| blob | d1c280faac3309e66e127a1b2c7c667020953979 |
1 .\" $Id$
2 .\"
3 .Dd August 22, 2002
4 .Dt KDC 8
5 .Os HEIMDAL
6 .Sh NAME
7 .Nm kdc
8 .Nd Kerberos 5 server
9 .Sh SYNOPSIS
10 .Nm
11 .Oo Fl c Ar file \*(Ba Xo
12 .Fl -config-file= Ns Ar file
13 .Xc
14 .Oc
15 .Op Fl p | Fl -no-require-preauth
16 .Op Fl -max-request= Ns Ar size
17 .Op Fl H | Fl -enable-http
18 .Op Fl -no-524
19 .Op Fl -kerberos4
20 .Op Fl -kerberos4-cross-realm
21 .Oo Fl r Ar string \*(Ba Xo
22 .Fl -v4-realm= Ns Ar string
23 .Xc
24 .Oc
25 .Op Fl K | Fl -kaserver
26 .Oo Fl P Ar portspec \*(Ba Xo
27 .Fl -ports= Ns Ar portspec
28 .Xc
29 .Oc
30 .Op Fl -detach
31 .Op Fl -addresses= Ns Ar list of addresses
32 .Sh DESCRIPTION
33 .Nm
34 serves requests for tickets. When it starts, it first checks the flags
35 passed, any options that are not specified with a command line flag is
36 taken from a config file, or from a default compiled-in value.
37 .Pp
38 Options supported:
39 .Bl -tag -width Ds
40 .It Xo
41 .Fl c Ar file ,
42 .Fl -config-file= Ns Ar file
43 .Xc
44 Specifies the location of the config file, the default is
45 .Pa /var/heimdal/kdc.conf .
46 This is the only value that can't be specified in the config file.
47 .It Xo
48 .Fl p ,
49 .Fl -no-require-preauth
50 .Xc
51 Turn off the requirement for pre-autentication in the initial AS-REQ
52 for all principals. The use of pre-authentication makes it more
53 difficult to do offline password attacks. You might want to turn it
54 off if you have clients that doesn't do pre-authentication. Since the
55 version 4 protocol doesn't support any pre-authentication, so serving
56 version 4 clients is just about the same as not requiring
57 pre-athentication. The default is to require
58 pre-authentication. Adding the require-preauth per principal is a more
59 flexible way of handling this.
60 .It Xo
61 .Fl -max-request= Ns Ar size
62 .Xc
63 Gives an upper limit on the size of the requests that the kdc is
64 willing to handle.
65 .It Xo
66 .Fl H ,
67 .Fl -enable-http
68 .Xc
69 Makes the kdc listen on port 80 and handle requests encapsulated in HTTP.
70 .It Xo
71 .Fl -no-524
72 .Xc
73 don't respond to 524 requests
74 .It Xo
75 .Fl -kerberos4
76 .Xc
77 respond to kerberos 4 requests
78 .It Xo
79 .Fl -kerberos4-cross-realm
80 .Xc
81 respond to kerberos 4 requests from foreign realms.
82 This is a known security hole and should not be enabled unless you
83 understand the consequences and are willing to live with them.
84 .It Xo
85 .Fl r Ar string ,
86 .Fl -v4-realm= Ns Ar string
87 .Xc
88 What realm this server should act as when dealing with version 4
89 requests. The database can contain any number of realms, but since the
90 version 4 protocol doesn't contain a realm for the server, it must be
91 explicitly specified. The default is whatever is returned by
92 .Fn krb_get_lrealm .
93 This option is only availabe if the KDC has been compiled with version
94 4 support.
95 .It Xo
96 .Fl K ,
97 .Fl -kaserver
98 .Xc
99 Enable kaserver emulation (in case it's compiled in).
100 .It Xo
101 .Fl P Ar portspec ,
102 .Fl -ports= Ns Ar portspec
103 .Xc
104 Specifies the set of ports the KDC should listen on.
105 It is given as a
106 white-space separated list of services or port numbers.
107 .It Fl -addresses= Ns Ar list of addresses
108 The list of addresses to listen for requests on. By default, the kdc
109 will listen on all the locally configured addresses. If only a subset
110 is desired, or the automatic detection fails, this option might be used.
111 .El
112 .Pp
113 All activities , are logged to one or more destinations, see
114 .Xr krb5.conf 5 ,
115 and
116 .Xr krb5_openlog 3 .
117 The entity used for logging is
118 .Nm kdc .
119 .Sh CONFIGURATION FILE
120 The configuration file has the same syntax as
121 .Xr krb5.conf 5 ,
122 but will be read before
123 .Pa /etc/krb5.conf ,
124 so it may override settings found there. Options specific to the KDC
125 only are found in the
126 .Dq [kdc]
127 section.
128 All the command-line options can preferably be added in the
129 configuration file. The only difference is the pre-authentication flag,
130 that has to be specified as:
131 .Pp
132 .Dl require-preauth = no
133 .Pp
134 (in fact you can specify the option as
135 .Fl -require-preauth=no ) .
136 .Pp
137 And there are some configuration options which do not have
138 command-line equivalents:
139 .Bl -tag -width "xxx" -offset indent
140 .It Li check-ticket-addresses = Va boolean
141 Check the addresses in the ticket when processing TGS requests. The
142 default is FALSE.
143 .It Li allow-null-ticket-addresses = Va boolean
144 Permit tickets with no addresses. This option is only relevant when
145 check-ticket-addresses is TRUE.
146 .It Li allow-anonymous = Va boolean
147 Permit anonymous tickets with no addresses.
148 .It encode_as_rep_as_tgs_rep = Va boolean
149 Encode AS-Rep as TGS-Rep to be bug-compatible with old DCE code. The
150 Heimdal clients allow both.
151 .It kdc_warn_pwexpire = Va time
152 How long before password/principal expiration the KDC should start
153 sending out warning messages.
154 .El
155 .Pp
156 An example of a config file:
157 .Bd -literal -offset indent
158 [kdc]
159 require-preauth = no
160 v4-realm = FOO.SE
161 key-file = /key-file
162 .Ed
163 .Sh BUGS
164 If the machine running the KDC has new addresses added to it, the KDC
165 will have to be restarted to listen to them. The reason it doesn't
166 just listen to wildcarded (like INADDR_ANY) addresses, is that the
167 replies has to come from the same address they were sent to, and most
168 OS:es doesn't pass this information to the application. If your normal
169 mode of operation require that you add and remove addresses, the best
170 option is probably to listen to a wildcarded TCP socket, and make sure
171 your clients use TCP to connect. For instance, this will listen to
172 IPv4 TCP port 88 only:
173 .Bd -literal -offset indent
174 kdc --addresses=0.0.0.0 --ports="88/tcp"
175 .Ed
176 .Pp
177 There should be a way to specify protocol, port, and address triplets,
178 not just addresses and protocol, port tuples.
179 .Sh SEE ALSO
180 .Xr kinit 1 ,
181 .Xr krb5.conf 5