| blob | 076039dfef0a031b9456b05c720c29daa209e249 |
1 '\" te
2 .\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH KRB5.CONF 4 "Nov 26, 2017"
7 .SH NAME
8 krb5.conf \- Kerberos configuration file
9 .SH SYNOPSIS
10 .LP
11 .nf
12 /etc/krb5/krb5.conf
13 .fi
15 .SH DESCRIPTION
16 .LP
17 The \fBkrb5.conf\fR file contains Kerberos configuration information, including
18 the locations of \fBKDC\fRs and administration daemons for the Kerberos realms
19 of interest, defaults for the current realm and for Kerberos applications, and
20 mappings of host names onto Kerberos realms. This file must reside on all
21 Kerberos clients.
22 .sp
23 .LP
24 The format of the \fBkrb5.conf\fR consists of sections headings in square
25 brackets. Each section can contain zero or more configuration variables (called
26 \fIrelations\fR), of the form:
27 .sp
28 .LP
29 \fIrelation\fR= \fIrelation-value\fR
30 .sp
31 .LP
32 or
33 .sp
34 .LP
35 \fIrelation-subsection\fR = {
36 .br
37 .in +2
38 \fIrelation\fR= \fIrelation-value\fR
39 .in -2
40 .br
41 .in +2
42 \fIrelation\fR= \fIrelation-value\fR
43 .in -2
44 .sp
45 .LP
46 }
47 .sp
48 .LP
49 The \fBkrb5.conf\fR file can contain any or all of the following sections:
50 .sp
51 .ne 2
52 .na
53 \fB\fBlibdefaults\fR\fR
54 .ad
55 .sp .6
56 .RS 4n
57 Contains default values used by the Kerberos V5 library.
58 .RE
60 .sp
61 .ne 2
62 .na
63 \fB\fBappdefaults\fR\fR
64 .ad
65 .sp .6
66 .RS 4n
67 Contains subsections for Kerberos V5 applications, where
68 \fIrelation-subsection\fR is the name of an application. Each subsection
69 describes application-specific defaults.
70 .RE
72 .sp
73 .ne 2
74 .na
75 \fB\fBrealms\fR\fR
76 .ad
77 .sp .6
78 .RS 4n
79 Contains subsections for Kerberos realms, where \fIrelation-subsection\fR is
80 the name of a realm. Each subsection contains relations that define the
81 properties for that particular realm.
82 .RE
84 .sp
85 .ne 2
86 .na
87 \fB\fBdomain_realm\fR\fR
88 .ad
89 .sp .6
90 .RS 4n
91 Contains relations which map domain names and subdomains onto Kerberos realm
92 names. This is used by programs to determine what realm a host should be in,
93 given its fully qualified domain name.
94 .RE
96 .sp
97 .ne 2
98 .na
99 \fB\fBlogging\fR\fR
100 .ad
101 .sp .6
102 .RS 4n
103 Contains relations which determine how Kerberos programs are to perform
104 logging.
105 .RE
107 .sp
108 .ne 2
109 .na
110 \fB\fBcapaths\fR\fR
111 .ad
112 .sp .6
113 .RS 4n
114 Contains the authentication paths used with direct (nonhierarchical)
115 cross-realm authentication. Entries in this section are used by the client to
116 determine the intermediate realms which can be used in cross-realm
117 authentication. It is also used by the end-service when checking the transited
118 field for trusted intermediate realms.
119 .RE
121 .sp
122 .ne 2
123 .na
124 \fB\fBdbmodules\fR\fR
125 .ad
126 .sp .6
127 .RS 4n
128 Contains relations for Kerberos database plug-in-specific configuration
129 information.
130 .RE
132 .sp
133 .ne 2
134 .na
135 \fB\fBkdc\fR\fR
136 .ad
137 .sp .6
138 .RS 4n
139 For a Key Distribution Center (\fBKDC\fR), can contain the location of the
140 \fBkdc.conf\fR file.
141 .RE
143 .SS "The \fB[libdefaults]\fR Section"
144 .LP
145 The \fB[libdefaults]\fR section can contain any of the following relations:
146 .sp
147 .ne 2
148 .na
149 \fB\fBdatabase_module\fR\fR
150 .ad
151 .sp .6
152 .RS 4n
153 Selects the \fBdbmodule\fR section entry to use to access the Kerberos
154 database. If this parameter is not present the code uses the standard
155 \fBdb2\fR-based Kerberos database.
156 .RE
158 .sp
159 .ne 2
160 .na
161 \fB\fBdefault_keytab_name\fR\fR
162 .ad
163 .sp .6
164 .RS 4n
165 Specifies the default keytab name to be used by application servers such as
166 \fBtelnetd\fR and \fBrlogind\fR. The default is \fB/etc/krb5/krb5.keytab\fR.
167 .RE
169 .sp
170 .ne 2
171 .na
172 \fB\fBdefault_realm\fR\fR
173 .ad
174 .sp .6
175 .RS 4n
176 Identifies the default Kerberos realm for the client. Set its value to your
177 Kerberos realm.
178 .RE
180 .sp
181 .ne 2
182 .na
183 \fB\fBdefault_tgs_enctypes\fR\fR
184 .ad
185 .sp .6
186 .RS 4n
187 Identifies the supported list of session key encryption types that should be
188 returned by the \fBKDC\fR. The list can be delimited with commas or whitespace.
189 The supported encryption types are \fBdes3-cbc-sha1-kd\fR, \fBdes-cbc-crc\fR,
190 \fBdes-cbc-md5\fR, \fBarcfour-hmac-md5\fR, \fBarcfour-hmac-md5-exp\fR,
191 \fBaes128-cts-hmac-sha1-96\fR, and \fBaes256-cts-hmac-sha1-96\fR.
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fBdefault_tkt_enctypes\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 Identifies the supported list of session key encryption types that should be
202 requested by the client. The format is the same as for
203 \fBdefault_tgs_enctypes\fR. The supported encryption types are
204 \fBdes3-cbc-sha1-kd\fR, \fBdes-cbc-crc\fR, \fBdes-cbc-md5\fR,
205 \fBarcfour-hmac-md5\fR, \fBarcfour-hmac-md5-exp\fR,
206 \fBaes128-cts-hmac-sha1-96\fR, and \fBaes256-cts-hmac-sha1-96\fR.
207 .RE
209 .sp
210 .ne 2
211 .na
212 \fB\fBclockskew\fR\fR
213 .ad
214 .sp .6
215 .RS 4n
216 Sets the maximum allowable amount of clock skew in seconds that the library
217 tolerates before assuming that a Kerberos message is invalid. The default value
218 is 300 seconds, or five minutes.
219 .RE
221 .sp
222 .ne 2
223 .na
224 \fB\fBforwardable =\fR [\fBtrue\fR | \fBfalse\fR]\fR
225 .ad
226 .sp .6
227 .RS 4n
228 Sets the "\fBforwardable\fR" flag in all tickets. This allows users to transfer
229 their credentials from one host to another without reauthenticating. This
230 option can also be set in the \fB[appdefaults]\fR or \fB[realms]\fR section
231 (see below) to limit its use in particular applications or just to a specific
232 realm.
233 .RE
235 .sp
236 .ne 2
237 .na
238 \fB\fBpermitted_enctypes\fR\fR
239 .ad
240 .sp .6
241 .RS 4n
242 This relation controls the encryption types for session keys permitted by
243 server applications that use Kerberos for authentication. In addition, it
244 controls the encryption types of keys added to a \fBkeytab\fR by means of the
245 \fBkadmin\fR(8) \fBktadd\fR command. The default is:
246 \fBaes256-cts-hmac-sha1-96\fR, \fBaes128-cts-hmac-sha1-96\fR,
247 \fBdes3-hmac-sha1-kd\fR, \fBarcfour-hmac-md5\fR, \fBarcfour-hmac-md5-exp\fR,
248 \fBdes-cbc-md5\fR, \fBdes-cbc-crc\fR.
