diff options
Diffstat (limited to 'doc/html/admin/install_kdc.html')
| -rw-r--r-- | doc/html/admin/install_kdc.html | 514 |
1 files changed, 259 insertions, 255 deletions
diff --git a/doc/html/admin/install_kdc.html b/doc/html/admin/install_kdc.html index b3984a5ed599..9667adda8228 100644 --- a/doc/html/admin/install_kdc.html +++ b/doc/html/admin/install_kdc.html @@ -1,33 +1,31 @@ + <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> - <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - - <title>Installing KDCs — MIT Kerberos Documentation</title> - + <title>Installing KDCs — MIT Kerberos Documentation</title> <link rel="stylesheet" href="../_static/agogo.css" type="text/css" /> <link rel="stylesheet" href="../_static/pygments.css" type="text/css" /> <link rel="stylesheet" href="../_static/kerb.css" type="text/css" /> - <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../', - VERSION: '1.16', + VERSION: '1.21.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', - HAS_SOURCE: true + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt' }; </script> <script type="text/javascript" src="../_static/jquery.js"></script> <script type="text/javascript" src="../_static/underscore.js"></script> <script type="text/javascript" src="../_static/doctools.js"></script> <link rel="author" title="About these documents" href="../about.html" /> + <link rel="index" title="Index" href="../genindex.html" /> + <link rel="search" title="Search" href="../search.html" /> <link rel="copyright" title="Copyright" href="../copyright.html" /> - <link rel="top" title="MIT Kerberos Documentation" href="../index.html" /> - <link rel="up" title="Installation guide" href="install.html" /> <link rel="next" title="Installing and configuring UNIX client machines" href="install_clients.html" /> <link rel="prev" title="Installation guide" href="install.html" /> </head> @@ -61,28 +59,29 @@ <div class="documentwrapper"> <div class="bodywrapper"> - <div class="body"> + <div class="body" role="main"> <div class="section" id="installing-kdcs"> <h1>Installing KDCs<a class="headerlink" href="#installing-kdcs" title="Permalink to this headline">¶</a></h1> <p>When setting up Kerberos in a production environment, it is best to -have multiple slave KDCs alongside with a master KDC to ensure the +have multiple replica KDCs alongside with a primary KDC to ensure the continued availability of the Kerberized services. Each KDC contains -a copy of the Kerberos database. The master KDC contains the writable -copy of the realm database, which it replicates to the slave KDCs at -regular intervals. All database changes (such as password changes) -are made on the master KDC. Slave KDCs provide Kerberos -ticket-granting services, but not database administration, when the -master KDC is unavailable. MIT recommends that you install all of -your KDCs to be able to function as either the master or one of the -slaves. This will enable you to easily switch your master KDC with -one of the slaves if necessary (see <a class="reference internal" href="#switch-master-slave"><em>Switching master and slave KDCs</em></a>). This -installation procedure is based on that recommendation.</p> +a copy of the Kerberos database. The primary KDC contains the +writable copy of the realm database, which it replicates to the +replica KDCs at regular intervals. All database changes (such as +password changes) are made on the primary KDC. Replica KDCs provide +Kerberos ticket-granting services, but not database administration, +when the primary KDC is unavailable. MIT recommends that you install +all of your KDCs to be able to function as either the primary or one +of the replicas. This will enable you to easily switch your primary +KDC with one of the replicas if necessary (see +<a class="reference internal" href="#switch-primary-replica"><span class="std std-ref">Switching primary and replica KDCs</span></a>). This installation procedure is based +on that recommendation.</p> <div class="admonition warning"> <p class="first admonition-title">Warning</p> <ul class="last simple"> <li>The Kerberos system relies on the availability of correct time -information. Ensure that the master and all slave KDCs have +information. Ensure that the primary and all replica KDCs have properly synchronized clocks.</li> <li>It is best to install and run KDCs on secured and dedicated hardware with limited access. If your KDC is also a file @@ -92,65 +91,65 @@ of those areas could potentially gain access to the Kerberos database.</li> </ul> </div> -<div class="section" id="install-and-configure-the-master-kdc"> -<h2>Install and configure the master KDC<a class="headerlink" href="#install-and-configure-the-master-kdc" title="Permalink to this headline">¶</a></h2> +<div class="section" id="install-and-configure-the-primary-kdc"> +<h2>Install and configure the primary KDC<a class="headerlink" href="#install-and-configure-the-primary-kdc" title="Permalink to this headline">¶</a></h2> <p>Install Kerberos either from the OS-provided packages or from the -source (See <a class="reference internal" href="../build/doing_build.html#do-build"><em>Building within a single tree</em></a>).</p> +source (See <a class="reference internal" href="../build/doing_build.html#do-build"><span class="std std-ref">Building within a single tree</span></a>).</p> <div class="admonition note"> <p class="first admonition-title">Note</p> <p>For the purpose of this document we will use the following names:</p> -<div class="highlight-python"><div class="highlight"><pre>kerberos.mit.edu - master KDC -kerberos-1.mit.edu - slave KDC -ATHENA.MIT.EDU - realm name -.k5.ATHENA.MIT.EDU - stash file -admin/admin - admin principal +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kerberos</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="o">-</span> <span class="n">primary</span> <span class="n">KDC</span> +<span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="o">-</span> <span class="n">replica</span> <span class="n">KDC</span> +<span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="o">-</span> <span class="n">realm</span> <span class="n">name</span> +<span class="o">.</span><span class="n">k5</span><span class="o">.</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="o">-</span> <span class="n">stash</span> <span class="n">file</span> +<span class="n">admin</span><span class="o">/</span><span class="n">admin</span> <span class="o">-</span> <span class="n">admin</span> <span class="n">principal</span> </pre></div> </div> -<p class="last">See <a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><em>MIT Kerberos defaults</em></a> for the default names and locations +<p class="last">See <a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><span class="std std-ref">MIT Kerberos defaults</span></a> for the default names and locations of the relevant to this topic files. Adjust the names and paths to your system environment.</p> </div> </div> <div class="section" id="edit-kdc-configuration-files"> <h2>Edit KDC configuration files<a class="headerlink" href="#edit-kdc-configuration-files" title="Permalink to this headline">¶</a></h2> -<p>Modify the configuration files, <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> and -<a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>, to reflect the correct information (such as +<p>Modify the configuration files, <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> and +<a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>, to reflect the correct information (such as domain-realm mappings and Kerberos servers names) for your realm. -(See <a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><em>MIT Kerberos defaults</em></a> for the recommended default locations for +(See <a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><span class="std std-ref">MIT Kerberos defaults</span></a> for the recommended default locations for these files).