Print this page 
12743 man page spelling mistakes
Split Close
Expand all
Collapse all
          --- old/usr/src/man/man4/krb5.conf.4
          +++ new/usr/src/man/man4/krb5.conf.4
   1    1  '\" te
   2    2  .\" Copyright (c) 2009 Sun Microsystems, Inc. All Rights Reserved.
   3    3  .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License").  You may not use this file except in compliance with the License.
   4    4  .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing.  See the License for the specific language governing permissions and limitations under the License.
   5    5  .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE.  If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
   6      -.TH KRB5.CONF 4 "Nov 26, 2017"
        6 +.TH KRB5.CONF 4 "May 16, 2020"
   7    7  .SH NAME
   8    8  krb5.conf \- Kerberos configuration file
   9    9  .SH SYNOPSIS
  10      -.LP
  11   10  .nf
  12   11  /etc/krb5/krb5.conf
  13   12  .fi
  14   13  
  15   14  .SH DESCRIPTION
  16      -.LP
  17   15  The \fBkrb5.conf\fR file contains Kerberos configuration information, including
  18   16  the locations of \fBKDC\fRs and administration daemons for the Kerberos realms
  19   17  of interest, defaults for the current realm and for Kerberos applications, and
  20   18  mappings of host names onto Kerberos realms. This file must reside on all
  21   19  Kerberos clients.
  22   20  .sp
  23   21  .LP
  24   22  The format of the \fBkrb5.conf\fR consists of sections headings in square
  25   23  brackets. Each section can contain zero or more configuration variables (called
  26   24  \fIrelations\fR), of the form:
↓ open down ↓ 107 lines elided ↑ open up ↑ 
 134  132  .na
 135  133  \fB\fBkdc\fR\fR
 136  134  .ad
 137  135  .sp .6
 138  136  .RS 4n
 139  137  For a Key Distribution Center (\fBKDC\fR), can contain the location of the
 140  138  \fBkdc.conf\fR file.
 141  139  .RE
 142  140  
 143  141  .SS "The \fB[libdefaults]\fR Section"
 144      -.LP
 145  142  The \fB[libdefaults]\fR section can contain any of the following relations:
 146  143  .sp
 147  144  .ne 2
 148  145  .na
 149  146  \fB\fBdatabase_module\fR\fR
 150  147  .ad
 151  148  .sp .6
 152  149  .RS 4n
 153  150  Selects the \fBdbmodule\fR section entry to use to access the Kerberos
 154  151  database. If this parameter is not present the code uses the standard
↓ open down ↓ 184 lines elided ↑ open up ↑ 
 339  336  .sp
 340  337  .ne 2
 341  338  .na
 342  339  \fB\fBdns_lookup_kdc\fR\fR
 343  340  .ad
 344  341  .sp .6
 345  342  .RS 4n
 346  343  Indicates whether DNS SRV records need to be used to locate the KDCs and the
 347  344  other servers for a realm, if they have not already been listed in the
 348  345  \fB[realms]\fR section. This option makes the machine vulnerable to a certain
 349      -type of DoS attack if somone spoofs the DNS records and does a redirect to
      346 +type of DoS attack if someone spoofs the DNS records and does a redirect to
 350  347  another server. This is, however, no worse than a DoS, since the bogus KDC is
 351  348  unable to decode anything sent (excepting the initial ticket request, which has
 352  349  no encrypted data). Also, anything the fake KDC sends out isl not trusted
 353  350  without verification (the local machine is unaware of the secret key to be
 354  351  used). If \fBdns_lookup_kdc\fR is not specified but \fBdns_fallback\fR is, then
 355  352  that value is used instead. In either case, values (if present) in the
 356  353  \fB[realms]\fR section override DNS. \fBdns_lookup_kdc\fR is enabled by
 357  354  default.
 358  355  .RE
 359  356
↓ open down ↓ 40 lines elided ↑ open up ↑ 
 400  397  \fBhost/foo.bar.com@FOO.COM\fR. This entry is needed to verify that the
 401  398  \fBTGT\fR requested was issued by the same \fBKDC\fR that issued the key for
 402  399  the host principal. If undefined, the behavior is as if this option were set to
 403  400  \fBtrue\fR. Setting this value to \fBfalse\fR leaves the system vulnerable to
 404  401  \fBDNS\fR spoofing attacks. This parameter can be in the \fB[realms]\fR section
 405  402  to set it on a per-realm basis, or it can be in the \fB[libdefaults]\fR section
 406  403  to make it a network-wide setting for all realms.
 407  404  .RE
 408  405  
 409  406  .SS "The \fB[appdefaults]\fR Section"
 410      -.LP
 411  407  This section contains subsections for Kerberos V5 applications, where
 412  408  \fIrelation-subsection\fR is the name of an application. Each subsection
 413  409  contains relations that define the default behaviors for that application.
 414  410  .sp
 415  411  .LP
 416  412  The following relations can be found in the \fB[appdefaults]\fR section, though
 417  413  not all relations are recognized by all kerberized applications. Some are
 418  414  specific to particular applications.
