foo.se:realm=FOO.SE
740 name_canon_rules = qualify:domain=bar.se:realm=FOO.SE
741 name_canon_rules = nss
742 [domain_realm]
743 .foo.se = FOO.SE
744 .bar.se = FOO.SE
745 [realms]
746 FOO.SE = {
747 kdc = kerberos.foo.se
748 default_domain = foo.se
749 }
750 [logging]
751 kdc = FILE:/var/heimdal/kdc.log
752 kdc = SYSLOG:INFO
753 default = SYSLOG:INFO:USER
754 [kadmin]
755 default_key_rules = {
756 */ppp@* = arcfour-hmac-md5:pw-salt
757 }
758 .Ed
759 .Sh DIAGNOSTICS
760 Since
761 .Nm
762 is read and parsed by the krb5 library, there is not a lot of
763 opportunities for programs to report parsing errors in any useful
764 format.
765 To help overcome this problem, there is a program
766 .Nm verify_krb5_conf
767 that reads
768 .Nm
769 and tries to emit useful diagnostics from parsing errors.
770 Note that this program does not have any way of knowing what options
771 are actually used and thus cannot warn about unknown or misspelled
772 ones.
773 .Sh SEE ALSO
774 .Xr kinit 1 ,
775 .Xr krb5_openlog 3 ,
776 .Xr strftime 3 ,
777 .Xr verify_krb5_conf 8