</p> <p>Most of the tags in the configuration have default values that will work well for most sites. There are some tags in the -<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> file whose values must be specified, and this +<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file whose values must be specified, and this section will explain those.</p> <p>If the locations for these configuration files differs from the default ones, set <strong>KRB5_CONFIG</strong> and <strong>KRB5_KDC_PROFILE</strong> environment variables to point to the krb5.conf and kdc.conf respectively. For example:</p> -<div class="highlight-python"><div class="highlight"><pre>export KRB5_CONFIG=/yourdir/krb5.conf -export KRB5_KDC_PROFILE=/yourdir/kdc.conf +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">export</span> <span class="n">KRB5_CONFIG</span><span class="o">=/</span><span class="n">yourdir</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">conf</span> +<span class="n">export</span> <span class="n">KRB5_KDC_PROFILE</span><span class="o">=/</span><span class="n">yourdir</span><span class="o">/</span><span class="n">kdc</span><span class="o">.</span><span class="n">conf</span> </pre></div> </div> <div class="section" id="krb5-conf"> <h3>krb5.conf<a class="headerlink" href="#krb5-conf" title="Permalink to this headline">¶</a></h3> -<p>If you are not using DNS TXT records (see <a class="reference internal" href="realm_config.html#mapping-hostnames"><em>Mapping hostnames onto Kerberos realms</em></a>), -you must specify the <strong>default_realm</strong> in the <a class="reference internal" href="conf_files/krb5_conf.html#libdefaults"><em>[libdefaults]</em></a> +<p>If you are not using DNS TXT records (see <a class="reference internal" href="realm_config.html#mapping-hostnames"><span class="std std-ref">Mapping hostnames onto Kerberos realms</span></a>), +you must specify the <strong>default_realm</strong> in the <a class="reference internal" href="conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a> section. If you are not using DNS URI or SRV records (see -<a class="reference internal" href="realm_config.html#kdc-hostnames"><em>Hostnames for KDCs</em></a> and <a class="reference internal" href="realm_config.html#kdc-discovery"><em>KDC Discovery</em></a>), you must include the -<strong>kdc</strong> tag for each <em>realm</em> in the <a class="reference internal" href="conf_files/krb5_conf.html#realms"><em>[realms]</em></a> section. To +<a class="reference internal" href="realm_config.html#kdc-hostnames"><span class="std std-ref">Hostnames for KDCs</span></a> and <a class="reference internal" href="realm_config.html#kdc-discovery"><span class="std std-ref">KDC Discovery</span></a>), you must include the +<strong>kdc</strong> tag for each <em>realm</em> in the <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> section. To communicate with the kadmin server in each realm, the <strong>admin_server</strong> tag must be set in the -<a class="reference internal" href="conf_files/krb5_conf.html#realms"><em>[realms]</em></a> section.</p> +<a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> section.</p> <p>An example krb5.conf file:</p> -<div class="highlight-python"><div class="highlight"><pre>[libdefaults] - default_realm = ATHENA.MIT.EDU +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">[</span><span class="n">libdefaults</span><span class="p">]</span> + <span class="n">default_realm</span> <span class="o">=</span> <span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> -[realms] - ATHENA.MIT.EDU = { - kdc = kerberos.mit.edu - kdc = kerberos-1.mit.edu - admin_server = kerberos.mit.edu - } +<span class="p">[</span><span class="n">realms</span><span class="p">]</span> + <span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="o">=</span> <span class="p">{</span> + <span class="n">kdc</span> <span class="o">=</span> <span class="n">kerberos</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> + <span class="n">kdc</span> <span class="o">=</span> <span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> + <span class="n">admin_server</span> <span class="o">=</span> <span class="n">kerberos</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> + <span class="p">}</span> </pre></div> </div> </div> @@ -160,33 +159,33 @@ tag must be set in the KDC and kadmind, as well as realm-specific defaults, the database type and location, and logging.</p> <p>An example kdc.conf file:</p> -<div class="highlight-python"><div class="highlight"><pre>[kdcdefaults] - kdc_listen = 88 - kdc_tcp_listen = 88 +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="p">[</span><span class="n">kdcdefaults</span><span class="p">]</span> + <span class="n">kdc_listen</span> <span class="o">=</span> <span class="mi">88</span> + <span class="n">kdc_tcp_listen</span> <span class="o">=</span> <span class="mi">88</span> -[realms] - ATHENA.MIT.EDU = { - kadmind_port = 749 - max_life = 12h 0m 0s - max_renewable_life = 7d 0h 0m 0s - master_key_type = aes256-cts - supported_enctypes = aes256-cts:normal aes128-cts:normal - # If the default location does not suit your setup, - # explicitly configure the following values: - # database_name = /var/krb5kdc/principal - # key_stash_file = /var/krb5kdc/.k5.ATHENA.MIT.EDU - # acl_file = /var/krb5kdc/kadm5.acl - } +<span class="p">[</span><span class="n">realms</span><span class="p">]</span> + <span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="o">=</span> <span class="p">{</span> + <span class="n">kadmind_port</span> <span class="o">=</span> <span class="mi">749</span> + <span class="n">max_life</span> <span class="o">=</span> <span class="mi">12</span><span class="n">h</span> <span class="mi">0</span><span class="n">m</span> <span class="mi">0</span><span class="n">s</span> + <span class="n">max_renewable_life</span> <span class="o">=</span> <span class="mi">7</span><span class="n">d</span> <span class="mi">0</span><span class="n">h</span> <span class="mi">0</span><span class="n">m</span> <span class="mi">0</span><span class="n">s</span> + <span class="n">master_key_type</span> <span class="o">=</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span> + <span class="n">supported_enctypes</span> <span class="o">=</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="p">:</span><span class="n">normal</span> <span class="n">aes128</span><span class="o">-</span><span class="n">cts</span><span class="p">:</span><span class="n">normal</span> + <span class="c1"># If the default location does not suit your setup,</span> + <span class="c1"># explicitly configure the following values:</span> + <span class="c1"># database_name = /var/krb5kdc/principal</span> + <span class="c1"># key_stash_file = /var/krb5kdc/.k5.ATHENA.MIT.EDU</span> + <span class="c1"># acl_file = /var/krb5kdc/kadm5.acl</span> + <span class="p">}</span> -[logging] - # By default, the KDC and kadmind will log output using - # syslog. You can instead send log output to files like this: - kdc = FILE:/var/log/krb5kdc.log - admin_server = FILE:/var/log/kadmin.log - default = FILE:/var/log/krb5lib.log +<span class="p">[</span><span class="n">logging</span><span class="p">]</span> + <span class="c1"># By default, the KDC and kadmind will log output using</span> + <span class="c1"># syslog. You can instead send log output to files like this:</span> + <span class="n">kdc</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">log</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">.</span><span class="n">log</span> + <span class="n">admin_server</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">log</span><span class="o">/</span><span class="n">kadmin</span><span class="o">.</span><span class="n">log</span> + <span class="n">default</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">log</span><span class="o">/</span><span class="n">krb5lib</span><span class="o">.</span><span class="n">log</span> </pre></div> </div> -<p>Replace <tt class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></tt> and <tt class="docutils literal"><span class="pre">kerberos.mit.edu</span></tt> with the name of +<p>Replace <code class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></code> and <code class="docutils literal"><span class="pre">kerberos.mit.edu</span></code> with the name of your Kerberos realm and server respectively.</p> <div class="admonition note"> <p class="first admonition-title">Note</p> @@ -198,8 +197,8 @@ your Kerberos realm and server respectively.</p> </div> <div class="section" id="create-the-kdc-database"> <span id="create-db"></span><h2>Create the KDC database<a class="headerlink" href="#create-the-kdc-database" title="Permalink to this headline">¶</a></h2> -<p>You will use the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><em>kdb5_util</em></a> command on the master KDC to -create the Kerberos database and the optional <a class="reference internal" href="../basic/stash_file_def.html#stash-definition"><em>stash file</em></a>.</p> +<p>You will use the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> command on the primary KDC to +create the Kerberos database and the optional <a class="reference internal" href="../basic/stash_file_def.html#stash-definition"><span class="std std-ref">stash file</span></a>.</p> <div class="admonition note"> <p class="first admonition-title">Note</p> <p class="last">If you choose not to install a stash file, the KDC will @@ -207,7 +206,7 @@ prompt you for the master key each time it starts up. This means that the KDC will not be able to start automatically, such as after a system reboot.</p> </div> -<p><a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><em>kdb5_util</em></a> will prompt you for the master password for the +<p><a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> will prompt you for the master password for the Kerberos database. This password can be any string. A good password is one you can remember, but that no one else can guess. Examples of bad passwords are words that can be found in a dictionary, any common @@ -215,46 +214,46 @@ or popular name, especially a famous person (or cartoon character), your username in any form (e.g., forward, backward, repeated twice, etc.), and any of the sample passwords that appear in this manual. One example of a password which might be good if it did not appear in -this manual is “MITiys4K5!”, which represents the sentence “MIT is -your source for Kerberos 5!” (It’s the first letter of each word, -substituting the numeral “4” for the word “for”, and includes the +this manual is “MITiys4K5!”, which represents the sentence “MIT is +your source for Kerberos 5!” (It’s the first letter of each word, +substituting the numeral “4” for the word “for”, and includes the punctuation mark at the end.)</p> <p>The following is an example of how to create a Kerberos database and -stash file on the master KDC, using the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><em>kdb5_util</em></a> command. -Replace <tt class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></tt> with the name of your Kerberos realm:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kdb5_util create -r ATHENA.MIT.EDU -s +stash file on the primary KDC, using the <a class="reference internal" href="admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a> command. +Replace <code class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></code> with the name of your Kerberos realm:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kdb5_util</span> <span class="n">create</span> <span class="o">-</span><span class="n">r</span> <span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="o">-</span><span class="n">s</span> -Initializing database '/usr/local/var/krb5kdc/principal' for realm 'ATHENA.MIT.EDU', -master key name 'K/M@ATHENA.MIT.EDU' -You will be prompted for the database Master Password. -It is important that you NOT FORGET this password. -Enter KDC database master key: <= Type the master password. -Re-enter KDC database master key to verify: <= Type it again. -shell% +<span class="n">Initializing</span> <span class="n">database</span> <span class="s1">'/usr/local/var/krb5kdc/principal'</span> <span class="k">for</span> <span class="n">realm</span> <span class="s1">'ATHENA.MIT.EDU'</span><span class="p">,</span> +<span class="n">master</span> <span class="n">key</span> <span class="n">name</span> <span class="s1">'K/M@ATHENA.MIT.EDU'</span> +<span class="n">You</span> <span class="n">will</span> <span class="n">be</span> <span class="n">prompted</span> <span class="k">for</span> <span class="n">the</span> <span class="n">database</span> <span class="n">Master</span> <span class="n">Password</span><span class="o">.</span> +<span class="n">It</span> <span class="ow">is</span> <span class="n">important</span> <span class="n">that</span> <span class="n">you</span> <span class="n">NOT</span> <span class="n">FORGET</span> <span class="n">this</span> <span class="n">password</span><span class="o">.</span> +<span class="n">Enter</span> <span class="n">KDC</span> <span class="n">database</span> <span class="n">master</span> <span class="n">key</span><span class="p">:</span> <span class="o"><=</span> <span class="n">Type</span> <span class="n">the</span> <span class="n">master</span> <span class="n">password</span><span class="o">.</span> +<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">KDC</span> <span class="n">database</span> <span class="n">master</span> <span class="n">key</span> <span class="n">to</span> <span class="n">verify</span><span class="p">:</span> <span class="o"><=</span> <span class="n">Type</span> <span class="n">it</span> <span class="n">again</span><span class="o">.</span> +<span class="n">shell</span><span class="o">%</span> </pre></div> </div> -<p>This will create five files in <a class="reference internal" href="../mitK5defaults.html#paths"><em>LOCALSTATEDIR</em></a><tt class="docutils literal"><span class="pre">/krb5kdc</span></tt> (or at the locations specified -in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>):</p> +<p>This will create five files in <a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal"><span class="pre">/krb5kdc</span></code> (or at the locations specified +in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>):</p> <ul class="simple"> -<li>two Kerberos database files, <tt class="docutils literal"><span class="pre">principal</span></tt>, and <tt class="docutils literal"><span class="pre">principal.ok</span></tt></li> -<li>the Kerberos administrative database file, <tt class="docutils literal"><span class="pre">principal.kadm5</span></tt></li> -<li>the administrative database lock file, <tt class="docutils literal"><span class="pre">principal.kadm5.lock</span></tt></li> -<li>the stash file, in this example <tt class="docutils literal"><span class="pre">.k5.ATHENA.MIT.EDU</span></tt>. If you do +<li>two Kerberos database files, <code class="docutils literal"><span class="pre">principal</span></code>, and <code class="docutils literal"><span class="pre">principal.ok</span></code></li> +<li>the Kerberos administrative database file, <code class="docutils literal"><span class="pre">principal.kadm5</span></code></li> +<li>the administrative database lock file, <code class="docutils literal"><span class="pre">principal.kadm5.lock</span></code></li> +<li>the stash file, in this example <code class="docutils literal"><span class="pre">.k5.ATHENA.MIT.EDU</span></code>. If you do not want a stash file, run the above command without the <strong>-s</strong> option.</li> </ul> <p>For more information on administrating Kerberos database see -<a class="reference internal" href="database.html#db-operations"><em>Operations on the Kerberos database</em></a>.</p> +<a class="reference internal" href="database.html#db-operations"><span class="std std-ref">Operations on the Kerberos database</span></a>.</p> </div> <div class="section" id="add-administrators-to-the-acl-file"> <span id="admin-acl"></span><h2>Add administrators to the ACL file<a class="headerlink" href="#add-administrators-to-the-acl-file" title="Permalink to this headline">¶</a></h2> <p>Next, you need create an Access Control List (ACL) file and put the Kerberos principal of at least one of the administrators into it. -This file is used by the <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><em>kadmind</em></a> daemon to control which +This file is used by the <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> daemon to control which principals may view and make privileged modifications to the Kerberos database files. The ACL filename is determined by the <strong>acl_file</strong> -variable in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>; the default is <a class="reference internal" href="../mitK5defaults.html#paths"><em>LOCALSTATEDIR</em></a><tt class="docutils literal"><span class="pre">/krb5kdc</span></tt><tt class="docutils literal"><span class="pre">/kadm5.acl</span></tt>.</p> -<p>For more information on Kerberos ACL file see <a class="reference internal" href="conf_files/kadm5_acl.html#kadm5-acl-5"><em>kadm5.acl</em></a>.</p> +variable in <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>; the default is <a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal"><span class="pre">/krb5kdc</span></code><code class="docutils literal"><span class="pre">/kadm5.acl</span></code>.</p> +<p>For more information on Kerberos ACL file see <a class="reference internal" href="conf_files/kadm5_acl.html#kadm5-acl-5"><span class="std std-ref">kadm5.acl</span></a>.</p> </div> <div class="section" id="add-administrators-to-the-kerberos-database"> <span id="addadmin-kdb"></span><h2>Add administrators to the Kerberos database<a class="headerlink" href="#add-administrators-to-the-kerberos-database" title="Permalink to this headline">¶</a></h2> @@ -263,33 +262,33 @@ are allowed to administer Kerberos database) to the Kerberos database. You <em>must</em> add at least one principal now to allow communication between the Kerberos administration daemon kadmind and the kadmin program over the network for further administration. To do this, use -the kadmin.local utility on the master KDC. kadmin.local is designed -to be run on the master KDC host without using Kerberos authentication -to an admin server; instead, it must have read and write access to the -Kerberos database on the local filesystem.</p> +the kadmin.local utility on the primary KDC. kadmin.local is designed +to be run on the primary KDC host without using Kerberos +authentication to an admin server; instead, it must have read and +write access to the Kerberos database on the local filesystem.</p> <p>The administrative principals you create should be the ones you added -to the ACL file (see <a class="reference internal" href="#admin-acl"><em>Add administrators to the ACL file</em></a>).</p> -<p>In the following example, the administrative principal <tt class="docutils literal"><span class="pre">admin/admin</span></tt> +to the ACL file (see <a class="reference internal" href="#admin-acl"><span class="std std-ref">Add administrators to the ACL file</span></a>).</p> +<p>In the following example, the administrative principal <code class="docutils literal"><span class="pre">admin/admin</span></code> is created:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kadmin.local +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kadmin</span><span class="o">.</span><span class="n">local</span> -kadmin.local: addprinc admin/admin@ATHENA.MIT.EDU +<span class="n">kadmin</span><span class="o">.</span><span class="n">local</span><span class="p">:</span> <span class="n">addprinc</span> <span class="n">admin</span><span class="o">/</span><span class="n">admin</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> -WARNING: no policy specified for "admin/admin@ATHENA.MIT.EDU"; -assigning "default". -Enter password for principal admin/admin@ATHENA.MIT.EDU: <= Enter a password. -Re-enter password for principal admin/admin@ATHENA.MIT.EDU: <= Type it again. -Principal "admin/admin@ATHENA.MIT.EDU" created. -kadmin.local: +<span class="n">No</span> <span class="n">policy</span> <span class="n">specified</span> <span class="k">for</span> <span class="s2">"admin/admin@ATHENA.MIT.EDU"</span><span class="p">;</span> +<span class="n">assigning</span> <span class="s2">"default"</span><span class="o">.</span> +<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">admin</span><span class="o">/</span><span class="n">admin</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> <span class="o"><=</span> <span class="n">Enter</span> <span class="n">a</span> <span class="n">password</span><span class="o">.</span> +<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">admin</span><span class="o">/</span><span class="n">admin</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> <span class="o"><=</span> <span class="n">Type</span> <span class="n">it</span> <span class="n">again</span><span class="o">.</span> +<span class="n">Principal</span> <span class="s2">"admin/admin@ATHENA.MIT.EDU"</span> <span class="n">created</span><span class="o">.</span> +<span class="n">kadmin</span><span class="o">.</span><span class="n">local</span><span class="p">:</span> </pre></div> </div> </div> -<div class="section" id="start-the-kerberos-daemons-on-the-master-kdc"> -<span id="start-kdc-daemons"></span><h2>Start the Kerberos daemons on the master KDC<a class="headerlink" href="#start-the-kerberos-daemons-on-the-master-kdc" title="Permalink to this headline">¶</a></h2> +<div class="section" id="start-the-kerberos-daemons-on-the-primary-kdc"> +<span id="start-kdc-daemons"></span><h2>Start the Kerberos daemons on the primary KDC<a class="headerlink" href="#start-the-kerberos-daemons-on-the-primary-kdc" title="Permalink to this headline">¶</a></h2> <p>At this point, you are ready to start the Kerberos KDC -(<a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8"><em>krb5kdc</em></a>) and administrative daemons on the Master KDC. To +(<a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a>) and administrative daemons on the primary KDC. To do so, type:</p> -<div class="highlight-python"><div class="highlight"><pre><span class="n">shell</span><span class="o">%</span> <span class="n">krb5kdc</span> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">krb5kdc</span> <span class="n">shell</span><span class="o">%</span> <span class="n">kadmind</span> </pre></div> </div> @@ -297,96 +296,98 @@ do so, type:</p> <div class="admonition note"> <p class="first admonition-title">Note</p> <p class="last">Assuming you want these daemons to start up automatically at -boot time, you can add them to the KDC’s <tt class="docutils literal"><span class="pre">/etc/rc</span></tt> or -<tt class="docutils literal"><span class="pre">/etc/inittab</span></tt> file. You need to have a -<a class="reference internal" href="../basic/stash_file_def.html#stash-definition"><em>stash file</em></a> in order to do this.</p> +boot time, you can add them to the KDC’s <code class="docutils literal"><span class="pre">/etc/rc</span></code> or +<code class="docutils literal"><span class="pre">/etc/inittab</span></code> file. You need to have a +<a class="reference internal" href="../basic/stash_file_def.html#stash-definition"><span class="std std-ref">stash file</span></a> in order to do this.</p> </div> <p>You can verify that they started properly by checking for their startup messages in the logging locations you defined in -<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> (see <a class="reference internal" href="conf_files/kdc_conf.html#logging"><em>[logging]</em></a>). For example:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% tail /var/log/krb5kdc.log -Dec 02 12:35:47 beeblebrox krb5kdc[3187](info): commencing operation -shell% tail /var/log/kadmin.log -Dec 02 12:35:52 beeblebrox kadmind[3189](info): starting +<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> (see <a class="reference internal" href="conf_files/kdc_conf.html#logging"><span class="std std-ref">[logging]</span></a>). For example:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">tail</span> <span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">log</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">.