KDC.CONF(5)

NAME
kdc.conf - Kerberos V5 KDC configuration file

DESCRIPTION
kdc.conf specifies per-realm configuration data to be used by the Kerberos V5 Authentication Service and Key Distribution Center (AS/KDC). This includes database, key and per-realm defaults.

The kdc.conf file uses the same format as the krb5.conf file. For a basic description of the syntax, please refer to the krb5.conf description.

The following sections are currently used in the kdc.conf file:

[kdcdefaults]
    Contains parameters which control the overall behaviour of the KDC.

[realms]
    Contains subsections keyed by Kerberos realm names which describe per-realm KDC parameters.

KDCDEFAULTS SECTION
The following relations are defined in the [kdcdefaults] section:

kdc_ports
    This relation lists the ports which the Kerberos server should listen on, by default. This list is a comma separated list of integers. If this relation is not specified, the compiled-in default is usually port 88 and port 750.

REALMS SECTION
Each tag in the [realms] section of the file names a Kerberos realm. The value of the tag is a subsection where the relations in that subsection define KDC parameters for that particular realm.

For each realm, the following tags may be specified in the [realms] subsection:

acl_file
    This string specifies the location of the acl file that kadmin uses to determine which principals are allowed which permissions on the database. The default is kadm5.acl.

admin_keytab
    This string specifies the location of the keytab file that kadmin uses to authenticate to the database. The default is kadm5.keytab.

database_name
    This string specifies the location of the Kerberos database for this realm.

default_principal_expiration
    This absolute time string specifies the default expiration date of principals created in this realm.

default_principal_flags
    This flag string specifies the default attributes of principals created in this realm.

dict_file
    Name and location of the dictionary file of words that are not allowed as passwords. The default is kadm5.dict.

encryption_type
    This encryption type string represents the encryption type used for this realm.

kadmind_port
    Specifies the port that the kadmind(8) daemon is to listen for this realm. The assigned port for kadmind is 749.

key_stash_file
    This string specifies the location where the master key has been stored with kdb5_util stash. The default is .k5.REALM where REALM is the Kerberos realm.

kdc_ports
    This string specifies the list of ports that the KDC is to listen to for this realm. By default, the value of kdc_ports as specified in the [kdcdefaults] section is used.

master_key_name
    This string specifies the name of the master key.

master_key_type
    This key type string represents the master key's key type.

max_life
    This delta time string specifes the maximum time period that a ticket may be valid for in this realm.

max_renewable_life
    This delta time string specifies the maximum time period that a ticket may be renewed for in this realm.

profile
    This string specifies the location of the Kerberos V5 configuration file, if different from the default (/etc/krb5.conf).

supported_enctypes
    This list of key:salt strings specifies the default key/salt combinations of principals for this realm.

FILES
/usr/local/lib/krb5kdc/kdc.conf

SEE ALSO
krb5.conf(5), krb5kdc(8)