krb5: Update to 1.21.1 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2023-08-04 17:53:10 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2023-08-04 17:53:10 +0000
commit	0320e0d5bb9fbb5da53478b3fd80ad79b110191d (patch)
tree	e1185f75bd2d3f87b0c17f787debc3ee8648214b /doc/html/admin/admin_commands/kpropd.html
parent	b0e4d68d5124581ae353493d69bea352de4cff8a (diff)

vendor/krb5/1.21.1

Diffstat (limited to 'doc/html/admin/admin_commands/kpropd.html')

-rw-r--r--

doc/html/admin/admin_commands/kpropd.html

137

1 files changed, 71 insertions, 66 deletions

diff --git a/doc/html/admin/admin_commands/kpropd.html b/doc/html/admin/admin_commands/kpropd.html
index 163f4ac8cd75..2bd16d7d043b 100644
--- a/doc/html/admin/admin_commands/kpropd.html
+++ b/doc/html/admin/admin_commands/kpropd.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kpropd — MIT Kerberos Documentation</title>

+ <title>kpropd — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="Administration programs" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<h1>kpropd<a class="headerlink" href="#kpropd" title="Permalink to this headline">¶</a></h1>

@@ -71,31 +69,33 @@

[-r realm]

[-A admin_server]

[-a acl_file]

-[-f slave_dumpfile]

+[-f replica_dumpfile]

[-F principal_database]

[-p kdb5_util_prog]

[-P port]

-[–pid-file=pid_file]

+[–pid-file=pid_file]

+[-D]

[-d]

-[-t]

+[-s keytab_file]

</div>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

-The kpropd command runs on the slave KDC server. It listens for

-update requests made by the <a class="reference internal" href="kprop.html#kprop-8">kprop</a> program. If incremental

+The kpropd command runs on the replica KDC server. It listens for

+update requests made by the <a class="reference internal" href="kprop.html#kprop-8">kprop</a> program. If incremental

propagation is enabled, it periodically requests incremental updates

-from the master KDC.

-When the slave receives a kprop request from the master, kpropd

+from the primary KDC.

+When the replica receives a kprop request from the primary, kpropd

accepts the dumped KDC database and places it in a file, and then runs

-<a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a> to load the dumped database into the active

-database which is used by <a class="reference internal" href="krb5kdc.html#krb5kdc-8">krb5kdc</a>. This allows the master

-Kerberos server to use <a class="reference internal" href="kprop.html#kprop-8">kprop</a> to propagate its database to

-the slave servers. Upon a successful download of the KDC database

-file, the slave Kerberos server will have an up-to-date KDC database.

+<a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a> to load the dumped database into the active

+database which is used by <a class="reference internal" href="krb5kdc.html#krb5kdc-8">krb5kdc</a>. This allows the primary

+Kerberos server to use <a class="reference internal" href="kprop.html#kprop-8">kprop</a> to propagate its database to

+the replica servers. Upon a successful download of the KDC database

+file, the replica Kerberos server will have an up-to-date KDC

+database.

Where incremental propagation is not used, kpropd is commonly invoked

out of inetd(8) as a nowait service. This is done by adding a line to

-the <tt class="docutils literal">/etc/inetd.conf</tt> file which looks like this:

-<div class="highlight-python"><div class="highlight"><pre>kprop stream tcp nowait root /usr/local/sbin/kpropd kpropd

+the <code class="docutils literal">/etc/inetd.conf</code> file which looks like this:

+<div class="highlight-default"><div class="highlight"><pre>kprop stream tcp nowait root /usr/local/sbin/kpropd kpropd

</pre></div>

</div>

kpropd can also run as a standalone daemon, backgrounding itself and

@@ -107,75 +107,77 @@ not. Prior to release 1.11, the -S option is required to run

kpropd in standalone mode; this option is now accepted for backward

compatibility but does nothing.

Incremental propagation may be enabled with the iprop_enable

-variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>. If incremental propagation is

-enabled, the slave periodically polls the master KDC for updates, at

-an interval determined by the iprop_slave_poll variable. If the

-slave receives updates, kpropd updates its log file with any updates

-from the master. <a class="reference internal" href="kproplog.html#kproplog-8">kproplog</a> can be used to view a summary of

-the update entry log on the slave KDC. If incremental propagation is

-enabled, the principal <tt class="docutils literal">kiprop/slavehostname@REALM</tt> (where

-slavehostname is the name of the slave KDC host, and REALM is the

-name of the Kerberos realm) must be present in the slave’s keytab

-file.

-<a class="reference internal" href="kproplog.html#kproplog-8">kproplog</a> can be used to force full replication when iprop is

+variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a>. If incremental propagation is

+enabled, the replica periodically polls the primary KDC for updates, at

+an interval determined by the iprop_replica_poll variable. If the

+replica receives updates, kpropd updates its log file with any updates

+from the primary. <a class="reference internal" href="kproplog.html#kproplog-8">kproplog</a> can be used to view a summary of

+the update entry log on the replica KDC. If incremental propagation

+is enabled, the principal <code class="docutils literal">kiprop/replicahostname@REALM</code> (where

+replicahostname is the name of the replica KDC host, and REALM is

+the name of the Kerberos realm) must be present in the replica’s

+keytab file.

+<a class="reference internal" href="kproplog.html#kproplog-8">kproplog</a> can be used to force full replication when iprop is

enabled.

</div>

<h2>OPTIONS<a class="headerlink" href="#options" title="Permalink to this headline">¶</a></h2>

<dt>-r realm</dt>

-<dd>Specifies the realm of the master server.</dd>

+<dd>Specifies the realm of the primary server.</dd>

<dt>-A admin_server</dt>

<dd>Specifies the server to be contacted for incremental updates; by

-default, the master admin server is contacted.</dd>

+default, the primary admin server is contacted.</dd>

<dd>Specifies the filename where the dumped principal database file is

-to be stored; by default the dumped database file is <a class="reference internal" href="../../mitK5defaults.html#paths">LOCALSTATEDIR</a><tt class="docutils literal">/krb5kdc</tt><tt class="docutils literal">/from_master</tt>.</dd>

+to be stored; by default the dumped database file is <a class="reference internal" href="../../mitK5defaults.html#paths">LOCALSTATEDIR</a><code class="docutils literal">/krb5kdc</code><code class="docutils literal">/from_master</code>.</dd>

+<dt>-F kerberos_db</dt>

+<dd>Path to the Kerberos database file, if not the default.</dd>

-<dd>Allows the user to specify the pathname to the <a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a>

-program; by default the pathname used is <a class="reference internal" href="../../mitK5defaults.html#paths">SBINDIR</a><tt class="docutils literal">/kdb5_util</tt>.</dd>

+<dd>Allows the user to specify the pathname to the <a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a>

+program; by default the pathname used is <a class="reference internal" href="../../mitK5defaults.html#paths">SBINDIR</a><code class="docutils literal">/kdb5_util</code>.</dd>

+<dt>-D</dt>

+<dd>In this mode, kpropd will not detach itself from the current job

+and run in the background. Instead, it will run in the

+foreground.</dd>

-<dd>Turn on debug mode. In this mode, kpropd will not detach

-itself from the current job and run in the background. Instead,

-it will run in the foreground and print out debugging messages

-during the database propagation.</dd>

-<dt>-t</dt>

-<dd>In standalone mode without incremental propagation, exit after one

-dump file is received. In incremental propagation mode, exit as

-soon as the database is up to date, or if the master returns an

-error.</dd>

+<dd>Turn on debug mode. kpropd will print out debugging messages

+during the database propogation and will run in the foreground

+(implies -D).</dd>

<dd>Allow for an alternate port number for kpropd to listen on. This

is only useful in combination with the -S option.</dd>

<dd>Allows the user to specify the path to the kpropd.acl file; by

-default the path used is <a class="reference internal" href="../../mitK5defaults.html#paths">LOCALSTATEDIR</a><tt class="docutils literal">/krb5kdc</tt><tt class="docutils literal">/kpropd.acl</tt>.</dd>

-<dt>–pid-file=pid_file</dt>

+default the path used is <a class="reference internal" href="../../mitK5defaults.html#paths">LOCALSTATEDIR</a><code class="docutils literal">/krb5kdc</code><code class="docutils literal">/kpropd.acl</code>.</dd>

+<dt>–pid-file=pid_file</dt>

<dd>In standalone mode, write the process ID of the daemon into

pid_file.</dd>

+<dt>-s keytab_file</dt>

+<dd>Path to a keytab to use for acquiring acceptor credentials.</dd>

+<dt>-x db_args</dt>

+<dd>Database-specific arguments. See <a class="reference internal" href="kadmin_local.html#dboptions">Database Options</a> in <a class="reference internal" href="kadmin_local.html#kadmin-1">kadmin</a> for supported arguments.</dd>

</dl>

</div>

-<div class="section" id="environment">

-<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-kpropd uses the following environment variables:

-<ul class="simple">

-<li>KRB5_CONFIG</li>

-<li>KRB5_KDC_PROFILE</li>

-</ul>

-</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

<dt>kpropd.acl</dt>

<dd>Access file for kpropd; the default location is

-<tt class="docutils literal">/usr/local/var/krb5kdc/kpropd.acl</tt>. Each entry is a line

+<code class="docutils literal">/usr/local/var/krb5kdc/kpropd.acl</code>. Each entry is a line

containing the principal of a host from which the local machine

-will allow Kerberos database propagation via <a class="reference internal" href="kprop.html#kprop-8">kprop</a>.</dd>

+will allow Kerberos database propagation via <a class="reference internal" href="kprop.html#kprop-8">kprop</a>.</dd>

</dl>

</div>

+<div class="section" id="environment">

+<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

+See <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7">kerberos</a> for a description of Kerberos environment

+variables.

+</div>

-<a class="reference internal" href="kprop.html#kprop-8">kprop</a>, <a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a>, <a class="reference internal" href="krb5kdc.html#krb5kdc-8">krb5kdc</a>, inetd(8)

+<a class="reference internal" href="kprop.html#kprop-8">kprop</a>, <a class="reference internal" href="kdb5_util.html#kdb5-util-8">kdb5_util</a>, <a class="reference internal" href="krb5kdc.html#krb5kdc-8">krb5kdc</a>,

+<a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7">kerberos</a>, inetd(8)

</div>

@@ -191,8 +193,8 @@ will allow Kerberos database propagation via <a class="reference internal" href=

<li><a class="reference internal" href="#synopsis">SYNOPSIS</a></li>

<li><a class="reference internal" href="#description">DESCRIPTION</a></li>

<li><a class="reference internal" href="#options">OPTIONS</a></li>

-<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li>

<li><a class="reference internal" href="#files">FILES</a></li>

+<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li>

</ul>

</li>

@@ -207,6 +209,7 @@ will allow Kerberos database propagation via <a class="reference internal" href=

<li class="toctree-l2"><a class="reference internal" href="../conf_files/index.html">Configuration Files</a></li>

<li class="toctree-l2"><a class="reference internal" href="../realm_config.html">Realm configuration decisions</a></li>

<li class="toctree-l2"><a class="reference internal" href="../database.html">Database administration</a></li>

+<li class="toctree-l2"><a class="reference internal" href="../dbtypes.html">Database types</a></li>

<li class="toctree-l2"><a class="reference internal" href="../lockout.html">Account lockout</a></li>

<li class="toctree-l2"><a class="reference internal" href="../conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li>

<li class="toctree-l2"><a class="reference internal" href="../appl_servers.html">Application servers</a></li>

@@ -214,6 +217,8 @@ will allow Kerberos database propagation via <a class="reference internal" href=

<li class="toctree-l2"><a class="reference internal" href="../backup_host.html">Backups of secure hosts</a></li>

<li class="toctree-l2"><a class="reference internal" href="../pkinit.html">PKINIT configuration</a></li>

<li class="toctree-l2"><a class="reference internal" href="../otp.html">OTP Preauthentication</a></li>

+<li class="toctree-l2"><a class="reference internal" href="../spake.html">SPAKE Preauthentication</a></li>

+<li class="toctree-l2"><a class="reference internal" href="../dictionary.html">Addressing dictionary attack risks</a></li>

<li class="toctree-l2"><a class="reference internal" href="../princ_dns.html">Principal names and DNS</a></li>

<li class="toctree-l2"><a class="reference internal" href="../enctypes.html">Encryption types</a></li>

<li class="toctree-l2"><a class="reference internal" href="../https.html">HTTPS proxy configuration</a></li>

@@ -225,7 +230,7 @@ will allow Kerberos database propagation via <a class="reference internal" href=

<li class="toctree-l3"><a class="reference internal" href="kprop.html">kprop</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">kpropd</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kpropd</a></li>

<li class="toctree-l3"><a class="reference internal" href="kproplog.html">kproplog</a></li>

<li class="toctree-l3"><a class="reference internal" href="ktutil.html">ktutil</a></li>

<li class="toctree-l3"><a class="reference internal" href="k5srvutil.html">k5srvutil</a></li>

@@ -266,8 +271,8 @@ will allow Kerberos database propagation via <a class="reference internal" href=

- <div class="right" >Release: 1.16

+ <div class="right" >Release: 1.21.1

</div>