249 .RE
251 .sp
252 .ne 2
253 .na
254 \fB\fBproxiable =\fR [\fBtrue\fR | \fBfalse\fR]\fR
255 .ad
256 .sp .6
257 .RS 4n
258 Sets the \fBproxiable\fR flag in all tickets. This allows users to create a
259 proxy ticket that can be transferred to a kerberized service to allow that
260 service to perform some function on behalf of the original user. This option
261 can also be set in the \fB[appdefaults]\fR or \fB[realms]\fR section (see
262 below) to limit its use in particular applications or just to a specific realm.
263 .RE
265 .sp
266 .ne 2
267 .na
268 \fB\fBrenew_lifetime =\fR\fIlifetime\fR\fR
269 .ad
270 .sp .6
271 .RS 4n
272 Requests renewable tickets, with a total lifetime of \fIlifetime\fR. The value
273 for \fIlifetime\fR must be followed immediately by one of the following
274 delimiters:
275 .sp
276 .ne 2
277 .na
278 \fB\fBs\fR\fR
279 .ad
280 .sp .6
281 .RS 4n
282 seconds
283 .RE
285 .sp
286 .ne 2
287 .na
288 \fB\fBm\fR\fR
289 .ad
290 .sp .6
291 .RS 4n
292 minutes
293 .RE
295 .sp
296 .ne 2
297 .na
298 \fB\fBh\fR\fR
299 .ad
300 .sp .6
301 .RS 4n
302 hours
303 .RE
305 .sp
306 .ne 2
307 .na
308 \fB\fBd\fR\fR
309 .ad
310 .sp .6
311 .RS 4n
312 days
313 .RE
315 Example:
316 .sp
317 .in +2
318 .nf
319 \fBrenew_lifetime = 90m\fR
320 .fi
321 .in -2
322 .sp
324 Do not mix units. A value of "\fB3h30m\fR" results in an error.
325 .RE
327 .sp
328 .ne 2
329 .na
330 \fB\fBmax_lifetime =\fR\fIlifetime\fR\fR
331 .ad
332 .sp .6
333 .RS 4n
334 Sets the requested maximum lifetime of the ticket. The values for
335 \fIlifetime\fR follow the format described for the \fBrenew_lifetime\fR option,
336 above.
337 .RE
339 .sp
340 .ne 2
341 .na
342 \fB\fBdns_lookup_kdc\fR\fR
343 .ad
344 .sp .6
345 .RS 4n
346 Indicates whether DNS SRV records need to be used to locate the KDCs and the
347 other servers for a realm, if they have not already been listed in the
348 \fB[realms]\fR section. This option makes the machine vulnerable to a certain
349 type of DoS attack if somone spoofs the DNS records and does a redirect to
350 another server. This is, however, no worse than a DoS, since the bogus KDC is
351 unable to decode anything sent (excepting the initial ticket request, which has
352 no encrypted data). Also, anything the fake KDC sends out isl not trusted
353 without verification (the local machine is unaware of the secret key to be
354 used). If \fBdns_lookup_kdc\fR is not specified but \fBdns_fallback\fR is, then
355 that value is used instead. In either case, values (if present) in the
356 \fB[realms]\fR section override DNS. \fBdns_lookup_kdc\fR is enabled by
357 default.
358 .RE
360 .sp
361 .ne 2
362 .na
363 \fB\fBdns_lookup_realm\fR\fR
364 .ad
365 .sp .6
366 .RS 4n
367 Indicates whether DNS TXT records need to be used to determine the Kerberos
368 realm information and/or the host/domain name-to-realm mapping of a host, if
369 this information is not already present in the \fBkrb5.conf\fR file. Enabling
370 this option might make the host vulnerable to a redirection attack, wherein
371 spoofed DNS replies persuade a client to authenticate to the wrong realm. In a
372 realm with no cross-realm trusts, this a DoS attack. If \fBdns_lookup_realm\fR
373 is not specified but \fBdns_fallback\fR is, then that value is used instead. In
374 either case, values (if present) in the \fB[libdefaults]\fR and
375 \fB[domain_realm]\fR sections override DNS.
376 .RE
378 .sp
379 .ne 2
380 .na
381 \fB\fBdns_fallback\fR\fR
382 .ad
383 .sp .6
384 .RS 4n
385 Generic flag controlling the use of DNS for retrieval of information about
386 Kerberos servers and host/domain name-to-realm mapping. If both
387 \fBdns_lookup_kdc\fR and \fBdns_lookup_realm\fR have been specified, this
388 option has no effect.
389 .RE
391 .sp
392 .ne 2
393 .na
394 \fB\fBverify_ap_req_nofail [true | false]\fR\fR
395 .ad
396 .sp .6
397 .RS 4n
398 If \fBtrue\fR, the local keytab file (\fB/etc/krb5/krb5.keytab\fR) must contain
399 an entry for the local \fBhost\fR principal, for example,
400 \fBhost/foo.bar.com@FOO.COM\fR. This entry is needed to verify that the
401 \fBTGT\fR requested was issued by the same \fBKDC\fR that issued the key for
402 the host principal. If undefined, the behavior is as if this option were set to
403 \fBtrue\fR. Setting this value to \fBfalse\fR leaves the system vulnerable to
404 \fBDNS\fR spoofing attacks. This parameter can be in the \fB[realms]\fR section
405 to set it on a per-realm basis, or it can be in the \fB[libdefaults]\fR section
406 to make it a network-wide setting for all realms.
407 .RE
409 .SS "The \fB[appdefaults]\fR Section"
410 .LP
411 This section contains subsections for Kerberos V5 applications, where
412 \fIrelation-subsection\fR is the name of an application. Each subsection
413 contains relations that define the default behaviors for that application.
414 .sp
415 .LP
416 The following relations can be found in the \fB[appdefaults]\fR section, though
417 not all relations are recognized by all kerberized applications. Some are
418 specific to particular applications.
419 .sp
420 .ne 2
421 .na
422 \fB\fBautologin =\fR [\fBtrue\fR | \fBfalse\fR]\fR
423 .ad
424 .sp .6
425 .RS 4n
426 Forces the application to attempt automatic login by presenting Kerberos
427 credentials. This is valid for the following applications: \fBrlogin\fR,
428 \fBrsh\fR, \fBrcp\fR, and \fBtelnet\fR.
429 .RE
431 .sp
432 .ne 2
433 .na
434 \fB\fBencrypt =\fR [\fBtrue\fR | \fBfalse\fR]\fR
435 .ad
436 .sp .6
437 .RS 4n
438 Forces applications to use encryption by default (after authentication) to
439 protect the privacy of the sessions. This is valid for the following
440 applications: \fBrlogin\fR, \fBrsh\fR, \fBrcp\fR, and \fBtelnet\fR.
441 .RE
443 .sp
444 .ne 2
445 .na
446 \fB\fBforward =\fR [\fBtrue\fR | \fBfalse\fR]\fR
447 .ad
448 .sp .6
449 .RS 4n
450 Forces applications to forward the user'ss credentials (after authentication)
451 to the remote server. This is valid for the following applications:
452 \fBrlogin\fR, \fBrsh\fR, \fBrcp\fR, and \fBtelnet\fR.
453 .RE
455 .sp
456 .ne 2
457 .na
458 \fB\fBforwardable =\fR [\fBtrue\fR | \fBfalse\fR]\fR
459 .ad
460 .sp .6
461 .RS 4n
462 See the description in the \fB[libdefaults]\fR section above. This is used by
463 any application that creates a ticket granting ticket and also by applications
464 that can forward tickets to a remote server.
465 .RE
467 .sp
468 .ne 2
469 .na
470 \fB\fBproxiable =\fR [\fBtrue\fR | \fBfalse\fR]\fR
471 .ad
472 .sp .6
473 .RS 4n
474 See the description in the \fB[libdefaults]\fR section above. This is used by
475 any application that creates a ticket granting ticket.
476 .RE
478 .sp
479 .ne 2
480 .na
481 \fB\fBrenewable =\fR [\fBtrue\fR | \fBfalse\fR]\fR
482 .ad
483 .sp .6
484 .RS 4n
485 Creates a TGT that can be renewed (prior to the ticket expiration time). This
486 is used by any application that creates a ticket granting ticket.