 419  415  .sp
 420  416  .ne 2
↓ open down ↓ 161 lines elided ↑ open up ↑ 
 582  578     }
 583  579  .fi
 584  580  .in -2
 585  581  .sp
 586  582  
 587  583  .sp
 588  584  .LP
 589  585  The application defaults specified here are overridden by those specified in
 590  586  the \fB[realms]\fR section.
 591  587  .SS "The \fB[realms]\fR Section"
 592      -.LP
 593  588  This section contains subsections for Kerberos realms, where
 594  589  \fIrelation-subsection\fR is the name of a realm. Each subsection contains
 595  590  relations that define the properties for that particular realm. The following
 596  591  relations can be specified in each \fB[realms]\fR subsection:
 597  592  .sp
 598  593  .ne 2
 599  594  .na
 600  595  \fB\fBadmin_server\fR\fR
 601  596  .ad
 602  597  .sp .6
↓ open down ↓ 259 lines elided ↑ open up ↑ 
 862  857  The parameters "\fBforwardable\fR", "\fBproxiable\fR", and
 863  858  "\fBrenew_lifetime\fR" as described in the \fB[libdefaults]\fR section (see
 864  859  above) are also valid in the \fB[realms]\fR section.
 865  860  .sp
 866  861  .LP
 867  862  Notice that \fBkpasswd_server\fR and \fBkpasswd_protocol\fR are realm-specific
 868  863  parameters. Most often, you need to specify them only when using a
 869  864  non-Solaris-based Kerberos server. Otherwise, the change request is sent over
 870  865  \fBRPCSEC_GSS\fR to the Solaris Kerberos administration server.
 871  866  .SS "The \fB[domain_realm]\fR Section"
 872      -.LP
 873  867  This section provides a translation from a domain name or hostname to a
 874  868  Kerberos realm name. The \fIrelation\fR can be a host name, or a domain name,
 875  869  where domain names are indicated by a period (`\fB\&.\fR') prefix.
 876  870  \fIrelation-value\fR is the Kerberos realm name for that particular host or
 877  871  domain. Host names and domain names should be in lower case.
 878  872  .sp
 879  873  .LP
 880  874  If no translation entry applies, the host's realm is considered to be the
 881  875  hostname's domain portion converted to upper case. For example, the following
 882  876  \fB[domain_realm]\fR section maps \fBcrash.mit.edu\fR into the
↓ open down ↓ 12 lines elided ↑ open up ↑ 
 895  889  .sp
 896  890  
 897  891  .sp
 898  892  .LP
 899  893  All other hosts in the \fBmit.edu\fR domain maps by default to the
 900  894  \fBATHENA.MIT.EDU\fR realm, and all hosts in the \fBfubar.org\fR domain maps by
 901  895  default into the \fBFUBAR.ORG\fR realm. The entries for the hosts \fBmit.edu\fR
 902  896  and \fBfubar.org\fR. Without these entries, these hosts would be mapped into
 903  897  the Kerberos realms \fBEDU\fR and \fBORG\fR, respectively.
 904  898  .SS "The \fB[logging]\fR Section"
 905      -.LP
 906  899  This section indicates how Kerberos programs are to perform logging. There are
 907  900  two types of relations for this section: relations to specify how to log and a
 908  901  relation to specify how to rotate \fBkdc\fR log files.
 909  902  .sp
 910  903  .LP
 911  904  The following relations can be defined to specify how to log. The same relation
 912  905  can be repeated if you want to assign it multiple logging methods.
 913  906  .sp
 914  907  .ne 2
 915  908  .na
↓ open down ↓ 188 lines elided ↑ open up ↑ 
1104 1097     kdc = FILE:/export/logging/kadmin.log
1105 1098     kdc_rotate = {
1106 1099        period = 1d
1107 1100        versions = 20
1108 1101     }
1109 1102  .fi
1110 1103  .in -2
1111 1104  .sp
1112 1105  
1113 1106  .SS "The \fB[capaths]\fR Section"
1114      -.LP
1115 1107  In order to perform direct (non-hierarchical) cross-realm authentication, a
1116 1108  database is needed to construct the authentication paths between the realms.
1117 1109  This section defines that database.
1118 1110  .sp
1119 1111  .LP
1120 1112  A client uses this section to find the authentication path between its realm
1121 1113  and the realm of the server. The server uses this section to verify the
1122 1114  authentication path used by the client, by checking the transited field of the
1123 1115  received ticket.
1124 1116  .sp
↓ open down ↓ 83 lines elided ↑ open up ↑ 
1208 1200  .fi
1209 1201  .in -2
1210 1202  .sp
1211 1203  
1212 1204  .sp
1213 1205  .LP
1214 1206  In the above examples, the ordering is not important, except when the same
1215 1207  relation is used more than once. The client uses this to determine the path.
1216 1208  (It is not important to the server, since the transited field is not sorted.)