</span><span class="n">log</span> +<span class="n">Dec</span> <span class="mi">02</span> <span class="mi">12</span><span class="p">:</span><span class="mi">35</span><span class="p">:</span><span class="mi">47</span> <span class="n">beeblebrox</span> <span class="n">krb5kdc</span><span class="p">[</span><span class="mi">3187</span><span class="p">](</span><span class="n">info</span><span class="p">):</span> <span class="n">commencing</span> <span class="n">operation</span> +<span class="n">shell</span><span class="o">%</span> <span class="n">tail</span> <span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">log</span><span class="o">/</span><span class="n">kadmin</span><span class="o">.</span><span class="n">log</span> +<span class="n">Dec</span> <span class="mi">02</span> <span class="mi">12</span><span class="p">:</span><span class="mi">35</span><span class="p">:</span><span class="mi">52</span> <span class="n">beeblebrox</span> <span class="n">kadmind</span><span class="p">[</span><span class="mi">3189</span><span class="p">](</span><span class="n">info</span><span class="p">):</span> <span class="n">starting</span> </pre></div> </div> <p>Any errors the daemons encounter while starting will also be listed in the logging output.</p> -<p>As an additional verification, check if <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><em>kinit</em></a> succeeds +<p>As an additional verification, check if <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> succeeds against the principals that you have created on the previous step -(<a class="reference internal" href="#addadmin-kdb"><em>Add administrators to the Kerberos database</em></a>). Run:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kinit admin/admin@ATHENA.MIT.EDU +(<a class="reference internal" href="#addadmin-kdb"><span class="std std-ref">Add administrators to the Kerberos database</span></a>). Run:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kinit</span> <span class="n">admin</span><span class="o">/</span><span class="n">admin</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> </pre></div> </div> </div> -<div class="section" id="install-the-slave-kdcs"> -<h2>Install the slave KDCs<a class="headerlink" href="#install-the-slave-kdcs" title="Permalink to this headline">¶</a></h2> -<p>You are now ready to start configuring the slave KDCs.</p> +<div class="section" id="install-the-replica-kdcs"> +<h2>Install the replica KDCs<a class="headerlink" href="#install-the-replica-kdcs" title="Permalink to this headline">¶</a></h2> +<p>You are now ready to start configuring the replica KDCs.</p> <div class="admonition note"> <p class="first admonition-title">Note</p> <p class="last">Assuming you are setting the KDCs up so that you can easily -switch the master KDC with one of the slaves, you should -perform each of these steps on the master KDC as well as the -slave KDCs, unless these instructions specify otherwise.</p> +switch the primary KDC with one of the replicas, you should +perform each of these steps on the primary KDC as well as +the replica KDCs, unless these instructions specify +otherwise.</p> </div> -<div class="section" id="create-host-keytabs-for-slave-kdcs"> -<span id="slave-host-key"></span><h3>Create host keytabs for slave KDCs<a class="headerlink" href="#create-host-keytabs-for-slave-kdcs" title="Permalink to this headline">¶</a></h3> -<p>Each KDC needs a <tt class="docutils literal"><span class="pre">host</span></tt> key in the Kerberos database. These keys +<div class="section" id="create-host-keytabs-for-replica-kdcs"> +<span id="replica-host-key"></span><h3>Create host keytabs for replica KDCs<a class="headerlink" href="#create-host-keytabs-for-replica-kdcs" title="Permalink to this headline">¶</a></h3> +<p>Each KDC needs a <code class="docutils literal"><span class="pre">host</span></code> key in the Kerberos database. These keys are used for mutual authentication when propagating the database dump -file from the master KDC to the secondary KDC servers.</p> -<p>On the master KDC, connect to administrative interface and create the -host principal for each of the KDCs’ <tt class="docutils literal"><span class="pre">host</span></tt> services. For example, -if the master KDC were called <tt class="docutils literal"><span class="pre">kerberos.mit.edu</span></tt>, and you had a -slave KDC named <tt class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></tt>, you would type the following:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kadmin -kadmin: addprinc -randkey host/kerberos.mit.edu -NOTICE: no policy specified for "host/kerberos.mit.edu@ATHENA.MIT.EDU"; assigning "default" -Principal "host/kerberos.mit.edu@ATHENA.MIT.EDU" created. +file from the primary KDC to the secondary KDC servers.</p> +<p>On the primary KDC, connect to administrative interface and create the +host principal for each of the KDCs’ <code class="docutils literal"><span class="pre">host</span></code> services. For example, +if the primary KDC were called <code class="docutils literal"><span class="pre">kerberos.mit.edu</span></code>, and you had a +replica KDC named <code class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></code>, you would type the +following:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kadmin</span> +<span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">-</span><span class="n">randkey</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> +<span class="n">No</span> <span class="n">policy</span> <span class="n">specified</span> <span class="k">for</span> <span class="s2">"host/kerberos.mit.edu@ATHENA.MIT.EDU"</span><span class="p">;</span> <span class="n">assigning</span> <span class="s2">"default"</span> +<span class="n">Principal</span> <span class="s2">"host/kerberos.mit.edu@ATHENA.MIT.EDU"</span> <span class="n">created</span><span class="o">.</span> -kadmin: addprinc -randkey host/kerberos-1.mit.edu -NOTICE: no policy specified for "host/kerberos-1.mit.edu@ATHENA.MIT.EDU"; assigning "default" -Principal "host/kerberos-1.mit.edu@ATHENA.MIT.EDU" created. +<span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="o">-</span><span class="n">randkey</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> +<span class="n">No</span> <span class="n">policy</span> <span class="n">specified</span> <span class="k">for</span> <span class="s2">"host/kerberos-1.mit.edu@ATHENA.MIT.EDU"</span><span class="p">;</span> <span class="n">assigning</span> <span class="s2">"default"</span> +<span class="n">Principal</span> <span class="s2">"host/kerberos-1.mit.edu@ATHENA.MIT.EDU"</span> <span class="n">created</span><span class="o">.</span> </pre></div> </div> -<p>It is not strictly necessary to have the master KDC server in the +<p>It is not strictly necessary to have the primary KDC server in the Kerberos database, but it can be handy if you want to be able to swap -the master KDC with one of the slaves.</p> -<p>Next, extract <tt class="docutils literal"><span class="pre">host</span></tt> random keys for all participating KDCs and -store them in each host’s default keytab file. Ideally, you should +the primary KDC with one of the replicas.</p> +<p>Next, extract <code class="docutils literal"><span class="pre">host</span></code> random keys for all participating KDCs and +store them in each host’s default keytab file. Ideally, you should extract each keytab locally on its own KDC. If this is not feasible, you should use an encrypted session to send them across the network. -To extract a keytab directly on a slave KDC called -<tt class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></tt>, you would execute the following command:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: ktadd host/kerberos-1.mit.edu -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type des3-cbc-sha1 added to keytab FILE:/etc/krb5.keytab. -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type arcfour-hmac added to keytab FILE:/etc/krb5.keytab. +To extract a keytab directly on a replica KDC called +<code class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></code>, you would execute the following command:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">ktadd</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">aes128</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha384</span><span class="o">-</span><span class="mi">192</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">arcfour</span><span class="o">-</span><span class="n">hmac</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> </pre></div> </div> -<p>If you are instead extracting a keytab for the slave KDC called -<tt class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></tt> on the master KDC, you should use a dedicated -temporary keytab file for that machine’s keytab:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: ktadd -k /tmp/kerberos-1.keytab host/kerberos-1.mit.edu -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type aes256-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. -Entry for principal host/kerberos-1.mit.edu with kvno 2, encryption - type aes128-cts-hmac-sha1-96 added to keytab FILE:/etc/krb5.keytab. +<p>If you are instead extracting a keytab for the replica KDC called +<code class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></code> on the primary KDC, you should use a dedicated +temporary keytab file for that machine’s keytab:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">ktadd</span> <span class="o">-</span><span class="n">k</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">keytab</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">2</span><span class="p">,</span> <span class="n">encryption</span> + <span class="nb">type</span> <span class="n">aes128</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span><span class="o">.</span> </pre></div> </div> -<p>The file <tt class="docutils literal"><span class="pre">/tmp/kerberos-1.keytab</span></tt> can then be installed as -<tt class="docutils literal"><span class="pre">/etc/krb5.keytab</span></tt> on the host <tt class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></tt>.</p> +<p>The file <code class="docutils literal"><span class="pre">/tmp/kerberos-1.keytab</span></code> can then be installed as +<code class="docutils literal"><span class="pre">/etc/krb5.keytab</span></code> on the host <code class="docutils literal"><span class="pre">kerberos-1.mit.edu</span></code>.</p> </div> -<div class="section" id="configure-slave-kdcs"> -<h3>Configure slave KDCs<a class="headerlink" href="#configure-slave-kdcs" title="Permalink to this headline">¶</a></h3> -<p>Database propagation copies the contents of the master’s database, but -does not propagate configuration files, stash files, or the kadm5 ACL -file. The following files must be copied by hand to each slave (see -<a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><em>MIT Kerberos defaults</em></a> for the default locations for these files):</p> +<div class="section" id="configure-replica-kdcs"> +<h3>Configure replica KDCs<a class="headerlink" href="#configure-replica-kdcs" title="Permalink to this headline">¶</a></h3> +<p>Database propagation copies the contents of the primary’s database, +but does not propagate configuration files, stash files, or the kadm5 +ACL file. The following files must be copied by hand to each replica +(see <a class="reference internal" href="../mitK5defaults.html#mitk5defaults"><span class="std std-ref">MIT Kerberos defaults</span></a> for the default locations for these files):</p> <ul class="simple"> <li>krb5.conf</li> <li>kdc.conf</li> @@ -394,98 +395,98 @@ file. The following files must be copied by hand to each slave (see <li>master key stash file</li> </ul> <p>Move the copied files into their appropriate directories, exactly as -on the master KDC. kadm5.acl is only needed to allow a slave to swap -with the master KDC.</p> -<p>The database is propagated from the master KDC to the slave KDCs via -the <a class="reference internal" href="admin_commands/kpropd.html#kpropd-8"><em>kpropd</em></a> daemon. You must explicitly specify the +on the primary KDC. kadm5.acl is only needed to allow a replica to +swap with the primary KDC.</p> +<p>The database is propagated from the primary KDC to the replica KDCs +via the <a class="reference internal" href="admin_commands/kpropd.html#kpropd-8"><span class="std std-ref">kpropd</span></a> daemon. You must explicitly specify the principals which are allowed to provide Kerberos dump updates on the -slave machine with a new database. Create a file named kpropd.acl in -the KDC state directory containing the <tt class="docutils literal"><span class="pre">host</span></tt> principals for each of -the KDCs:</p> -<div class="highlight-python"><div class="highlight"><pre>host/kerberos.mit.edu@ATHENA.MIT.EDU -host/kerberos-1.mit.edu@ATHENA.MIT.EDU +replica machine with a new database. Create a file named kpropd.acl +in the KDC state directory containing the <code class="docutils literal"><span class="pre">host</span></code> principals for each +of the KDCs:</p> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> +<span class="n">host</span><span class="o">/</span><span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> </pre></div> </div> <div class="admonition note"> <p class="first admonition-title">Note</p> -<p class="last">If you expect that the master and slave KDCs will be +<p class="last">If you expect that the primary and replica KDCs will be switched at some point of time, list the host principals from all participating KDC servers in kpropd.acl files on all of the KDCs. Otherwise, you only need to list the -master KDC’s host principal in the kpropd.acl files of the -slave KDCs.</p> +primary KDC’s host principal in the kpropd.acl files of the +replica KDCs.</p> </div> -<p>Then, add the following line to <tt class="docutils literal"><span class="pre">/etc/inetd.conf</span></tt> on each KDC +<p>Then, add the following line to <code class="docutils literal"><span class="pre">/etc/inetd.conf</span></code> on each KDC (adjust the path to kpropd):</p> -<div class="highlight-python"><div class="highlight"><pre>krb5_prop stream tcp nowait root /usr/local/sbin/kpropd kpropd +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">krb5_prop</span> <span class="n">stream</span> <span class="n">tcp</span> <span class="n">nowait</span> <span class="n">root</span> <span class="o">/</span><span class="n">usr</span><span class="o">/</span><span class="n">local</span><span class="o">/</span><span class="n">sbin</span><span class="o">/</span><span class="n">kpropd</span> <span class="n">kpropd</span> </pre></div> </div> -<p>You also need to add the following line to <tt class="docutils literal"><span class="pre">/etc/services</span></tt> on each +<p>You also need to add the following line to <code class="docutils literal"><span class="pre">/etc/services</span></code> on each KDC, if it is not already present (assuming that the default port is used):</p> -<div class="highlight-python"><div class="highlight"><pre>krb5_prop 754/tcp # Kerberos slave propagation +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">krb5_prop</span> <span class="mi">754</span><span class="o">/</span><span class="n">tcp</span> <span class="c1"># Kerberos replica propagation</span> </pre></div> </div> <p>Restart inetd daemon.</p> -<p>Alternatively, start <a class="reference internal" href="admin_commands/kpropd.html#kpropd-8"><em>kpropd</em></a> as a stand-alone daemon. This is +<p>Alternatively, start <a class="reference internal" href="admin_commands/kpropd.html#kpropd-8"><span class="std std-ref">kpropd</span></a> as a stand-alone daemon. This is required when incremental propagation is enabled.</p> -<p>Now that the slave KDC is able to accept database propagation, you’ll -need to propagate the database from the master server.</p> -<p>NOTE: Do not start the slave KDC yet; you still do not have a copy of -the master’s database.</p> +<p>Now that the replica KDC is able to accept database propagation, +you’ll need to propagate the database from the primary server.</p> +<p>NOTE: Do not start the replica KDC yet; you still do not have a copy +of the primary’s database.</p> </div> -<div class="section" id="propagate-the-database-to-each-slave-kdc"> -<span id="kprop-to-slaves"></span><h3>Propagate the database to each slave KDC<a class="headerlink" href="#propagate-the-database-to-each-slave-kdc" title="Permalink to this headline">¶</a></h3> -<p>First, create a dump file of the database on the master KDC, as +<div class="section" id="propagate-the-database-to-each-replica-kdc"> +<span id="kprop-to-replicas"></span><h3>Propagate the database to each replica KDC<a class="headerlink" href="#propagate-the-database-to-each-replica-kdc" title="Permalink to this headline">¶</a></h3> +<p>First, create a dump file of the database on the primary KDC, as follows:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kdb5_util dump /usr/local/var/krb5kdc/slave_datatrans +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kdb5_util</span> <span class="n">dump</span> <span class="o">/</span><span class="n">usr</span><span class="o">/</span><span class="n">local</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">replica_datatrans</span> </pre></div> </div> -<p>Then, manually propagate the database to each slave KDC, as in the +<p>Then, manually propagate the database to each replica KDC, as in the following example:</p> -<div class="highlight-python"><div class="highlight"><pre>shell% kprop -f /usr/local/var/krb5kdc/slave_datatrans kerberos-1.mit.edu +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kprop</span> <span class="o">-</span><span class="n">f</span> <span class="o">/</span><span class="n">usr</span><span class="o">/</span><span class="n">local</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">replica_datatrans</span> <span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> -Database propagation to kerberos-1.mit.edu: SUCCEEDED +<span class="n">Database</span> <span class="n">propagation</span> <span class="n">to</span> <span class="n">kerberos</span><span class="o">-</span><span class="mf">1.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span><span class="p">:</span> <span class="n">SUCCEEDED</span> </pre></div> </div> <p>You will need a script to dump and propagate the database. The following is an example of a Bourne shell script that will do this.</p> <div class="admonition note"> <p class="first admonition-title">Note</p> -<p class="last">Remember that you need to replace <tt class="docutils literal"><span class="pre">/usr/local/var/krb5kdc</span></tt> +<p class="last">Remember that you need to replace <code class="docutils literal"><span class="pre">/usr/local/var/krb5kdc</span></code> with the name of the KDC state directory.</p> </div> -<div class="highlight-python"><div class="highlight"><pre>#!/bin/sh +<div class="highlight-default"><div class="highlight"><pre><span></span>#!/bin/sh kdclist = "kerberos-1.mit.edu kerberos-2.mit.edu" -kdb5_util dump /usr/local/var/krb5kdc/slave_datatrans +kdb5_util dump /usr/local/var/krb5kdc/replica_datatrans for kdc in $kdclist do - kprop -f /usr/local/var/krb5kdc/slave_datatrans $kdc + kprop -f /usr/local/var/krb5kdc/replica_datatrans $kdc done </pre></div> </div> <p>You will need to set up a cron job to run this script at the intervals -you decided on earlier (see <a class="reference internal" href="realm_config.html#db-prop"><em>Database propagation</em></a>).</p> -<p>Now that the slave KDC has a copy of the Kerberos database, you can +you decided on earlier (see <a class="reference internal" href="realm_config.html#db-prop"><span class="std std-ref">Database propagation</span></a>).</p> +<p>Now that the replica KDC has a copy of the Kerberos database, you can start the krb5kdc daemon:</p> -<div class="highlight-python"><div class="highlight"><pre><span class="n">shell</span><span class="o">%</span> <span class="n">krb5kdc</span> +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">krb5kdc</span> </pre></div> </div> -<p>As with the master KDC, you will probably want to add this command to -the KDCs’ <tt class="docutils literal"><span class="pre">/etc/rc</span></tt> or <tt class="docutils literal"><span class="pre">/etc/inittab</span></tt> files, so they will start +<p>As with the primary KDC, you will probably want to add this command to +the KDCs’ <code class="docutils literal"><span class="pre">/etc/rc</span></code> or <code class="docutils literal"><span class="pre">/etc/inittab</span></code> files, so they will start the krb5kdc daemon automatically at boot time.</p> <div class="section" id="propagation-failed"> <h4>Propagation failed?<a class="headerlink" href="#propagation-failed" title="Permalink to this headline">¶</a></h4> <p>You may encounter the following error messages. For a more detailed discussion on possible causes and solutions click on the error link -to be redirected to <a class="reference internal" href="troubleshoot.html#troubleshoot"><em>Troubleshooting</em></a> section.</p> +to be redirected to <a class="reference internal" href="troubleshoot.html#troubleshoot"><span class="std std-ref">Troubleshooting</span></a> section.</p> <ol class="arabic simple"> -<li><a class="reference internal" href="troubleshoot.html#kprop-no-route"><em>kprop: No route to host while connecting to server</em></a></li> -<li><a class="reference internal" href="troubleshoot.html#kprop-con-refused"><em>kprop: Connection refused while connecting to server</em></a></li> -<li><a class="reference internal" href="troubleshoot.html#kprop-sendauth-exchange"><em>kprop: Server rejected authentication (during sendauth exchange) while authenticating to server</em></a></li> +<li><a class="reference internal" href="troubleshoot.html#kprop-no-route"><span class="std std-ref">kprop: No route to host while connecting to server</span></a></li> +<li><a class="reference internal" href="troubleshoot.html#kprop-con-refused"><span class="std std-ref">kprop: Connection refused while connecting to server</span></a></li> +<li><a class="reference internal" href="troubleshoot.html#kprop-sendauth-exchange"><span class="std std-ref">kprop: Server rejected authentication (during sendauth exchange) while authenticating to server</span></a></li> </ol> </div> </div> @@ -493,46 +494,46 @@ to be redirected to <a class="reference internal" href="troubleshoot.html#troubl <div class="section" id="add-kerberos-principals-to-the-database"> <h2>Add Kerberos principals to the database<a class="headerlink" href="#add-kerberos-principals-to-the-database" title="Permalink to this headline">¶</a></h2> <p>Once your KDCs are set up and running, you are ready to use -<a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><em>kadmin</em></a> to load principals for your users, hosts, and other +<a class="reference internal" href="admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> to load principals for your users, hosts, and other services into the Kerberos database. This procedure is described -fully in <a class="reference internal" href="database.html#add-mod-del-princs"><em>Adding, modifying and deleting principals</em></a>.</p> -<p>You may occasionally want to use one of your slave KDCs as the master. -This might happen if you are upgrading the master KDC, or if your -master KDC has a disk crash. See the following section for the -instructions.</p> +fully in <a class="reference internal" href="database.html#principals"><span class="std std-ref">Principals</span></a>.</p> +<p>You may occasionally want to use one of your replica KDCs as the +primary. This might happen if you are upgrading the primary KDC, or +if your primary KDC has a disk crash. See the following section for +the instructions.</p> </div> -<div class="section" id="switching-master-and-slave-kdcs"> -<span id="switch-master-slave"></span><h2>Switching master and slave KDCs<a class="headerlink" href="#switching-master-and-slave-kdcs" title="Permalink to this headline">¶</a></h2> -<p>You may occasionally want to use one of your slave KDCs as the master. -This might happen if you are upgrading the master KDC, or if your -master KDC has a disk crash.</p> +<div class="section" id="switching-primary-and-replica-kdcs"> +<span id="switch-primary-replica"></span><h2>Switching primary and replica KDCs<a class="headerlink" href="#switching-primary-and-replica-kdcs" title="Permalink to this headline">¶</a></h2> +<p>You may occasionally want to use one of your replica KDCs as the +primary. This might happen if you are upgrading the primary KDC, or +if your primary KDC has a disk crash.</p> <p>Assuming you have configured all of your KDCs to be able to function -as either the master KDC or a slave KDC (as this document recommends), -all you need to do to make the changeover is:</p> -<p>If the master KDC is still running, do the following on the <em>old</em> -master KDC:</p> +as either the primary KDC or a replica KDC (as this document +recommends), all you need to do to make the changeover is:</p> +<p>If the primary KDC is still running, do the following on the <em>old</em> +primary KDC:</p> <ol class="arabic simple"> <li>Kill the kadmind process.</li> <li>Disable the cron job that propagates the database.</li> <li>Run your database propagation script manually, to ensure that the -slaves all have the latest copy of the database (see -<a class="reference internal" href="#kprop-to-slaves"><em>Propagate the database to each slave KDC</em></a>).</li> +replicas all have the latest copy of the database (see +<a class="reference internal" href="#kprop-to-replicas"><span class="std std-ref">Propagate the database to each replica KDC</span></a>).</li> </ol> -<p>On the <em>new</em> master KDC:</p> +<p>On the <em>new</em> primary KDC:</p> <ol class="arabic simple"> -<li>Start the <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><em>kadmind</em></a> daemon (see <a class="reference internal" href="#start-kdc-daemons"><em>Start the Kerberos daemons on the master KDC</em></a>).</li> +<li>Start the <a class="reference internal" href="admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> daemon (see <a class="reference internal" href="#start-kdc-daemons"><span class="std std-ref">Start the Kerberos daemons on the primary KDC</span></a>).</li> <li>Set up the cron job to propagate the database (see -<a class="reference internal" href="#kprop-to-slaves"><em>Propagate the database to each slave KDC</em></a>).</li> -<li>Switch the CNAMEs of the old and new master KDCs. If you can’t do -this, you’ll need to change the <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> file on every +<a class="reference internal" href="#kprop-to-replicas"><span class="std std-ref">Propagate the database to each replica KDC</span></a>).</li> +<li>Switch the CNAMEs of the old and new primary KDCs. If you can’t do +this, you’ll need to change the <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file on every client machine in your Kerberos realm.</li> </ol> </div> <div class="section" id="incremental-database-propagation"> <h2>Incremental database propagation<a class="headerlink" href="#incremental-database-propagation" title="Permalink to this headline">¶</a></h2> <p>If you expect your Kerberos database to become large, you may wish to -set up incremental propagation to slave KDCs. See <a class="reference internal" href="database.html#incr-db-prop"><em>Incremental database propagation</em></a> -for details.</p> +set up incremental propagation to replica KDCs. See +<a class="reference internal" href="database.html#incr-db-prop"><span class="std std-ref">Incremental database propagation</span></a> for details.</p> </div> </div> @@ -545,7 +546,7 @@ for details.</p> <h2>On this page</h2> <ul> <li><a class="reference internal" href="#">Installing KDCs</a><ul> -<li><a class="reference internal" href="#install-and-configure-the-master-kdc">Install and configure the master KDC</a></li> +<li><a class="reference internal" href="#install-and-configure-the-primary-kdc">Install and configure the primary KDC</a></li> <li><a class="reference internal" href="#edit-kdc-configuration-files">Edit KDC configuration files</a><ul> <li><a class="reference internal" href="#krb5-conf">krb5.conf</a></li> <li><a class="reference internal" href="#kdc-conf">kdc.conf</a></li> @@ -554,18 +555,18 @@ for details.</p> <li><a class="reference internal" href="#create-the-kdc-database">Create the KDC database</a></li> <li><a class="reference internal" href="#add-administrators-to-the-acl-file">Add administrators to the ACL file</a></li> <li><a class="reference internal" href="#add-administrators-to-the-kerberos-database">Add administrators to the Kerberos database</a></li> -<li><a class="reference internal" href="#start-the-kerberos-daemons-on-the-master-kdc">Start the Kerberos daemons on the master KDC</a></li> -<li><a class="reference internal" href="#install-the-slave-kdcs">Install the slave KDCs</a><ul> -<li><a class="reference internal" href="#create-host-keytabs-for-slave-kdcs">Create host keytabs for slave KDCs</a></li> -<li><a class="reference internal" href="#configure-slave-kdcs">Configure slave KDCs</a></li> -<li><a class="reference internal" href="#propagate-the-database-to-each-slave-kdc">Propagate the database to each slave KDC</a><ul> +<li><a class="reference internal" href="#start-the-kerberos-daemons-on-the-primary-kdc">Start the Kerberos daemons on the primary KDC</a></li> +<li><a class="reference internal" href="#install-the-replica-kdcs">Install the replica KDCs</a><ul> +<li><a class="reference internal" href="#create-host-keytabs-for-replica-kdcs">Create host keytabs for replica KDCs</a></li> +<li><a class="reference internal" href="#configure-replica-kdcs">Configure replica KDCs</a></li> +<li><a class="reference internal" href="#propagate-the-database-to-each-replica-kdc">Propagate the database to each replica KDC</a><ul> <li><a class="reference internal" href="#propagation-failed">Propagation failed?</a></li> </ul> </li> </ul> </li> <li><a class="reference internal" href="#add-kerberos-principals-to-the-database">Add Kerberos principals to the database</a></li> -<li><a class="reference internal" href="#switching-master-and-slave-kdcs">Switching master and slave KDCs</a></li> +<li><a class="reference internal" href="#switching-primary-and-replica-kdcs">Switching primary and replica KDCs</a></li> <li><a class="reference internal" href="#incremental-database-propagation">Incremental database propagation</a></li> </ul> </li> @@ -577,7 +578,7 @@ for details.</p> <li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li> <li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current"> <li class="toctree-l2 current"><a class="reference internal" href="install.html">Installation guide</a><ul class="current"> -<li class="toctree-l3 current"><a class="current reference internal" href="">Installing KDCs</a></li> +<li class="toctree-l3 current"><a class="current reference internal" href="#">Installing KDCs</a></li> <li class="toctree-l3"><a class="reference internal" href="install_clients.html">Installing and configuring UNIX client machines</a></li> <li class="toctree-l3"><a class="reference internal" href="install_appl_srv.html">UNIX Application Servers</a></li> </ul> @@ -585,6 +586,7 @@ for details.</p> <li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li> <li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li> <li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li> +<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li> <li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li> <li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> <li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li> @@ -592,6 +594,8 @@ for details.</p> <li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li> <li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li> <li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li> <li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li> <li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li> @@ -631,8 +635,8 @@ for details.</p> <div class="footer-wrapper"> <div class="footer" > - <div class="right" ><i>Release: 1.16</i><br /> - © <a href="../copyright.html">Copyright</a> 1985-2017, MIT. + <div class="right" ><i>Release: 1.21.1</i><br /> + © <a href="../copyright.html">Copyright</a> 1985-2023, MIT. </div> <div class="left"> |