487 .RE
489 .sp
490 .ne 2
491 .na
492 \fB\fBno_addresses =\fR [\fBtrue\fR | \fBfalse\fR]\fR
493 .ad
494 .sp .6
495 .RS 4n
496 Creates tickets with no address bindings. This is to allow tickets to be used
497 across a \fBNAT\fR boundary or when using multi-homed systems. This option is
498 valid in the \fBkinit\fR \fB[appdefault]\fR section only.
499 .RE
501 .sp
502 .ne 2
503 .na
504 \fB\fBmax_life =\fR\fIlifetime\fR\fR
505 .ad
506 .sp .6
507 .RS 4n
508 Sets the maximum lifetime of the ticket, with a total lifetime of
509 \fIlifetime\fR. The values for \fIlifetime\fR follow the format described in
510 the \fB[libdefaults]\fR section above. This option is obsolete and is removed
511 in a future release of the Solaris operating system.
512 .RE
514 .sp
515 .ne 2
516 .na
517 \fB\fBmax_renewable_life =\fR\fIlifetime\fR\fR
518 .ad
519 .sp .6
520 .RS 4n
521 Requests renewable tickets, with a total lifetime of \fIlifetime\fR. The values
522 for \fIlifetime\fR follow the format described in the \fB[libdefaults]\fR
523 section above. This option is obsolete and is removed in a future release of
524 the Solaris operating system.
525 .RE
527 .sp
528 .ne 2
529 .na
530 \fB\fBrcmd_protocol =\fR [ \fBrcmdv1\fR | \fBrcmdv2\fR ]\fR
531 .ad
532 .sp .6
533 .RS 4n
534 Specifies which Kerberized "\fBrcmd\fR" protocol to use when using the
535 Kerberized \fBrlogin\fR(1), \fBrsh\fR(1), or \fBrcp\fR(1) programs. The
536 default is to use \fBrcmdv2\fR by default, as this is the more secure and
537 more recent update of the protocol. However, when talking to older \fBMIT\fR
538 or \fBSEAM\fR-based "\fBrcmd\fR" servers, it can be necessary to force the
539 new clients to use the older \fBrcmdv1\fR protocol. This option is valid
540 only for the following applications: \fBrlogin\fR, \fBrcp\fR, and \fBrsh\fR.
541 .RE
543 .sp
544 .LP
545 The following application defaults can be set to \fBtrue\fR or \fBfalse\fR:
546 .sp
547 .in +2
548 .nf
549 kinit
550 forwardable = true
551 proxiable = true
552 renewable = true
553 no_addresses = true
554 max_life = \fIdelta_time\fR
555 max_renewable_life = \fIdelta_time\fR
556 .fi
557 .in -2
558 .sp
560 .sp
561 .LP
562 See \fBkinit\fR(1) for the valid time duration formats you can specify for
563 \fIdelta_time\fR.
564 .sp
565 .LP
566 In the following example, \fBkinit\fR gets forwardable tickets by default and
567 \fBtelnet\fR has three default behaviors specified:
568 .sp
569 .in +2
570 .nf
571 [appdefaults]
572 kinit = {
573 forwardable = true
574 }
576 telnet = {
577 forward = true
578 encrypt = true
579 autologin = true
580 }
581 .fi
582 .in -2
583 .sp
585 .sp
586 .LP
587 The application defaults specified here are overridden by those specified in
588 the \fB[realms]\fR section.
589 .SS "The \fB[realms]\fR Section"
590 .LP
591 This section contains subsections for Kerberos realms, where
592 \fIrelation-subsection\fR is the name of a realm. Each subsection contains
593 relations that define the properties for that particular realm. The following
594 relations can be specified in each \fB[realms]\fR subsection:
595 .sp
596 .ne 2
597 .na
598 \fB\fBadmin_server\fR\fR
599 .ad
600 .sp .6
601 .RS 4n
602 Identifies the host where the Kerberos administration daemon (\fBkadmind\fR) is
603 running. Typically, this is the master \fBKDC\fR.
604 .RE
606 .sp
607 .ne 2
608 .na
609 \fB\fIapplication defaults\fR\fR
610 .ad
611 .sp .6
612 .RS 4n
613 Application defaults that are specific to a particular realm can be specified
614 within a \fB[realms]\fR subsection. Realm-specific application defaults
615 override the global defaults specified in the \fB[appdefaults]\fR section.
616 .RE
618 .sp
619 .ne 2
620 .na
621 \fB\fBauth_to_local_realm\fR\fR
622 .ad
623 .sp .6
624 .RS 4n
625 For use in the default realm, non-default realms can be equated with the
626 default realm for authenticated name-to-local name mapping.
627 .RE
629 .sp
630 .ne 2
631 .na
632 \fB\fBauth_to_local_names\fR\fR
633 .ad
634 .sp .6
635 .RS 4n
636 This subsection allows you to set explicit mappings from principal names to
637 local user names. The tag is the mapping name and the value is the
638 corresponding local user name.
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fB\fBauth_to_local\fR\fR
645 .ad
646 .sp .6
647 .RS 4n
648 This tag allows you to set a general rule for mapping principal names to local
649 user names. It is used if there is not an explicit mapping for the principal
650 name that is being translated. The possible values are:
651 .sp
652 .in +2
653 .nf
654 RULE:[<ncomps>:<format>](<regex>)s/<regex>/<text>/
655 .fi
656 .in -2
658 Each rule has three parts:
659 .sp
660 .ne 2
661 .na
662 \fBFirst part\(emFormulate the string on which to perform operations:\fR
663 .ad
664 .sp .6
665 .RS 4n
666 If not present then the string defaults to the fully flattened principal minus
667 the realm name. Otherwise the syntax is as follows:
668 .sp
669 .in +2
670 .nf
671 "[" \fI<ncomps>\fR ":" \fI<format>\fR "]"
672 .fi
673 .in -2
675 Where:
676 .sp
677 \fI<ncomps>\fR is the number of expected components for this rule. If the
678 particular principal does not have this number of components, then this rule
679 does not apply.
680 .sp
681 \fI<format>\fR is a string of \fI<component>\fR or verbatim characters to be
682 inserted.
683 .sp
684 \fI<component>\fR is of the form "\fB$\fR"\fI<number>\fR to select the
685 \fI<number>\fRth component. \fI<number>\fR begins from 1.
686 .RE
688 .sp
689 .ne 2
690 .na
691 \fBSecond part\(emselect rule validity:\fR
692 .ad
693 .sp .6
694 .RS 4n
695 If not present, this rule can apply to all selections. Otherwise the syntax is
696 as follows:
697 .sp
698 .in +2
699 .nf
700 "(" \fI<regex>\fR ")"
701 .fi
702 .in -2
704 Where:
705 .sp
706 \fI<regex>\fR is a selector regular expression. If this regular expression
707 matches the whole pattern generated from the first part, then this rule still
708 applies.
709 .RE
711 .sp
712 .ne 2
713 .na
714 \fBThird part\(emTransform rule:\fR
715 .ad
716 .sp .6
717 .RS 4n
718 If not present, then the selection string is passed verbatim and is matched.
719 Otherwise, the syntax is as follows:
720 .sp
721 .in +2
722 .nf
723 \fI<rule>\fR ...
724 .fi
725 .in -2
727 Where:
728 .sp
729 \fI<rule>\fR is of the form:
730 .sp
731 .in +2
732 .nf
733 "s/" <regex> "/" <text> "/" ["g"]
734 .fi
735 .in -2
737 Regular expressions are defined in \fBregex\fR(5).
738 .sp
739 For example:
740 .sp
741 auth_to_local = RULE:[1:$1@$0](.*@.*ACME\.COM)s/@.*//
742 .sp
743 The preceding maps \fB\fIusername\fR@ACME.COM\fR and all sub-realms of
744 \fBACME.COM\fR to \fIusername\fR.
745 .RE
747 .sp
748 .ne 2
749 .na
750 \fBDEFAULT\fR
751 .ad
752 .sp .6
753 .RS 4n
754 The principal name is used as the local name. If the principal has more than
755 one component or is not in the default realm, this rule is not applicable and
756 the conversion fails.
757 .RE
759 .RE
761 .sp
762 .ne 2
763 .na
764 \fB\fBdatabase_module\fR\fR
765 .ad
766 .sp .6
767 .RS 4n
768 Selects the \fBdbmodule\fR section entry to use to access the Kerberos
769 database.
770 .RE
772 .sp
773 .ne 2
774 .na
775 \fB\fBextra_addresses\fR...\fR
776 .ad
777 .sp .6
778 .RS 4n
779 This allows a computer to use multiple local addresses, to allow Kerberos to
780 work in a network that uses NATs. The addresses should be in a comma-separated
781 list.
782 .RE
784 .sp
785 .ne 2
786 .na
787 \fB\fBkdc\fR\fR
788 .ad
789 .sp .6
790 .RS 4n
791 The name of a host running a \fBKDC\fR for that realm. An optional port number
792 (separated from the hostname by a colon) can be included.
793 .RE
795 .sp
796 .ne 2
797 .na
798 \fB\fBkpasswd_server\fR\fR
799 .ad
800 .sp .6
801 .RS 4n
802 Identifies the host where the Kerberos password-changing server is running.
803 Typically, this is the same as host indicated in the \fBadmin_server\fR. If
804 this parameter is omitted, the host in \fBadmin_server\fR is used. You can also
805 specify a port number if the server indicated by \fBkpasswd_server\fR runs on a
806 port other than 464 (the default). The format of this parameter is:
807 \fIhostname\fR[:\fIport\fR].
808 .RE
810 .sp
811 .ne 2
812 .na
813 \fB\fBkpasswd_protocol\fR\fR
814 .ad
815 .sp .6
816 .RS 4n
817 Identifies the protocol to be used when communicating with the server indicated
818 by \fBkpasswd_server\fR. By default, this parameter is defined to be
819 \fBRPCSEC_GSS\fR, which is the protocol used by Solaris-based administration
820 servers. To be able to change a principal's password stored on non-Solaris
821 Kerberos server, such as Microsoft Active Directory or \fBMIT\fR Kerberos, this
822 value should be \fBSET_CHANGE\fR. This indicates that a non-RPC- based protocol
823 is used to communicate the password change request to the server in the
824 \fBkpasswd_server\fR entry.
825 .RE
827 .sp
828 .ne 2
829 .na
830 \fB\fBudp_preference_limit\fR\fR
831 .ad
832 .sp .6
833 .RS 4n
834 When sending a message to the KDC, the library tries using TCP before UDP if
835 the size of the message is above \fBudp_preference_limit\fR. If the message is
836 smaller than \fBudp_preference_limit\fR, then UDP is tried before TCP.
837 Regardless of the size, both protocols are tried if the first attempt fails.
838 .RE
840 .sp
841 .ne 2
842 .na
843 \fB\fBverify_ap_req_nofail\fR [\fBtrue\fR | \fBfalse\fR]\fR
844 .ad
845 .sp .6
846 .RS 4n
847 If \fBtrue\fR, the local keytab file (\fB/etc/krb5/krb5.keytab\fR) must contain
848 an entry for the local \fBhost\fR principal, for example,
849 \fBhost/foo.bar.com@FOO.COM\fR. This entry is needed to verify that the
850 \fBTGT\fR requested was issued by the same \fBKDC\fR that issued the key for
851 the host principal. If undefined, the behavior is as if this option were set to
852 \fBtrue\fR. Setting this value to \fBfalse\fR leaves the system vulnerable to
853 \fBDNS\fR spoofing attacks. This parameter might be in the \fB[realms]\fR
854 section to set it on a per-realm basis, or it might be in the
855 \fB[libdefaults]\fR section to make it a network-wide setting for all realms.
856 .RE
858 .sp
859 .LP
860 The parameters "\fBforwardable\fR", "\fBproxiable\fR", and
861 "\fBrenew_lifetime\fR" as described in the \fB[libdefaults]\fR section (see
862 above) are also valid in the \fB[realms]\fR section.
863 .sp
864 .LP
865 Notice that \fBkpasswd_server\fR and \fBkpasswd_protocol\fR are realm-specific
866 parameters. Most often, you need to specify them only when using a
867 non-Solaris-based Kerberos server. Otherwise, the change request is sent over
868 \fBRPCSEC_GSS\fR to the Solaris Kerberos administration server.
869 .SS "The \fB[domain_realm]\fR Section"
870 .LP
871 This section provides a translation from a domain name or hostname to a
872 Kerberos realm name. The \fIrelation\fR can be a host name, or a domain name,
873 where domain names are indicated by a period (`\fB\&.\fR') prefix.
874 \fIrelation-value\fR is the Kerberos realm name for that particular host or
875 domain. Host names and domain names should be in lower case.
876 .sp
877 .LP
878 If no translation entry applies, the host's realm is considered to be the
879 hostname's domain portion converted to upper case. For example, the following
880 \fB[domain_realm]\fR section maps \fBcrash.mit.edu\fR into the
881 \fBTEST.ATHENA.MIT.EDU\fR realm:
882 .sp
883 .in +2
884 .nf
885 [domain_realm]
886 .mit.edu = ATHENA.MIT.EDU
887 mit.edu = ATHENA.MIT.EDU
888 crash.mit.edu = TEST.ATHENA.MIT.EDU
889 .fubar.org = FUBAR.ORG
890 fubar.org = FUBAR.ORG
891 .fi
892 .in -2
893 .sp
895 .sp
896 .LP
897 All other hosts in the \fBmit.edu\fR domain maps by default to the
898 \fBATHENA.MIT.EDU\fR realm, and all hosts in the \fBfubar.org\fR domain maps by
899 default into the \fBFUBAR.ORG\fR realm. The entries for the hosts \fBmit.edu\fR
900 and \fBfubar.org\fR. Without these entries, these hosts would be mapped into
901 the Kerberos realms \fBEDU\fR and \fBORG\fR, respectively.
902 .SS "The \fB[logging]\fR Section"
903 .LP
904 This section indicates how Kerberos programs are to perform logging. There are
905 two types of relations for this section: relations to specify how to log and a
906 relation to specify how to rotate \fBkdc\fR log files.
907 .sp
908 .LP
909 The following relations can be defined to specify how to log. The same relation
910 can be repeated if you want to assign it multiple logging methods.
911 .sp
912 .ne 2
913 .na
914 \fB\fBadmin_server\fR\fR
915 .ad
916 .sp .6
917 .RS 4n
918 Specifies how to log the Kerberos administration daemon (\fBkadmind\fR). The
919 default is \fBFILE:/var/krb5/kadmin.log.\fR
920 .RE
922 .sp
923 .ne 2
924 .na
925 \fB\fBdefault\fR\fR
926 .ad
927 .sp .6
928 .RS 4n
929 Specifies how to perform logging in the absence of explicit specifications
930 otherwise.
931 .RE
933 .sp
934 .ne 2
935 .na
936 \fB\fBkdc\fR\fR
937 .ad
938 .sp .6
939 .RS 4n
940 Specifies how the \fBKDC\fR is to perform its logging. The default is
941 \fBFILE:/var/krb5/kdc.log\fR.
942 .RE
944 .sp
945 .LP
946 The \fBadmin_server\fR, \fBdefault\fR, and \fBkdc\fR relations can have the
947 following values:
948 .sp
949 .ne 2
950 .na
951 \fB\fBFILE:\fR\fIfilename\fR\fR
952 .ad
953 .br
954 .na
955 \fB\fBFILE=\fR\fIfilename\fR\fR
956 .ad
957 .sp .6
958 .RS 4n
959 This value causes the entity's logging messages to go to the specified file. If
960 the `=' form is used, the file is overwritten. If the `:' form is used, the
961 file is appended to.
962 .RE
964 .sp
965 .ne 2
966 .na
967 \fB\fBSTDERR\fR\fR
968 .ad
969 .sp .6
970 .RS 4n
971 This value causes the entity's logging messages to go to its standard error
972 stream.
973 .RE
975 .sp
976 .ne 2
977 .na
978 \fB\fBCONSOLE\fR\fR
979 .ad
980 .sp .6
981 .RS 4n
982 This value causes the entity's logging messages to go to the console, if the
983 system supports it.
984 .RE
986 .sp
987 .ne 2
988 .na
989 \fB\fBDEVICE=\fR\fIdevicename\fR\fR
990 .ad
991 .sp .6
992 .RS 4n
993 This causes the entity's logging messages to go to the specified device.
994 .RE
996 .sp
997 .ne 2
998 .na
999 \fB\fBSYSLOG[:\fR\fIseverity\fR\fB[:\fR\fIfacility\fR\fB]]\fR\fR
1000 .ad
1001 .sp .6
1002 .RS 4n
1003 This causes the entity's logging messages to go to the system log.
1004 .RE
1006 .sp
1007 .LP
1008 The \fIseverity\fR argument specifies the default severity of system log
1009 messages. This can be any of the following severities supported by the
1010 \fBsyslog\fR(3C) call, minus the \fBLOG_\fR prefix: \fBLOG_EMERG\fR,
1011 \fBLOG_ALERT\fR, \fBLOG_CRIT\fR, \fBLOG_ERR\fR, \fBLOG_WARNING\fR,
1012 \fBLOG_NOTICE\fR, \fBLOG_INFO\fR, and \fBLOG_DEBUG\fR. For example, a value of
1013 \fBCRIT\fR would specify \fBLOG_CRIT\fR severity.
1014 .sp
1015 .LP
1016 The \fIfacility\fR argument specifies the facility under which the messages are
1017 logged. This can be any of the following facilities supported by the
1018 \fBsyslog\fR(3C) call minus the \fBLOG_\fR prefix: \fBLOG_KERN\fR,
1019 \fBLOG_USER\fR, \fBLOG_MAIL\fR, \fBLOG_DAEMON\fR, \fBLOG_AUTH\fR,
1020 \fBLOG_LPR\fR, \fBLOG_NEWS\fR, \fBLOG_UUCP\fR, \fBLOG_CRON\fR, and
1021 \fBLOG_LOCAL0\fR through \fBLOG_LOCAL7\fR.
1022 .sp
1023 .LP
1024 If no severity is specified, the default is \fBERR\fR. If no facility is
1025 specified, the default is \fBAUTH\fR.
1026 .sp
1027 .LP
1028 The following relation can be defined to specify how to rotate \fBkdc\fR log
1029 files if the \fBFILE:\fR value is being used to log:
1030 .sp
1031 .ne 2
1032 .na
1033 \fB\fBkdc_rotate\fR\fR
1034 .ad
1035 .sp .6
1036 .RS 4n
1037 A relation subsection that enables \fBkdc\fR logging to be rotated to multiple
1038 files based on a time interval. This can be used to avoid logging to one file,
1039 which might grow too large and bring the \fBKDC\fR to a halt.
1040 .RE
1042 .sp
1043 .LP
1044 The time interval for the rotation is specified by the \fBperiod\fR relation.
1045 The number of log files to be rotated is specified by the \fBversions\fR
1046 relation. Both the \fBperiod\fR and \fBversions\fR (described below) should be
1047 included in this subsection. And, this subsection applies only if the \fBkdc\fR
1048 relation has a \fBFILE:\fR value.
1049 .sp
1050 .LP
1051 The following relations can be specified for the \fBkdc_rotate\fR relation
1052 subsection:
1053 .sp
1054 .ne 2
1055 .na
1056 \fB\fB\fR\fBperiod=\fIdelta_time\fR\fR\fR
1057 .ad
1058 .sp .6
1059 .RS 4n
1060 Specifies the time interval before a new log file is created. See the
1061 \fBTime\fR\fBFormats\fR section in \fBkinit\fR(1) for the valid time duration
1062 formats you can specify for \fIdelta_time\fR. If \fBperiod\fR is not specified
1063 or set to \fBnever\fR, no rotation occurs.
1064 .RE
1066 .sp
1067 .LP
1068 Specifying a time interval does not mean that the log files are rotated at the
1069 time interval based on real time. This is because the time interval is checked
1070 at each attempt to write a record to the log, or when logging is actually
1071 occurring. Therefore, rotation occurs only when logging has actually occurred
1072 for the specified time interval.
1073 .sp
1074 .ne 2
1075 .na
1076 \fB\fBversions=\fR\fInumber\fR\fR
1077 .ad
1078 .sp .6
1079 .RS 4n
1080 Specifies how many previous versions are saved before the rotation begins. A
1081 number is appended to the log file, starting with 0 and ending with
1082 (\fInumber\fR - 1). For example, if \fBversions\fR is set to \fB2\fR, up to
1083 three logging files are created (\fIfilename\fR, \fIfilename\fR.0, and
1084 \fIfilename\fR.1) before the first one is overwritten to begin the rotation.
1085 .RE
1087 .sp
1088 .LP
1089 Notice that if \fBversions\fR is not specified or set to \fB0\fR, only one log
1090 file is created, but it is overwritten whenever the time interval is met.
1091 .sp
1092 .LP
1093 In the following example, the logging messages from the Kerberos administration
1094 daemon goes to the console. The logging messages from the \fBKDC\fR is appended
1095 to the \fB/var/krb5/kdc.log\fR, which is rotated between twenty-one log files
1096 with a specified time interval of a day.
1097 .sp
1098 .in +2
1099 .nf
1100 [logging]
1101 admin_server = CONSOLE
1102 kdc = FILE:/export/logging/kadmin.log
1103 kdc_rotate = {
1104 period = 1d
1105 versions = 20
1106 }
1107 .fi
1108 .in -2
1109 .sp
1111 .SS "The \fB[capaths]\fR Section"
1112 .LP
1113 In order to perform direct (non-hierarchical) cross-realm authentication, a
1114 database is needed to construct the authentication paths between the realms.
1115 This section defines that database.
1116 .sp
1117 .LP
1118 A client uses this section to find the authentication path between its realm
1119 and the realm of the server. The server uses this section to verify the
1120 authentication path used by the client, by checking the transited field of the
1121 received ticket.
1122 .sp
1123 .LP
1124 There is a subsection for each participating realm, and each subsection has
1125 relations named for each of the realms. The \fIrelation-value\fR is an
1126 intermediate realm which can participate in the cross-realm authentication. The
1127 relations can be repeated if there is more than one intermediate realm. A value
1128 of '.' means that the two realms share keys directly, and no intermediate
1129 realms should be allowed to participate.
1130 .sp
1131 .LP
1132 There are n**2 possible entries in this table, but only those entries which is
1133 needed on the client or the server need to be present. The client needs a
1134 subsection named for its local realm, with relations named for all the realms
1135 of servers it needs to authenticate with. A server needs a subsection named for
1136 each realm of the clients it serves.
1137 .sp
1138 .LP
1139 For example, \fBANL.GOV\fR, \fBPNL.GOV\fR, and \fBNERSC.GOV\fR all wish to use
1140 the \fBES.NET\fR realm as an intermediate realm. \fBANL\fR has a sub realm of
1141 \fBTEST.ANL.GOV\fR, which authenticates with \fBNERSC.GOV\fR but not
1142 \fBPNL.GOV\fR. The \fB[capath]\fR section for \fBANL.GOV\fR systems would look
1143 like this:
1144 .sp
1145 .in +2
1146 .nf
1147 [capaths]
1148 ANL.GOV = {
1149 TEST.ANL.GOV = .
1150 PNL.GOV = ES.NET
1151 NERSC.GOV = ES.NET
1152 ES.NET = .
1153 }
1155 TEST.ANL.GOV = {
1156 ANL.GOV = .
1157 }
1159 PNL.GOV = {
1160 ANL.GOV = ES.NET
1161 }
1163 NERSC.GOV = {
1164 ANL.GOV = ES.NET
1165 }
1167 ES.NET = {
1168 ANL.GOV = .
1169 }
1170 .fi
1171 .in -2
1172 .sp
1174 .sp
1175 .LP
1176 The \fB[capath]\fR section of the configuration file used on \fBNERSC.GOV\fR
1177 systems would look like this:
1178 .sp
1179 .in +2
1180 .nf
1181 [capaths]
1182 NERSC.GOV = {
1183 ANL.GOV = ES.NET
1184 TEST.ANL.GOV = ES.NET
1185 TEST.ANL.GOV = ANL.GOV
1186 PNL.GOV = ES.NET
1187 ES.NET = .
1188 }
1190 ANL.GOV = {
1191 NERSC.GOV = ES.NET
1192 }
1194 PNL.GOV = {
1195 NERSC.GOV = ES.NET
1196 }
1198 ES.NET = {
1199 NERSC.GOV = .
1200 }
1202 TEST.ANL.GOV = {
1203 NERSC.GOV = ANL.GOV
1204 NERSC.GOV = ES.NET
1205 }
1206 .fi
1207 .in -2
1208 .sp
1210 .sp
1211 .LP
1212 In the above examples, the ordering is not important, except when the same
1213 relation is used more than once. The client uses this to determine the path.
1214 (It is not important to the server, since the transited field is not sorted.)
1215 .SS "PKINIT-specific Options"
1216 .LP
1217 The following are \fBpkinit-specific\fR options. These values can be specified
1218 in \fB[libdefaults]\fR as global defaults, or within a realm-specific
1219 subsection of \fB[libdefaults]\fR, or can be specified as realm-specific values
1220 in the \fB[realms]\fR section. A realm-specific value overrides, does not add
1221 to, a generic \fB[libdefaults]\fR specification.
1222 .sp
1223 .LP
1224 The search order is:
1225 .RS +4
1226 .TP
1227 1.
1228 realm-specific subsection of \fB[libdefaults]\fR
1229 .sp
1230 .in +2
1231 .nf
1232 [libdefaults]
1233 EXAMPLE.COM = {
1234 pkinit_anchors = FILE:/usr/local/example.com.crt
1235 .fi
1236 .in -2
1238 .RE
1239 .RS +4
1240 .TP
1241 2.
1242 realm-specific value in the \fB[realms]\fR section
1243 .sp
1244 .in +2
1245 .nf
1246 [realms]
1247 OTHERREALM.ORG = {
1248 pkinit_anchors = FILE:/usr/local/otherrealm.org.crt
1249 .fi
1250 .in -2
1252 .RE
1253 .RS +4
1254 .TP
1255 3.
1256 generic value in the \fB[libdefaults]\fR section
1257 .sp
1258 .in +2
1259 .nf
1260 [libdefaults]
1261 pkinit_anchors = DIR:/usr/local/generic_trusted_cas/
1262 .fi
1263 .in -2
1265 .RE
1266 .sp
1267 .LP
1268 The syntax for specifying Public Key identity, trust, and revocation
1269 information for \fBpkinit\fR is as follows:
1270 .sp
1271 .ne 2
1272 .na
1273 \fB\fBpkinit_identities\fR \fB=\fR \fIURI\fR\fR
1274 .ad
1275 .sp .6
1276 .RS 4n
1277 Specifies the location(s) to be used to find the user's X.509 identity
1278 information. This option can be specified multiple times. Each value is
1279 attempted in order until identity information is found and authentication is
1280 attempted. These values are not used if the user specifies
1281 \fBX509_user_identity\fR on the command line.
1282 .sp
1283 Valid \fIURI\fR types are \fBFILE\fR, \fBDIR\fR, \fBPKCS11\fR, \fBPKCS12\fR,
1284 and \fBENV\fR. See the \fBPKINIT URI Types\fR section for more details.
1285 .RE
1287 .sp
1288 .ne 2
1289 .na
1290 \fB\fBpkinit_anchors\fR \fB=\fR \fIURI\fR\fR
1291 .ad
1292 .sp .6
1293 .RS 4n
1294 Specifies the location of trusted anchor (root) certificates which the client
1295 trusts to sign KDC certificates. This option can be specified multiple times.
1296 These values from the \fBconfig\fR file are not used if the user specifies
1297 \fBX509_anchors\fR on the command line.
1298 .sp
1299 Valid \fIURI\fR types are \fBFILE\fR and \fBDIR\fR. See the \fBPKINIT URI
1300 Types\fR section for more details.
1301 .RE
1303 .sp
1304 .ne 2
1305 .na
1306 \fB\fBpkinit_pool\fR \fB=\fR \fIURI\fR\fR
1307 .ad
1308 .sp .6
1309 .RS 4n
1310 Specifies the location of intermediate certificates which can be used by the
1311 client to complete the trust chain between a KDC certificate and a trusted
1312 anchor. This option can be specified multiple times.
1313 .sp
1314 Valid \fIURI\fR types are \fBFILE\fR and \fBDIR\fR. See the \fBPKINIT URI
1315 Types\fR section for more details.
1316 .RE
1318 .sp
1319 .ne 2
1320 .na
1321 \fB\fBpkinit_revoke\fR \fB=\fR \fIURI\fR\fR
1322 .ad
1323 .sp .6
1324 .RS 4n
1325 Specifies the location of Certificate Revocation List (CRL) information to be
1326 used by the client when verifying the validity of the KDC certificate
1327 presented. This option can be specified multiple times.
1328 .sp
1329 The only valid \fIURI\fR type is \fBDIR\fR. See the \fBPKINIT URI Types\fR
1330 section for more details.
1331 .RE
1333 .sp
1334 .ne 2
1335 .na
1336 \fB\fBpkinit_require_crl_checking\fR \fB=\fR \fIvalue\fR\fR
1337 .ad
1338 .sp .6
1339 .RS 4n
1340 The default certificate verification process always checks the available
1341 revocation information to see if a certificate has been revoked. If a match is
1342 found for the certificate in a CRL, verification fails. If the certificate
1343 being verified is not listed in a CRL, or there is no CRL present for its
1344 issuing CA, and \fBpkinit_require_crl_checking\fR is \fBfalse\fR, then
1345 verification succeeds. However, if \fBpkinit_require_crl_checking\fR is
1346 \fBtrue\fR and there is no CRL information available for the issuing CA, then
1347 verification fails. \fBpkinit_require_crl_checking\fR should be set to
1348 \fBtrue\fR if the policy is such that up-to-date CRLs must be present for every
1349 CA.
1350 .RE
1352 .sp
1353 .ne 2
1354 .na
1355 \fB\fBpkinit_dh_min_bits\fR \fB=\fR \fIvalue\fR\fR
1356 .ad
1357 .sp .6
1358 .RS 4n
1359 Specifies the size of the Diffie-Hellman key the client attempts to use. The
1360 acceptable values are currently 1024, 2048, and 4096. The default is 2048.
1361 .RE
1363 .sp
1364 .ne 2
1365 .na
1366 \fB\fBpkinit_win2k\fR \fB=\fR \fIvalue\fR\fR
1367 .ad
1368 .sp .6
1369 .RS 4n
1370 This flag specifies whether the target realm is assumed to support only the
1371 old, pre-RFC version of the protocol. The default is \fBfalse\fR.
1372 .RE
1374 .sp
1375 .ne 2
1376 .na
1377 \fB\fBpkinit_win2k_require_binding\fR \fB=\fR \fIvalue\fR\fR
1378 .ad
1379 .sp .6
1380 .RS 4n
1381 If this flag is set to \fBtrue\fR, it expects that the target KDC is patched to
1382 return a reply with a checksum rather than a nonce. The default is \fBfalse\fR.
1383 .RE
1385 .sp
1386 .ne 2
1387 .na
1388 \fB\fBpkinit_eku_checking\fR \fB=\fR \fIvalue\fR\fR
1389 .ad
1390 .sp .6
1391 .RS 4n
1392 This option specifies what Extended Key Usage value the KDC certificate
1393 presented to the client must contain. If the KDC certificate has the \fBpkinit
1394 SubjectAlternativeName\fR encoded as the Kerberos TGS name, EKU checking is not
1395 necessary since the issuing CA has certified this as a KDC certificate. The
1396 values recognized in the \fBkrb5.conf\fR file are:
1397 .sp
1398 .ne 2
1399 .na
1400 \fB\fBkpKDC\fR\fR
1401 .ad
1402 .RS 16n
1403 This is the default value and specifies that the KDC must have the
1404 \fBid-pkinit-KPKdc EKU\fR as defined in RFC4556.
1405 .RE
1407 .sp
1408 .ne 2
1409 .na
1410 \fB\fBkpServerAuth\fR\fR
1411 .ad
1412 .RS 16n
1413 If \fBkpServerAuth\fR is specified, a KDC certificate with the
1414 \fBid-kp-serverAuth EKU\fR as used by Microsoft is accepted.
1415 .RE
1417 .sp
1418 .ne 2
1419 .na
1420 \fB\fBnone\fR\fR
1421 .ad
1422 .RS 16n
1423 If \fBnone\fR is specified, then the KDC certificate is not checked to verify
1424 it has an acceptable EKU. The use of this option is not recommended.
1425 .RE
1427 .RE
1429 .sp
1430 .ne 2
1431 .na
1432 \fB\fBpkinit_kdc_hostname\fR \fB=\fR \fIvalue\fR\fR
1433 .ad
1434 .sp .6
1435 .RS 4n
1436 The presence of this option indicates that the client is willing to accept a
1437 KDC certificate with a \fBdNSName\fR SAN (Subject Alternative Name) rather than
1438 requiring the \fBid-pkinit-san\fR as defined in RFC4556. This option can be
1439 specified multiple times. Its value should contain the acceptable hostname for
1440 the KDC (as contained in its certificate).
1441 .RE
1443 .sp
1444 .ne 2
1445 .na
1446 \fB\fBpkinit_cert_match\fR \fB=\fR \fIrule\fR\fR
1447 .ad
1448 .sp .6
1449 .RS 4n
1450 Specifies matching rules that the client certificate must match before it is
1451 used to attempt \fBpkinit\fR authentication. If a user has multiple
1452 certificates available (on a smart card, or by way of another media), there
1453 must be exactly one certificate chosen before attempting \fBpkinit\fR
1454 authentication. This option can be specified multiple times. All the
1455 available certificates are checked against each rule in order until there is a
1456 match of exactly one certificate.
1457 .sp
1458 The Subject and Issuer comparison strings are the RFC2253 string
1459 representations from the certificate Subject DN and Issuer DN values.
1460 .sp
1461 The syntax of the matching rules is:
1462 .sp
1463 .in +2
1464 .nf
1465 [relation-operator]component-rule `...'
1466 .fi
1467 .in -2
1469 where
1470 .sp
1471 .ne 2
1472 .na
1473 \fB\fIrelation-operator\fR\fR
1474 .ad
1475 .RS 21n
1476 Specify \fIrelation-operator\fR as \fB&&\fR, meaning all component rules must
1477 match, or \fB||\fR, meaning only one component rule must match. If
1478 \fIrelation-operator\fR is not specified, the default is \fB&&\fR\&.
1479 .RE
1481 .sp
1482 .ne 2
1483 .na
1484 \fB\fIcomponent-rule\fR\fR
1485 .ad
1486 .RS 21n
1487 There is no punctuation or white space between component rules.Specify
1488 \fIcomponent-rule\fR as one of the following:
1489 .sp
1490 .in +2
1491 .nf
1492 `<SUBJECT>'regular-expression
1494 `<ISSUER>'regular-expression
1496 `<SAN>'regular-expression
1498 `<EKU>'extended-key-usage-list
1499 where extended-key-usage-list is a comma-separated list
1500 of required Extended Key Usage values. All values in
1501 the list must be present in the certificate.
1502 `pkinit'
1503 `msScLogin'
1504 `clientAuth'
1505 `emailProtection'
1506 `<KU>'key-usage-list
1507 where key-usage-list is a comma-separated list of
1508 required Key Usage values. All values in the list must
1509 be present in the certificate.
1510 `digitalSignature'
1511 .fi
1512 .in -2
1514 .RE
1516 Examples:
1517 .sp
1518 .in +2
1519 .nf
1520 pkinit_cert_match = ||<SUBJECT>.*DoE.*<SAN>.*@EXAMPLE.COM
1521 pkinit_cert_match = &&<EKU>msScLogin,clientAuth<ISSUER>.*DoE.*
1522 pkinit_cert_match = <EKU>msScLogin,clientAuth<KU>digitalSignature
1523 .fi
1524 .in -2
1526 .RE
1528 .SS "PKINIT URI Types"
1529 .ne 2
1530 .na
1531 \fB\fBFILE:\fR\fIfile-name[,key-file-name]\fR\fR
1532 .ad
1533 .sp .6
1534 .RS 4n
1535 This option has context-specific behavior.
1536 .sp
1537 .ne 2
1538 .na
1539 \fB\fBpkinit_identities\fR\fR
1540 .ad
1541 .RS 21n
1542 \fIfile-name\fR specifies the name of a PEM-format file containing the user's
1543 certificate. If \fIkey-file-name\fR is not specified, the user's private key
1544 is expected to be in \fIfile-name\fR as well. Otherwise, \fIkey-file-name\fR
1545 is the name of the file containing the private key.
1546 .RE
1548 .sp
1549 .ne 2
1550 .na
1551 \fB\fBpkinit_anchors\fR\fR
1552 .ad
1553 .br
1554 .na
1555 \fB\fBpkinit_pool\fR\fR
1556 .ad
1557 .RS 21n
1558 \fIfile-name\fR is assumed to be the name of an \fBOpenSSL-style ca-bundle\fR
1559 file. The \fBca-bundle\fR file should be base-64 encoded.
1560 .RE
1562 .RE
1564 .sp
1565 .ne 2
1566 .na
1567 \fB\fBDIR:\fR\fIdirectory-name\fR\fR
1568 .ad
1569 .sp .6
1570 .RS 4n
1571 This option has context-specific behavior.
1572 .sp
1573 .ne 2
1574 .na
1575 \fB\fBpkinit_identities\fR\fR
1576 .ad
1577 .RS 21n
1578 \fIdirectory-name\fR specifies a directory with files named \fB*.crt\fR and
1579 \fB*.key\fR, where the first part of the file name is the same for matching
1580 pairs of certificate and private key files. When a file with a name ending with
1581 \&.\fBcrt\fR is found, a matching file ending with \fB\&.key\fR is assumed to
1582 contain the private key. If no such file is found, then the certificate in the
1583 \fB\&.crt\fR is not used.
1584 .RE
1586 .sp
1587 .ne 2
1588 .na
1589 \fB\fBpkinit_anchors\fR\fR
1590 .ad
1591 .br
1592 .na
1593 \fB\fBpkinit_pool\fR\fR
1594 .ad
1595 .RS 21n
1596 \fIdirectory-name\fR is assumed to be an OpenSSL-style hashed CA directory
1597 where each CA cert is stored in a file named \fBhash-of-ca-cert\fR.\fI#\fR.
1598 This infrastructure is encouraged, but all files in the directory are examined
1599 and if they contain certificates (in PEM format), they are used.
1600 .RE
1602 .RE
1604 .sp
1605 .ne 2
1606 .na
1607 \fB\fBPKCS12:\fR\fIpkcs12-file-name\fR\fR
1608 .ad
1609 .sp .6
1610 .RS 4n
1611 \fIpkcs12-file-name\fR is the name of a \fBPKCS #12\fR format file, containing
1612 the user's certificate and private key.
1613 .RE
1615 .sp
1616 .ne 2
1617 .na
1618 \fB\fBPKCS11:[slotid=\fR\fIslot-id\fR\fB][:token=\fR\fItoken-label\fR\fB][:cert
1619 id=\fR\fIcert-id\fR\fB][:certlabel=\fR\fIcert-label\fR\fB]\fR\fR
1620 .ad
1621 .sp .6
1622 .RS 4n
1623 All keyword/values are optional. PKCS11 modules (for example,
1624 \fBopensc-pkcs11.so\fR) must be installed as a \fBcrypto\fR provider under
1625 \fBlibpkcs11\fR(3LIB). \fBslotid=\fR and/or \fBtoken=\fR can be specified to
1626 force the use of a particular smart card reader or token if there is more than
1627 one available. \fBcertid=\fR and/or \fBcertlabel=\fR can be specified to force
1628 the selection of a particular certificate on the device. See the
1629 \fBpkinit_cert_match\fR configuration option for more ways to select a
1630 particular certificate to use for \fBpkinit\fR.
1631 .RE
1633 .sp
1634 .ne 2
1635 .na
1636 \fB\fBENV:\fR\fIenvironment-variable-name\fR\fR
1637 .ad
1638 .sp .6
1639 .RS 4n
1640 \fIenvironment-variable-name\fR specifies the name of an environment variable
1641 which has been set to a value conforming to one of the previous values. For
1642 example, \fBENV:X509_PROXY\fR, where environment variable \fBX509_PROXY\fR has
1643 been set to \fBFILE:/tmp/my_proxy.pem\fR.
1644 .RE
1646 .SS "The \fB[dbmodules]\fR Section"
1647 .LP
1648 This section consists of relations that provide configuration information for
1649 plug-in modules. In particular, the relations describe the configuration for
1650 LDAP KDB plug-in. Use of the \fBdb2\fR KDB plug-in is the default behavior and
1651 that this section does not need to be filled out in that case.
1652 .sp
1653 .ne 2
1654 .na
1655 \fB\fBdb_library\fR\fR
1656 .ad
1657 .sp .6
1658 .RS 4n
1659 Name of the plug-in library. To use the LDAP KDB plug-in the name must be
1660 \fBkdb_ldap\fR. The default value is \fBdb2\fR.
1661 .RE
1663 .sp
1664 .ne 2
1665 .na
1666 \fB\fBdb_module_dir\fR\fR
1667 .ad
1668 .sp .6
1669 .RS 4n
1670 Path to the plug-in libraries. The default is \fB/usr/lib/krb5\fR.
1671 .RE
1673 .sp
1674 .ne 2
1675 .na
1676 \fB\fBldap_cert_path\fR\fR
1677 .ad
1678 .sp .6
1679 .RS 4n
1680 Path to the Network Security Services (NSS) trusted database for an SSL
1681 connection. This is a required parameter when using the LDAP KDB plug-in.
1682 .RE
1684 .sp
1685 .ne 2
1686 .na
1687 \fB\fBldap_conns_per_server\fR\fR
1688 .ad
1689 .sp .6
1690 .RS 4n
1691 Number of connections per LDAP instance. The default is \fB5\fR.
1692 .RE
1694 .sp
1695 .ne 2
1696 .na
1697 \fB\fBldap_kadmind_dn\fR\fR
1698 .ad
1699 .sp .6
1700 .RS 4n
1701 Bind DN for \fBkadmind\fR. This specifies the DN that the \fBkadmind\fR service
1702 uses when binding to the LDAP Directory Server. The password for this bind DN
1703 should be in the \fBldap_service_password_file\fR.
1704 .RE
1706 .sp
1707 .ne 2
1708 .na
1709 \fB\fBldap_kdc_dn\fR\fR
1710 .ad
1711 .sp .6
1712 .RS 4n
1713 Bind DN for a Key Distribution Center (KDC). This specifies the DN that the
1714 \fBkrb5kdc\fR service use when binding to the LDAP Directory Server. The
1715 password for this bind DN should be in the \fBldap_service_password_file\fR.
1716 .RE
1718 .sp
1719 .ne 2
1720 .na
1721 \fB\fBldap_servers\fR\fR
1722 .ad
1723 .sp .6
1724 .RS 4n
1725 List of LDAP directory servers in URI format. Use of either of the following is
1726 acceptable.
1727 .sp
1728 .in +2
1729 .nf
1730 ldap://\fI<ds hostname>\fR:\fI<SSL port>\fR
1731 ldap://\fI<ds hostname>\fR
1732 .fi
1733 .in -2
1734 .sp
1736 Each server URI should be separated by whitespace.
1737 .RE
1739 .sp
1740 .ne 2
1741 .na
1742 \fB\fBldap_service_password_file\fR\fR
1743 .ad
1744 .sp .6
1745 .RS 4n
1746 File containing stashed passwords used by the KDC when binding to the LDAP
1747 Directory Server. The default is \fB/var/krb5/service_passwd\fR. This file is
1748 created using \fBkdb5_ldap_util\fR(8).
1749 .RE
1751 .sp
1752 .ne 2
1753 .na
1754 \fB\fBldap_ssl_port\fR\fR
1755 .ad
1756 .sp .6
1757 .RS 4n
1758 Port number for SSL connection with directory server. The default is \fB389\fR.
1759 .RE
1761 .SH EXAMPLES
1762 .LP
1763 \fBExample 1 \fRSample File
1764 .sp
1765 .LP
1766 The following is an example of a generic \fBkrb5.conf\fR file:
1768 .sp
1769 .in +2
1770 .nf
1771 [libdefaults]
1772 default_realm = ATHENA.MIT.EDU
1773 default_tkt_enctypes = des-cbc-crc
1774 default_tgs_enctypes = des-cbc-crc
1776 [realms]
1777 ATHENA.MIT.EDU = {
1778 kdc = kerberos.mit.edu
1779 kdc = kerberos-1.mit.edu
1780 kdc = kerberos-2.mit.edu
1781 admin_server = kerberos.mit.edu
1782 auth_to_local_realm = KRBDEV.ATHENA.MIT.EDU
1783 }
1785 FUBAR.ORG = {
1786 kdc = kerberos.fubar.org
1787 kdc = kerberos-1.fubar.org
1788 admin_server = kerberos.fubar.org
1789 }
1791 [domain_realm]
1792 .mit.edu = ATHENA.MIT.EDU
1793 mit.edu = ATHENA.MIT.EDU
1794 .fi
1795 .in -2
1796 .sp
1798 .LP
1799 \fBExample 2 \fRKDC Using the LDAP KDB plug-in, \fBrealms\fR and
1800 \fBdbmodules\fR Sections
1801 .sp
1802 .LP
1803 The following is an example of the \fBrealms\fR and \fBdbmodules\fR sections of
1804 a Kerberos configuration file when the KDC is using the LDAP KDB plug-in.
1806 .sp
1807 .in +2
1808 .nf
1809 [realms]
1810 SUN.COM = {
1811 kdc = kc-umpk-01.athena.mit.edu
1812 kdc = kc-umpk-02.athena.mit.edu
1813 admin_server = kc-umpk-01.athena.mit.edu
1814 database_module = LDAP
1815 }
1817 [dbmodules]
1818 LDAP = {
1819 db_library = kdb_ldap
1820 ldap_kerberos_container_dn = "cn=krbcontainer,dc=mit,dc=edu"
1821 ldap_kdc_dn = "cn=kdc service,ou=profile,dc=mit,dc=edu"
1822 ldap_kadmind_dn = "cn=kadmin service,ou=profile,dc=mit,dc=edu"
1823 ldap_cert_path = /var/ldap
1824 ldap_servers = ldaps://ds.mit.edu
1825 }
1826 .fi
1827 .in -2
1828 .sp
1830 .SH FILES
1831 .ne 2
1832 .na
1833 \fB\fB/var/krb5/kdc.log\fR\fR
1834 .ad
1835 .sp .6
1836 .RS 4n
1837 \fBKDC\fR logging file
1838 .RE
1840 .SH ATTRIBUTES
1841 .LP
1842 See \fBattributes\fR(5) for descriptions of the following attributes:
1843 .sp
1845 .sp
1846 .TS
1847 box;
1848 c | c
1849 l | l .
1850 ATTRIBUTE TYPE ATTRIBUTE VALUE
1851 _
1852 Interface Stability See below.
1853 .TE
1855 .sp
1856 .LP
1857 All of the keywords are Committed, except for the \fBPKINIT\fR keywords, which
1858 are Volatile.
1859 .SH SEE ALSO
1860 .LP
1861 \fBkinit\fR(1), \fBrcp\fR(1), \fBrlogin\fR(1), \fBrsh\fR(1),
1862 \fBtelnet\fR(1), \fBsyslog\fR(3C), \fBattributes\fR(5), \fBkerberos\fR(5),
1863 \fBregex\fR(5)
1864 .SH NOTES
1865 .LP
1866 If the \fBkrb5.conf\fR file is not formatted properly, the \fBtelnet\fR command
1867 fails. However, the \fBdtlogin\fR and \fBlogin\fR commands still succeed, even
1868 if the \fBkrb5.conf\fR file is specified as required for the commands. If this
1869 occurs, the following error message is displayed:
1870 .sp
1871 .in +2
1872 .nf
1873 Error initializing krb5: Improper format of \fIitem\fR
1874 .fi
1875 .in -2
1876 .sp
1878 .sp
1879 .LP
1880 To bypass any other problems that might occur, you should fix the file as soon
1881 as possible.
1882 .sp
1883 .LP
1884 The \fBmax_life\fR and \fBmax_renewable_life\fR options are obsolete and is
1885 removed in a future release of the Solaris operating system.