1217 1209  .SS "PKINIT-specific Options"
1218      -.LP
1219 1210  The following are \fBpkinit-specific\fR options. These values can be specified
1220 1211  in \fB[libdefaults]\fR as global defaults, or within a realm-specific
1221 1212  subsection of \fB[libdefaults]\fR, or can be specified as realm-specific values
1222 1213  in the \fB[realms]\fR section. A realm-specific value overrides, does not add
1223 1214  to, a generic \fB[libdefaults]\fR specification.
1224 1215  .sp
1225 1216  .LP
1226 1217  The search order is:
1227 1218  .RS +4
1228 1219  .TP
↓ open down ↓ 410 lines elided ↑ open up ↑ 
1639 1630  .ad
1640 1631  .sp .6
1641 1632  .RS 4n
1642 1633  \fIenvironment-variable-name\fR specifies the name of an environment variable
1643 1634  which has been set to a value conforming to one of the previous values. For
1644 1635  example, \fBENV:X509_PROXY\fR, where environment variable \fBX509_PROXY\fR has
1645 1636  been set to \fBFILE:/tmp/my_proxy.pem\fR.
1646 1637  .RE
1647 1638  
1648 1639  .SS "The \fB[dbmodules]\fR Section"
1649      -.LP
1650 1640  This section consists of relations that provide configuration information for
1651 1641  plug-in modules. In particular, the relations describe the configuration for
1652 1642  LDAP KDB plug-in. Use of the \fBdb2\fR KDB plug-in is the default behavior and
1653 1643  that this section does not need to be filled out in that case.
1654 1644  .sp
1655 1645  .ne 2
1656 1646  .na
1657 1647  \fB\fBdb_library\fR\fR
1658 1648  .ad
1659 1649  .sp .6
↓ open down ↓ 94 lines elided ↑ open up ↑ 
1754 1744  .ne 2
1755 1745  .na
1756 1746  \fB\fBldap_ssl_port\fR\fR
1757 1747  .ad
1758 1748  .sp .6
1759 1749  .RS 4n
1760 1750  Port number for SSL connection with directory server. The default is \fB389\fR.
1761 1751  .RE
1762 1752  
1763 1753  .SH EXAMPLES
1764      -.LP
1765 1754  \fBExample 1 \fRSample File
1766 1755  .sp
1767 1756  .LP
1768 1757  The following is an example of a generic \fBkrb5.conf\fR file:
1769 1758  
1770 1759  .sp
1771 1760  .in +2
1772 1761  .nf
1773 1762  [libdefaults]
1774 1763     default_realm = ATHENA.MIT.EDU
↓ open down ↓ 58 lines elided ↑ open up ↑ 
1833 1822  .ne 2
1834 1823  .na
1835 1824  \fB\fB/var/krb5/kdc.log\fR\fR
1836 1825  .ad
1837 1826  .sp .6
1838 1827  .RS 4n
1839 1828  \fBKDC\fR logging file
1840 1829  .RE
1841 1830  
1842 1831  .SH ATTRIBUTES
1843      -.LP
1844 1832  See \fBattributes\fR(5) for descriptions of the following attributes:
1845 1833  .sp
1846 1834  
1847 1835  .sp
1848 1836  .TS
1849 1837  box;
1850 1838  c | c
1851 1839  l | l .
1852 1840  ATTRIBUTE TYPE  ATTRIBUTE VALUE
1853 1841  _
1854 1842  Interface Stability     See below.
1855 1843  .TE
1856 1844  
1857 1845  .sp
1858 1846  .LP
1859 1847  All of the keywords are Committed, except for the \fBPKINIT\fR keywords, which
1860 1848  are Volatile.
1861 1849  .SH SEE ALSO
1862      -.LP
1863 1850  \fBkinit\fR(1), \fBrcp\fR(1), \fBrdist\fR(1), \fBrlogin\fR(1), \fBrsh\fR(1),
1864 1851  \fBtelnet\fR(1), \fBsyslog\fR(3C), \fBattributes\fR(5), \fBkerberos\fR(5),
1865 1852  \fBregex\fR(5)
1866 1853  .SH NOTES
1867      -.LP
1868 1854  If the \fBkrb5.conf\fR file is not formatted properly, the \fBtelnet\fR command
1869 1855  fails. However, the \fBdtlogin\fR and \fBlogin\fR commands still succeed, even
1870 1856  if the \fBkrb5.conf\fR file is specified as required for the commands. If this
1871 1857  occurs, the following error message is displayed:
1872 1858  .sp
1873 1859  .in +2
1874 1860  .nf
1875 1861  Error initializing krb5: Improper format of \fIitem\fR
1876 1862  .fi
1877 1863  .in -2
1878 1864  .sp
1879 1865  
1880 1866  .sp
1881 1867  .LP
1882 1868  To bypass any other problems that might occur, you should fix the file as soon
1883 1869  as possible.
1884 1870  .sp
1885 1871  .LP
1886 1872  The \fBmax_life\fR and \fBmax_renewable_life\fR options are obsolete and is
1887 1873  removed in a future release of the Solaris operating system.
    
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX