Manual page.
git-svn-id: svn://svn.h5l.se/heimdal/trunk/heimdal@2644 ec53bebd-3082-4978-b11e-865c3cabbd6b
This commit is contained in:
Johan Danielsson
96
kdc/kdc.8
Normal file
96
kdc/kdc.8
Normal file
@@ -0,0 +1,96 @@
|
||||
.\" $Id$
|
||||
.\"
|
||||
.Dd July 27, 1997
|
||||
.Dt KDC 8
|
||||
.Os HEIMDAL
|
||||
.Sh NAME
|
||||
.Nm kdc
|
||||
.Nd
|
||||
Kerberos 5 server
|
||||
.Sh SYNOPSIS
|
||||
.Nm
|
||||
.Op Fl c Ar file
|
||||
.Op Fl k Ar file
|
||||
.Op Fl l Ar file
|
||||
.Op Fl p
|
||||
.Op Fl r Ar realm
|
||||
.Op Fl -config-file= Ns Ar file
|
||||
.Op Fl -key-file= Ns Ar file
|
||||
.Op Fl -log-file= Ns Ar file
|
||||
.Op Fl -log-level= Ns Ar number
|
||||
.Op Fl -no-require-preauth
|
||||
.Op Fl -v4-realm= Ns Ar realm
|
||||
|
||||
.Sh DESCRIPTION
|
||||
.Nm
|
||||
serves requests for tickets. When it starts, it first checks the flags
|
||||
passed, any options that are not specified with a command line flag is
|
||||
taken from a config file, or from a default compiled-in value.
|
||||
.Pp
|
||||
Options supported:
|
||||
.Bl -tag -width Ds
|
||||
.It Fl c Ar file
|
||||
.It Fl -config-file= Ns Ar file
|
||||
Specifies the location of the config file, the default is
|
||||
.Pa /var/heimdal/kdc.conf .
|
||||
This is the only value that can't be specified in the config file.
|
||||
.It Fl k Ar file
|
||||
.It Fl -key-file= Ns Ar file
|
||||
The location of the master-key file. All keys in the database is
|
||||
encrypted with this master key. The use of a master key is currently
|
||||
optional, so there is no default.
|
||||
.Em "Don't specify a master key file if your database is not encrypted."
|
||||
.It Fl l Ar file
|
||||
.It Fl -log-file= Ns Ar file
|
||||
The file where the KDC logs its activities.
|
||||
.It Fl -log-level= Ns Ar number
|
||||
What level of information you want logged. The default is 0, and logs
|
||||
only requests and any errors when parsing them. You can turn off
|
||||
logging by specifying -1.
|
||||
.It Fl p
|
||||
.It Fl -no-require-preauth
|
||||
Turn off the requirement for pre-autentication in the initial
|
||||
AS-REQ. The use of pre-authentication makes it more difficult to do
|
||||
offline password attacks. You might want to turn it off if you have
|
||||
clients that doesn't do pre-authentication. Since the version 4
|
||||
protocol doesn't support any pre-authentication, so serving version 4
|
||||
clients is just about the same as not requiring pre-athentication. The
|
||||
default is to require pre-authentication.
|
||||
.It Fl r Ar realm
|
||||
.It Fl -v4-realm= Ns Ar realm
|
||||
What realm this server should act as when dealing with version 4
|
||||
requests. The database can contain any number of realms, but since the
|
||||
version 4 protocol doesn't contain a realm for the server, it must be
|
||||
explicitly specified. The default is whatever is returned by
|
||||
.Fn krb_get_lrealm .
|
||||
This option is only availabe if the program has been compiled with
|
||||
version 4 support.
|
||||
.El
|
||||
.Sh CONFIGURATION FILE
|
||||
The configuration file has the same syntax as the
|
||||
.Pa krb5.conf
|
||||
file (you can actually put the configuration in
|
||||
.Pa /etc/krb5.conf ,
|
||||
and then start the KDC with
|
||||
.Fl -config-file= Ns Ar /etc/krb5.conf ) .
|
||||
All options should be in a section called
|
||||
.Dq kdc .
|
||||
Options are called the same as the long option name, and takes the
|
||||
same arguments. The only difference is the pre-authentication flag,
|
||||
that has to be specified as:
|
||||
.Pp
|
||||
.Dl require-preauth = no
|
||||
.Pp
|
||||
(in fact you can specify the option as
|
||||
.Fl -require-preauth= Ns Ar no
|
||||
as well).
|
||||
.Pp
|
||||
An example of a config file:
|
||||
.Bd -literal -offset indent
|
||||
[kdc]
|
||||
require-preauth = no
|
||||
v4-realm = FOO.SE
|
||||
log-file = /var/log/kdc.log
|
||||
.Ed
|
||||
.Sh SEE ALSO
|
||||
.Xr kinit 1
|
||||
128
lib/krb5/krb5.conf.5
Normal file
128
lib/krb5/krb5.conf.5
Normal file
@@ -0,0 +1,128 @@
|
||||
.\" $Id$
|
||||
.\"
|
||||
.Dd July 27, 1997
|
||||
.Dt KRB5.CONF 5
|
||||
.Os HEIMDAL
|
||||
.Sh NAME
|
||||
.Nm /etc/krb5.conf
|
||||
.Nd
|
||||
Configuration file for Kerberos 5
|
||||
.Sh DESCRIPTION
|
||||
The
|
||||
.Nm
|
||||
file specifies several configuration parameters for the Kerberos 5
|
||||
library, as well as some programs.
|
||||
.Pp
|
||||
The file consists of one or more sections, containing a number of
|
||||
bindings. The value of each binding can be either a string or a list
|
||||
of other bindings. The grammar looks like:
|
||||
.Bd -literal -offset indent
|
||||
file:
|
||||
/* empty */
|
||||
sections
|
||||
|
||||
sections:
|
||||
section sections
|
||||
section
|
||||
|
||||
section:
|
||||
'[' section_name ']' bindings
|
||||
|
||||
section_name:
|
||||
STRING
|
||||
|
||||
bindings:
|
||||
binding bindings
|
||||
binding
|
||||
|
||||
binding:
|
||||
name '=' STRING
|
||||
name '=' '{' bindings '}'
|
||||
|
||||
name:
|
||||
STRING
|
||||
|
||||
.Ed
|
||||
.Li STRINGs
|
||||
consists of one or more non-white space characters.
|
||||
Currently recognised sections and bindings are:
|
||||
|
||||
.Bl -tag -width "xxxxxx" -offset indent
|
||||
.It Li libdefaults
|
||||
.Bl -tag -width "xxxxxx" -offset indent
|
||||
.It Li default_realm = Va REALM
|
||||
Default realm to use, this is also known as your
|
||||
.Dq local realm .
|
||||
The default is the result of
|
||||
.Fn krb5_get_host_realm "local host name" .
|
||||
.It Li clockskew = time
|
||||
Maximum time differential (in seconds) allowed when comparing
|
||||
times. Default is 300 seconds (five minutes).
|
||||
.It Li kdc_timeout = time
|
||||
Maximum time to wait for a reply from the kdc, default is 3 seconds.
|
||||
.El
|
||||
.It Li domain_realm
|
||||
This is a list of mappings from DNS domain to Kerberos realm. Each
|
||||
binding in this section looks like:
|
||||
.Pp
|
||||
.Dl domain = realm
|
||||
.Pp
|
||||
The domain can be either a full name of a host or a trailing
|
||||
component, in the latter case the domain-string should start with a
|
||||
perid.
|
||||
.It Li realms
|
||||
.Bl -tag -offset indent
|
||||
.It Va REALM Li = {
|
||||
.Bl -tag -offset indent
|
||||
.It Li kdc = Va host[:port]
|
||||
Specifies a kdc for this realm. If the optional port is absent, the
|
||||
default value for the
|
||||
.Dq kerberos/udp
|
||||
service will be used.
|
||||
.It Li v4_instance_convert = {
|
||||
This specifies a list of version 4 instance to version 5 component
|
||||
conversions that should be made when converting a version 4 principal
|
||||
to a version 5 ditto. Since version 4 host instances only contains the
|
||||
first part of the domain name, this section is sometimes
|
||||
necessary. See also
|
||||
.Li default_domain .
|
||||
.It }
|
||||
.It Li v4_name_convert = {
|
||||
Similar to
|
||||
.Li v4_instance_convert ,
|
||||
but converts the version 4 name, rather than the instance. This is not
|
||||
used by the MIT libkrb5, but before someone thinks up something better
|
||||
you will have to have a binding looking like:
|
||||
.Pp
|
||||
.Dl rcmd = host
|
||||
.Pp
|
||||
here.
|
||||
.It }
|
||||
.It Li default_domain = Va domain
|
||||
The default domain to use when converting version 4 instances to
|
||||
version 5 principals.
|
||||
.El
|
||||
.It Li }
|
||||
.El
|
||||
.El
|
||||
.Sh EXAMPLE
|
||||
.Bd -literal -offset indent
|
||||
[lib_defaults]
|
||||
default_domain = FOO.SE
|
||||
[domain_realm]
|
||||
.foo.se = FOO.SE
|
||||
.bar.se = FOO.SE
|
||||
[realms]
|
||||
FOO.SE = {
|
||||
kdc = kerberos.foo.se
|
||||
v4_name_convert = {
|
||||
rcmd = host
|
||||
}
|
||||
v4_instance_convert = {
|
||||
xyz = xyz.bar.se
|
||||
}
|
||||
default_domain = foo.se
|
||||
}
|
||||
.Ed
|
||||
.Sh SEE ALSO
|
||||
.Xr Source tm
|
||||
Reference in New Issue
Block a user