DragonFly On-Line Manual Pages

KRB5.CONF(5) MIT Kerberos KRB5.CONF(5)

NAME
krb5.conf - Kerberos configuration file

The krb5.conf file contains Kerberos configuration information,
including the locations of KDCs and admin servers for the Kerberos
realms of interest, defaults for the current realm and for Kerberos
applications, and mappings of hostnames onto Kerberos realms.
Normally, you should install your krb5.conf file in the directory /etc.
You can override the default location by setting the environment
variable KRB5_CONFIG. Multiple colon-separated filenames may be
specified in KRB5_CONFIG; all files which are present will be read.
Starting in release 1.14, directory names can also be specified in
KRB5_CONFIG; all files within the directory whose names consist solely
of alphanumeric characters, dashes, or underscores will be read.

STRUCTURE
The krb5.conf file is set up in the style of a Windows INI file. Lines
beginning with '#' or ';' (possibly after initial whitespace) are
ignored as comments. Sections are headed by the section name, in
square brackets. Each section may contain zero or more relations, of
the form:

foo = bar

or:

fubar = {
foo = bar
baz = quux
}

Placing a '*' after the closing bracket of a section name indicates
that the section is final, meaning that if the same section appears
within a later file specified in KRB5_CONFIG, it will be ignored. A
subsection can be marked as final by placing a '*' after either the tag
name or the closing brace.

The krb5.conf file can include other files using either of the
following directives at the beginning of a line:

include FILENAME
includedir DIRNAME

FILENAME or DIRNAME should be an absolute path. The named file or
directory must exist and be readable. Including a directory includes
all files within the directory whose names consist solely of
alphanumeric characters, dashes, or underscores. Starting in release
1.15, files with names ending in ".conf" are also included, unless the
name begins with ".". Included profile files are syntactically
independent of their parents, so each included file must begin with a
section header. Starting in release 1.17, files are read in
alphanumeric order; in previous releases, they may be read in any
order.

The krb5.conf file can specify that configuration should be obtained
from a loadable module, rather than the file itself, using the
following directive at the beginning of a line before any section
headers:

module MODULEPATH:RESIDUAL

MODULEPATH may be relative to the library path of the krb5
installation, or it may be an absolute path. RESIDUAL is provided to
the module at initialization time. If krb5.conf uses a module
directive, kdc.conf(5) should also use one if it exists.

SECTIONS
The krb5.conf file may contain the following sections:

Additionally, krb5.conf may include any of the relations described in
kdc.conf(5), but it is not a recommended practice.

[libdefaults]
The libdefaults section may contain any of the following relations:

allow_des3
Permit the KDC to issue tickets with des3-cbc-sha1 session keys.
In future releases, this flag will allow des3-cbc-sha1 to be
used at all. The default value for this tag is false. (Added
in release 1.21.)

allow_rc4
Permit the KDC to issue tickets with arcfour-hmac session keys.
In future releases, this flag will allow arcfour-hmac to be used
at all. The default value for this tag is false. (Added in
release 1.21.)

allow_weak_crypto
If this flag is set to false, then weak encryption types (as
noted in Encryption_types in kdc.conf(5)) will be filtered out
of the lists default_tgs_enctypes, default_tkt_enctypes, and
permitted_enctypes. The default value for this tag is false.

canonicalize
If this flag is set to true, initial ticket requests to the KDC
will request canonicalization of the client principal name, and
answers with different client principals than the requested
principal will be accepted. The default value is false.

ccache_type
This parameter determines the format of credential cache types
created by kinit(1) or other programs. The default value is 4,
which represents the most current format. Smaller values can be
used for compatibility with very old implementations of Kerberos
which interact with credential caches on the same host.

clockskew
Sets the maximum allowable amount of clockskew in seconds that
the library will tolerate before assuming that a Kerberos
message is invalid. The default value is 300 seconds, or five
minutes.

The clockskew setting is also used when evaluating ticket start
and expiration times. For example, tickets that have reached
their expiration time can still be used (and renewed if they are
renewable tickets) if they have been expired for a shorter
duration than the clockskew setting.

default_ccache_name
This relation specifies the name of the default credential
cache. The default is FILE:/tmp/krb5cc_%{uid}. This relation
is subject to parameter expansion (see below). New in release
1.11.

default_client_keytab_name
This relation specifies the name of the default keytab for
obtaining client credentials. The default is
FILE:/usr/local/var/krb5/user/%{euid}/client.keytab. This
relation is subject to parameter expansion (see below). New in
release 1.11.

default_keytab_name
This relation specifies the default keytab name to be used by
application servers such as sshd. The default is
FILE:/etc/krb5.keytab. This relation is subject to parameter
expansion (see below).

default_rcache_name
This relation specifies the name of the default replay cache.
The default is dfl:. This relation is subject to parameter
expansion (see below). New in release 1.18.

default_realm
Identifies the default Kerberos realm for the client. Set its
value to your Kerberos realm. If this value is not set, then a
realm must be specified with every Kerberos principal when
invoking programs such as kinit(1).

default_tgs_enctypes
Identifies the supported list of session key encryption types
that the client should request when making a TGS-REQ, in order
of preference from highest to lowest. The list may be delimited
with commas or whitespace. See Encryption_types in kdc.conf(5)
for a list of the accepted values for this tag. Starting in
release 1.18, the default value is the value of
permitted_enctypes. For previous releases or if
permitted_enctypes is not set, the default value is
aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128
des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac
camellia128-cts-cmac.

Do not set this unless required for specific backward
compatibility purposes; stale values of this setting can prevent
clients from taking advantage of new stronger enctypes when the
libraries are upgraded.

default_tkt_enctypes
Identifies the supported list of session key encryption types
that the client should request when making an AS-REQ, in order
of preference from highest to lowest. The format is the same as
for default_tgs_enctypes. Starting in release 1.18, the default
value is the value of permitted_enctypes. For previous releases
or if permitted_enctypes is not set, the default value is
aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96
aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128
des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac
camellia128-cts-cmac.

dns_canonicalize_hostname
Indicate whether name lookups will be used to canonicalize
hostnames for use in service principal names. Setting this flag
to false can improve security by reducing reliance on DNS, but
means that short hostnames will not be canonicalized to
fully-qualified hostnames. If this option is set to fallback
(new in release 1.18), DNS canonicalization will only be
performed the server hostname is not found with the original
name when requesting credentials. The default value is true.

dns_lookup_kdc
Indicate whether DNS SRV records should be used to locate the
KDCs and other servers for a realm, if they are not listed in
the krb5.conf information for the realm. (Note that the
admin_server entry must be in the krb5.conf realm information in
order to contact kadmind, because the DNS implementation for
kadmin is incomplete.)

Enabling this option does open up a type of denial-of-service
attack, if someone spoofs the DNS records and redirects you to
another server. However, it's no worse than a denial of
service, because that fake KDC will be unable to decode anything
you send it (besides the initial ticket request, which has no
encrypted data), and anything the fake KDC sends will not be
trusted without verification using some secret that it won't
know.

dns_uri_lookup
Indicate whether DNS URI records should be used to locate the
KDCs and other servers for a realm, if they are not listed in
the krb5.conf information for the realm. SRV records are used
as a fallback if no URI records were found. The default value
is true. New in release 1.15.

enforce_ok_as_delegate
If this flag to true, GSSAPI credential delegation will be
disabled when the ok-as-delegate flag is not set in the service
ticket. If this flag is false, the ok-as-delegate ticket flag
is only enforced when an application specifically requests
enforcement. The default value is false.

err_fmt
This relation allows for custom error message formatting. If a
value is set, error messages will be formatted by substituting a
normal error message for %M and an error code for %C in the
value.

extra_addresses
This allows a computer to use multiple local addresses, in order
to allow Kerberos to work in a network that uses NATs while
still using address-restricted tickets. The addresses should be
in a comma-separated list. This option has no effect if
noaddresses is true.

forwardable
If this flag is true, initial tickets will be forwardable by
default, if allowed by the KDC. The default value is false.

ignore_acceptor_hostname
When accepting GSSAPI or krb5 security contexts for host-based
service principals, ignore any hostname passed by the calling
application, and allow clients to authenticate to any service
principal in the keytab matching the service name and realm name
(if given). This option can improve the administrative
flexibility of server applications on multihomed hosts, but
could compromise the security of virtual hosting environments.
The default value is false. New in release 1.10.

k5login_authoritative
If this flag is true, principals must be listed in a local
user's k5login file to be granted login access, if a .k5login(5)
file exists. If this flag is false, a principal may still be
granted login access through other mechanisms even if a k5login
file exists but does not list the principal. The default value
is true.

k5login_directory
If set, the library will look for a local user's k5login file
within the named directory, with a filename corresponding to the
local username. If not set, the library will look for k5login
files in the user's home directory, with the filename .k5login.
For security reasons, .k5login files must be owned by the local
user or by root.

kcm_mach_service
On macOS only, determines the name of the bootstrap service used
to contact the KCM daemon for the KCM credential cache type. If
the value is -, Mach RPC will not be used to contact the KCM
daemon. The default value is org.h5l.kcm.

kcm_socket
Determines the path to the Unix domain socket used to access the
KCM daemon for the KCM credential cache type. If the value is
-, Unix domain sockets will not be used to contact the KCM
daemon. The default value is /var/run/.heim_org.h5l.kcm-socket.

kdc_default_options
Default KDC options (Xored for multiple values) when requesting
initial tickets. By default it is set to 0x00000010
(KDC_OPT_RENEWABLE_OK).

kdc_timesync
Accepted values for this relation are 1 or 0. If it is nonzero,
client machines will compute the difference between their time
and the time returned by the KDC in the timestamps in the
tickets and use this value to correct for an inaccurate system
clock when requesting service tickets or authenticating to
services. This corrective factor is only used by the Kerberos
library; it is not used to change the system clock. The default
value is 1.

noaddresses
If this flag is true, requests for initial tickets will not be
made with address restrictions set, allowing the tickets to be
used across NATs. The default value is true.

permitted_enctypes
Identifies the encryption types that servers will permit for
session keys and for ticket and authenticator encryption,
ordered by preference from highest to lowest. Starting in
release 1.18, this tag also acts as the default value for
default_tgs_enctypes and default_tkt_enctypes. The default
value for this tag is aes256-cts-hmac-sha1-96
aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192
aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5
camellia256-cts-cmac camellia128-cts-cmac.

plugin_base_dir
If set, determines the base directory where krb5 plugins are
located. The default value is the krb5/plugins subdirectory of
the krb5 library directory. This relation is subject to
parameter expansion (see below) in release 1.17 and later.

preferred_preauth_types
This allows you to set the preferred preauthentication types
which the client will attempt before others which may be
advertised by a KDC. The default value for this setting is "17,
16, 15, 14", which forces libkrb5 to attempt to use PKINIT if it
is supported.

proxiable
If this flag is true, initial tickets will be proxiable by
default, if allowed by the KDC. The default value is false.

qualify_shortname
If this string is set, it determines the domain suffix for
single-component hostnames when DNS canonicalization is not used
(either because dns_canonicalize_hostname is false or because
forward canonicalization failed). The default value is the
first search domain of the system's DNS configuration. To
disable qualification of shortnames, set this relation to the
empty string with qualify_shortname = "". (New in release
1.18.)

rdns If this flag is true, reverse name lookup will be used in
addition to forward name lookup to canonicalizing hostnames for
use in service principal names. If dns_canonicalize_hostname is
set to false, this flag has no effect. The default value is
true.

realm_try_domains
Indicate whether a host's domain components should be used to
determine the Kerberos realm of the host. The value of this
variable is an integer: -1 means not to search, 0 means to try
the host's domain itself, 1 means to also try the domain's
immediate parent, and so forth. The library's usual mechanism
for locating Kerberos realms is used to determine whether a
domain is a valid realm, which may involve consulting DNS if
dns_lookup_kdc is set. The default is not to search domain
components.

renew_lifetime
(duration string.) Sets the default renewable lifetime for
initial ticket requests. The default value is 0.

spake_preauth_groups
A whitespace or comma-separated list of words which specifies
the groups allowed for SPAKE preauthentication. The possible
values are:

+-------------+-------------------------+
|edwards25519 | Edwards25519 curve (RFC |
| | 7748) |
+-------------+-------------------------+
|P-256 | NIST P-256 curve (RFC |
| | 5480) |
+-------------+-------------------------+
|P-384 | NIST P-384 curve (RFC |
| | 5480) |
+-------------+-------------------------+
|P-521 | NIST P-521 curve (RFC |
| | 5480) |
+-------------+-------------------------+

The default value for the client is edwards25519. The default
value for the KDC is empty. New in release 1.17.

ticket_lifetime
(duration string.) Sets the default lifetime for initial ticket
requests. The default value is 1 day.

udp_preference_limit
When sending a message to the KDC, the library will try using
TCP before UDP if the size of the message is above
udp_preference_limit. If the message is smaller than
udp_preference_limit, then UDP will be tried before TCP.
Regardless of the size, both protocols will be tried if the
first attempt fails.

verify_ap_req_nofail
If this flag is true, then an attempt to verify initial
credentials will fail if the client machine does not have a
keytab. The default value is false.

client_aware_channel_bindings
If this flag is true, then all application protocol
authentication requests will be flagged to indicate that the
application supports channel bindings when operating over a
secure channel. The default value is false.

[realms]
Each tag in the [realms] section of the file is the name of a Kerberos
realm. The value of the tag is a subsection with relations that define
the properties of that particular realm. For each realm, the following
tags may be specified in the realm's subsection:

admin_server
Identifies the host where the administration server is running.
Typically, this is the primary Kerberos server. This tag must
be given a value in order to communicate with the kadmind(8)
server for the realm.

auth_to_local
This tag allows you to set a general rule for mapping principal
names to local user names. It will be used if there is not an
explicit mapping for the principal name that is being
translated. The possible values are:

RULE:exp
The local name will be formulated from exp.

The format for exp is
[n:string](regexp)s/pattern/replacement/g. The integer n
indicates how many components the target principal should
have. If this matches, then a string will be formed from
string, substituting the realm of the principal for $0
and the n'th component of the principal for $n (e.g., if
the principal was johndoe/admin then [2:$2$1foo] would
result in the string adminjohndoefoo). If this string
matches regexp, then the s//[g] substitution command will
be run over the string. The optional g will cause the
substitution to be global over the string, instead of
replacing only the first match in the string.

DEFAULT
The principal name will be used as the local user name.
If the principal has more than one component or is not in
the default realm, this rule is not applicable and the
conversion will fail.

For example:

[realms]
ATHENA.MIT.EDU = {
auth_to_local = RULE:[2:$1](johndoe)s/^.*$/guest/
auth_to_local = RULE:[2:$1;$2](^.*;admin$)s/;admin$//
auth_to_local = RULE:[2:$2](^.*;root)s/^.*$/root/
auth_to_local = DEFAULT
}

would result in any principal without root or admin as the
second component to be translated with the default rule. A
principal with a second component of admin will become its first
component. root will be used as the local name for any
principal with a second component of root. The exception to
these two rules are any principals johndoe/*, which will always
get the local name guest.

auth_to_local_names
This subsection allows you to set explicit mappings from
principal names to local user names. The tag is the mapping
name, and the value is the corresponding local user name.

default_domain
This tag specifies the domain used to expand hostnames when
translating Kerberos 4 service principals to Kerberos 5
principals (for example, when converting rcmd.hostname to
host/hostname.domain).

disable_encrypted_timestamp
If this flag is true, the client will not perform encrypted
timestamp preauthentication if requested by the KDC. Setting
this flag can help to prevent dictionary attacks by active
attackers, if the realm's KDCs support SPAKE preauthentication
or if initial authentication always uses another mechanism or
always uses FAST. This flag persists across client referrals
during initial authentication. This flag does not prevent the
KDC from offering encrypted timestamp. New in release 1.17.

http_anchors
When KDCs and kpasswd servers are accessed through HTTPS
proxies, this tag can be used to specify the location of the CA
certificate which should be trusted to issue the certificate for
a proxy server. If left unspecified, the system-wide default
set of CA certificates is used.

The syntax for values is similar to that of values for the
pkinit_anchors tag:

FILE: filename

filename is assumed to be the name of an OpenSSL-style ca-bundle
file.

DIR: dirname

dirname is assumed to be an directory which contains CA
certificates. All files in the directory will be examined; if
they contain certificates (in PEM format), they will be used.

ENV: envvar

envvar specifies the name of an environment variable which has
been set to a value conforming to one of the previous values.
For example, ENV:X509_PROXY_CA, where environment variable
X509_PROXY_CA has been set to FILE:/tmp/my_proxy.pem.

kdc The name or address of a host running a KDC for that realm. An
optional port number, separated from the hostname by a colon,
may be included. If the name or address contains colons (for
example, if it is an IPv6 address), enclose it in square
brackets to distinguish the colon from a port separator. For
your computer to be able to communicate with the KDC for each
realm, this tag must be given a value in each realm subsection
in the configuration file, or there must be DNS SRV records
specifying the KDCs.

kpasswd_server
Points to the server where all the password changes are
performed. If there is no such entry, DNS will be queried
(unless forbidden by dns_lookup_kdc). Finally, port 464 on the
admin_server host will be tried.

master_kdc
The name for primary_kdc prior to release 1.19. Its value is
used as a fallback if primary_kdc is not specified.

primary_kdc
Identifies the primary KDC(s). Currently, this tag is used in
only one case: If an attempt to get credentials fails because of
an invalid password, the client software will attempt to contact
the primary KDC, in case the user's password has just been
changed, and the updated database has not been propagated to the
replica servers yet. New in release 1.19.

v4_instance_convert
This subsection allows the administrator to configure exceptions
to the default_domain mapping rule. It contains V4 instances
(the tag name) which should be translated to some specific
hostname (the tag value) as the second component in a Kerberos
V5 principal name.

v4_realm
This relation is used by the krb524 library routines when
converting a V5 principal name to a V4 principal name. It is
used when the V4 realm name and the V5 realm name are not the
same, but still share the same principal names and passwords.
The tag value is the Kerberos V4 realm name.

[domain_realm]
The [domain_realm] section provides a translation from hostnames to
Kerberos realms. Each tag is a domain name, providing the mapping for
that domain and all subdomains. If the tag begins with a period (.)
then it applies only to subdomains. The Kerberos realm may be
identified either in the realms section or using DNS SRV records. Tag
names should be in lower case. For example:

[domain_realm]
crash.mit.edu = TEST.ATHENA.MIT.EDU
.dev.mit.edu = TEST.ATHENA.MIT.EDU
mit.edu = ATHENA.MIT.EDU

maps the host with the name crash.mit.edu into the TEST.ATHENA.MIT.EDU
realm. The second entry maps all hosts under the domain dev.mit.edu
into the TEST.ATHENA.MIT.EDU realm, but not the host with the name
dev.mit.edu. That host is matched by the third entry, which maps the
host mit.edu and all hosts under the domain mit.edu that do not match a
preceding rule into the realm ATHENA.MIT.EDU.

If no translation entry applies to a hostname used for a service
principal for a service ticket request, the library will try to get a
referral to the appropriate realm from the client realm's KDC. If that
does not succeed, the host's realm is considered to be the hostname's
domain portion converted to uppercase, unless the realm_try_domains
setting in [libdefaults] causes a different parent domain to be used.

[capaths]
In order to perform direct (non-hierarchical) cross-realm
authentication, configuration is needed to determine the authentication
paths between realms.

A client will use this section to find the authentication path between
its realm and the realm of the server. The server will use this
section to verify the authentication path used by the client, by
checking the transited field of the received ticket.

There is a tag for each participating client realm, and each tag has
subtags for each of the server realms. The value of the subtags is an
intermediate realm which may participate in the cross-realm
authentication. The subtags may be repeated if there is more then one
intermediate realm. A value of "." means that the two realms share
keys directly, and no intermediate realms should be allowed to
participate.

Only those entries which will be needed on the client or the server
need to be present. A client needs a tag for its local realm with
subtags for all the realms of servers it will need to authenticate to.
A server needs a tag for each realm of the clients it will serve, with
a subtag of the server realm.

For example, ANL.GOV, PNL.GOV, and NERSC.GOV all wish to use the ES.NET
realm as an intermediate realm. ANL has a sub realm of TEST.ANL.GOV
which will authenticate with NERSC.GOV but not PNL.GOV. The [capaths]
section for ANL.GOV systems would look like this:

[capaths]
ANL.GOV = {
TEST.ANL.GOV = .
PNL.GOV = ES.NET
NERSC.GOV = ES.NET
ES.NET = .
}
TEST.ANL.GOV = {
ANL.GOV = .
}
PNL.GOV = {
ANL.GOV = ES.NET
}
NERSC.GOV = {
ANL.GOV = ES.NET
}
ES.NET = {
ANL.GOV = .
}

The [capaths] section of the configuration file used on NERSC.GOV
systems would look like this:

[capaths]
NERSC.GOV = {
ANL.GOV = ES.NET
TEST.ANL.GOV = ES.NET
TEST.ANL.GOV = ANL.GOV
PNL.GOV = ES.NET
ES.NET = .
}
ANL.GOV = {
NERSC.GOV = ES.NET
}
PNL.GOV = {
NERSC.GOV = ES.NET
}
ES.NET = {
NERSC.GOV = .
}
TEST.ANL.GOV = {
NERSC.GOV = ANL.GOV
NERSC.GOV = ES.NET
}

When a subtag is used more than once within a tag, clients will use the
order of values to determine the path. The order of values is not
important to servers.

[appdefaults]
Each tag in the [appdefaults] section names a Kerberos V5 application
or an option that is used by some Kerberos V5 application[s]. The
value of the tag defines the default behaviors for that application.

For example:

[appdefaults]
telnet = {
ATHENA.MIT.EDU = {
option1 = false
}
}
telnet = {
option1 = true
option2 = true
}
ATHENA.MIT.EDU = {
option2 = false
}
option2 = true

The above four ways of specifying the value of an option are shown in
order of decreasing precedence. In this example, if telnet is running
in the realm EXAMPLE.COM, it should, by default, have option1 and
option2 set to true. However, a telnet program in the realm
ATHENA.MIT.EDU should have option1 set to false and option2 set to
true. Any other programs in ATHENA.MIT.EDU should have option2 set to
false by default. Any programs running in other realms should have
option2 set to true.

The list of specifiable options for each application may be found in
that application's man pages. The application defaults specified here
are overridden by those specified in the realms section.

[plugins]

o pwqual interface

o kadm5_hook interface

o clpreauth and kdcpreauth interfaces

Tags in the [plugins] section can be used to register dynamic plugin
modules and to turn modules on and off. Not every krb5 pluggable
interface uses the [plugins] section; the ones that do are documented
here.

New in release 1.9.

Each pluggable interface corresponds to a subsection of [plugins]. All
subsections support the same tags:

disable
This tag may have multiple values. If there are values for this
tag, then the named modules will be disabled for the pluggable
interface.

enable_only
This tag may have multiple values. If there are values for this
tag, then only the named modules will be enabled for the
pluggable interface.

module This tag may have multiple values. Each value is a string of
the form modulename:pathname, which causes the shared object
located at pathname to be registered as a dynamic module named
modulename for the pluggable interface. If pathname is not an
absolute path, it will be treated as relative to the
plugin_base_dir value from [libdefaults].

For pluggable interfaces where module order matters, modules registered
with a module tag normally come first, in the order they are
registered, followed by built-in modules in the order they are
documented below. If enable_only tags are used, then the order of
those tags overrides the normal module order.

The following subsections are currently supported within the [plugins]
section:

ccselect interface
The ccselect subsection controls modules for credential cache selection
within a cache collection. In addition to any registered dynamic
modules, the following built-in modules exist (and may be disabled with
the disable tag):

k5identity
Uses a .k5identity file in the user's home directory to select a
client principal

realm Uses the service realm to guess an appropriate cache from the
collection

hostname
If the service principal is host-based, uses the service
hostname to guess an appropriate cache from the collection

pwqual interface
The pwqual subsection controls modules for the password quality
interface, which is used to reject weak passwords when passwords are
changed. The following built-in modules exist for this interface:

dict Checks against the realm dictionary file

empty Rejects empty passwords

hesiod Checks against user information stored in Hesiod (only if
Kerberos was built with Hesiod support)

princ Checks against components of the principal name

kadm5_hook interface
The kadm5_hook interface provides plugins with information on principal
creation, modification, password changes and deletion. This interface
can be used to write a plugin to synchronize MIT Kerberos with another
database such as Active Directory. No plugins are built in for this
interface.

kadm5_auth interface
The kadm5_auth section (introduced in release 1.16) controls modules
for the kadmin authorization interface, which determines whether a
client principal is allowed to perform a kadmin operation. The
following built-in modules exist for this interface:

acl This module reads the kadm5.acl(5) file, and authorizes
operations which are allowed according to the rules in the file.

self This module authorizes self-service operations including
password changes, creation of new random keys, fetching the
client's principal record or string attributes, and fetching the
policy record associated with the client principal.

clpreauth and kdcpreauth interfaces
The clpreauth and kdcpreauth interfaces allow plugin modules to provide
client and KDC preauthentication mechanisms. The following built-in
modules exist for these interfaces:

pkinit This module implements the PKINIT preauthentication mechanism.

encrypted_challenge
This module implements the encrypted challenge FAST factor.

encrypted_timestamp
This module implements the encrypted timestamp mechanism.

hostrealm interface
The hostrealm section (introduced in release 1.12) controls modules for
the host-to-realm interface, which affects the local mapping of
hostnames to realm names and the choice of default realm. The
following built-in modules exist for this interface:

profile
This module consults the [domain_realm] section of the profile
for authoritative host-to-realm mappings, and the default_realm
variable for the default realm.

dns This module looks for DNS records for fallback host-to-realm
mappings and the default realm. It only operates if the
dns_lookup_realm variable is set to true.

domain This module applies heuristics for fallback host-to-realm
mappings. It implements the realm_try_domains variable, and
uses the uppercased parent domain of the hostname if that does
not produce a result.

localauth interface
The localauth section (introduced in release 1.12) controls modules for
the local authorization interface, which affects the relationship
between Kerberos principals and local system accounts. The following
built-in modules exist for this interface:

default
This module implements the DEFAULT type for auth_to_local
values.

rule This module implements the RULE type for auth_to_local values.

names This module looks for an auth_to_local_names mapping for the
principal name.

auth_to_local
This module processes auth_to_local values in the default
realm's section, and applies the default method if no
auth_to_local values exist.

k5login
This module authorizes a principal to a local account according
to the account's .k5login(5) file.

an2ln This module authorizes a principal to a local account if the
principal name maps to the local account name.

certauth interface
The certauth section (introduced in release 1.16) controls modules for
the certificate authorization interface, which determines whether a
certificate is allowed to preauthenticate a user via PKINIT. The
following built-in modules exist for this interface:

pkinit_san
This module authorizes the certificate if it contains a PKINIT
Subject Alternative Name for the requested client principal, or
a Microsoft UPN SAN matching the principal if pkinit_allow_upn
is set to true for the realm.

pkinit_eku
This module rejects the certificate if it does not contain an
Extended Key Usage attribute consistent with the
pkinit_eku_checking value for the realm.

dbmatch
This module authorizes or rejects the certificate according to
whether it matches the pkinit_cert_match string attribute on the
client principal, if that attribute is present.

PKINIT OPTIONS
NOTE:
The following are PKINIT-specific options. These values may be
specified in [libdefaults] as global defaults, or within a
realm-specific subsection of [libdefaults], or may be specified as
realm-specific values in the [realms] section. A realm-specific
value overrides, not adds to, a generic [libdefaults] specification.
The search order is:

1. realm-specific subsection of [libdefaults]:

[libdefaults]
EXAMPLE.COM = {
pkinit_anchors = FILE:/usr/local/example.com.crt
}

2. realm-specific value in the [realms] section:

[realms]
OTHERREALM.ORG = {
pkinit_anchors = FILE:/usr/local/otherrealm.org.crt
}

3. generic value in the [libdefaults] section:

[libdefaults]
pkinit_anchors = DIR:/usr/local/generic_trusted_cas/

Specifying PKINIT identity information
The syntax for specifying Public Key identity, trust, and revocation
information for PKINIT is as follows:

FILE:filename[,keyfilename]
This option has context-specific behavior.

In pkinit_identity or pkinit_identities, filename specifies the
name of a PEM-format file containing the user's certificate. If
keyfilename is not specified, the user's private key is expected
to be in filename as well. Otherwise, keyfilename is the name
of the file containing the private key.

In pkinit_anchors or pkinit_pool, filename is assumed to be the
name of an OpenSSL-style ca-bundle file.

DIR:dirname
This option has context-specific behavior.

In pkinit_identity or pkinit_identities, dirname specifies a
directory with files named *.crt and *.key where the first part
of the file name is the same for matching pairs of certificate
and private key files. When a file with a name ending with .crt
is found, a matching file ending with .key is assumed to contain
the private key. If no such file is found, then the certificate
in the .crt is not used.

In pkinit_anchors or pkinit_pool, dirname is assumed to be an
OpenSSL-style hashed CA directory where each CA cert is stored
in a file named hash-of-ca-cert.#. This infrastructure is
encouraged, but all files in the directory will be examined and
if they contain certificates (in PEM format), they will be used.

In pkinit_revoke, dirname is assumed to be an OpenSSL-style
hashed CA directory where each revocation list is stored in a
file named hash-of-ca-cert.r#. This infrastructure is
encouraged, but all files in the directory will be examined and
if they contain a revocation list (in PEM format), they will be
used.

PKCS12:filename
filename is the name of a PKCS #12 format file, containing the
user's certificate and private key.

PKCS11:[module_name=]modname[:slotid=slot-id][:token=token-label][:certid=cert-id][:certlabel=cert-label]
All keyword/values are optional. modname specifies the location
of a library implementing PKCS #11. If a value is encountered
with no keyword, it is assumed to be the modname. If no
module-name is specified, the default is opensc-pkcs11.so.
slotid= and/or token= may be specified to force the use of a
particular smard card reader or token if there is more than one
available. certid= and/or certlabel= may be specified to force
the selection of a particular certificate on the device. See
the pkinit_cert_match configuration option for more ways to
select a particular certificate to use for PKINIT.

ENV:envvar
envvar specifies the name of an environment variable which has
been set to a value conforming to one of the previous values.
For example, ENV:X509_PROXY, where environment variable
X509_PROXY has been set to FILE:/tmp/my_proxy.pem.

PKINIT krb5.conf options

pkinit_anchors
Specifies the location of trusted anchor (root) certificates
which the client trusts to sign KDC certificates. This option
may be specified multiple times. These values from the config
file are not used if the user specifies X509_anchors on the
command line.

pkinit_cert_match
Specifies matching rules that the client certificate must match
before it is used to attempt PKINIT authentication. If a user
has multiple certificates available (on a smart card, or via
other media), there must be exactly one certificate chosen
before attempting PKINIT authentication. This option may be
specified multiple times. All the available certificates are
checked against each rule in order until there is a match of
exactly one certificate.

The Subject and Issuer comparison strings are the RFC 2253
string representations from the certificate Subject DN and
Issuer DN values.

The syntax of the matching rules is:
[relation-operator]component-rule ...

where:

relation-operator
can be either &&, meaning all component rules must match,
or ||, meaning only one component rule must match. The
default is &&.

component-rule
can be one of the following. Note that there is no
punctuation or whitespace between component rules.
<SUBJECT>regular-expression
<ISSUER>regular-expression
<SAN>regular-expression
<EKU>extended-key-usage-list
<KU>key-usage-list

extended-key-usage-list is a comma-separated list of
required Extended Key Usage values. All values in the
list must be present in the certificate. Extended Key
Usage values can be:

o pkinit

o msScLogin

o clientAuth

o emailProtection

key-usage-list is a comma-separated list of required Key
Usage values. All values in the list must be present in
the certificate. Key Usage values can be:

o digitalSignature

o keyEncipherment

Examples:

pkinit_cert_match = ||<SUBJECT>.*DoE.*<SAN>.*@EXAMPLE.COM
pkinit_cert_match = &&<EKU>msScLogin,clientAuth<ISSUER>.*DoE.*
pkinit_cert_match = <EKU>msScLogin,clientAuth<KU>digitalSignature

pkinit_eku_checking
This option specifies what Extended Key Usage value the KDC
certificate presented to the client must contain. (Note that if
the KDC certificate has the pkinit SubjectAlternativeName
encoded as the Kerberos TGS name, EKU checking is not necessary
since the issuing CA has certified this as a KDC certificate.)
The values recognized in the krb5.conf file are:

kpKDC This is the default value and specifies that the KDC must
have the id-pkinit-KPKdc EKU as defined in RFC 4556.

kpServerAuth
If kpServerAuth is specified, a KDC certificate with the
id-kp-serverAuth EKU will be accepted. This key usage
value is used in most commercially issued server
certificates.

none If none is specified, then the KDC certificate will not
be checked to verify it has an acceptable EKU. The use
of this option is not recommended.

pkinit_dh_min_bits
Specifies the size of the Diffie-Hellman key the client will
attempt to use. The acceptable values are 1024, 2048, and 4096.
The default is 2048.

pkinit_identities
Specifies the location(s) to be used to find the user's X.509
identity information. If this option is specified multiple
times, each value is attempted in order until certificates are
found. Note that these values are not used if the user
specifies X509_user_identity on the command line.

pkinit_kdc_hostname
The presence of this option indicates that the client is willing
to accept a KDC certificate with a dNSName SAN (Subject
Alternative Name) rather than requiring the id-pkinit-san as
defined in RFC 4556. This option may be specified multiple
times. Its value should contain the acceptable hostname for the
KDC (as contained in its certificate).

pkinit_pool
Specifies the location of intermediate certificates which may be
used by the client to complete the trust chain between a KDC
certificate and a trusted anchor. This option may be specified
multiple times.

pkinit_require_crl_checking
The default certificate verification process will always check
the available revocation information to see if a certificate has
been revoked. If a match is found for the certificate in a CRL,
verification fails. If the certificate being verified is not
listed in a CRL, or there is no CRL present for its issuing CA,
and pkinit_require_crl_checking is false, then verification
succeeds.

However, if pkinit_require_crl_checking is true and there is no
CRL information available for the issuing CA, then verification
fails.

pkinit_require_crl_checking should be set to true if the policy
is such that up-to-date CRLs must be present for every CA.

pkinit_revoke
Specifies the location of Certificate Revocation List (CRL)
information to be used by the client when verifying the validity
of the KDC certificate presented. This option may be specified
multiple times.

PARAMETER EXPANSION
Starting with release 1.11, several variables, such as
default_keytab_name, allow parameters to be expanded. Valid parameters
are:

+------------------+----------------------------+
|%{TEMP} | Temporary directory |
+------------------+----------------------------+
|%{uid} | Unix real UID or Windows |
| | SID |
+------------------+----------------------------+
|%{euid} | Unix effective user ID or |
| | Windows SID |
+------------------+----------------------------+
|%{USERID} | Same as %{uid} |
+------------------+----------------------------+
|%{null} | Empty string |
+------------------+----------------------------+
|%{LIBDIR} | Installation library |
| | directory |
+------------------+----------------------------+
|%{BINDIR} | Installation binary |
| | directory |
+------------------+----------------------------+
|%{SBINDIR} | Installation admin binary |
| | directory |
+------------------+----------------------------+
|%{username} | (Unix) Username of |
| | effective user ID |
+------------------+----------------------------+
|%{APPDATA} | (Windows) Roaming |
| | application data for |
| | current user |
+------------------+----------------------------+
|%{COMMON_APPDATA} | (Windows) Application data |
| | for all users |
+------------------+----------------------------+
|%{LOCAL_APPDATA} | (Windows) Local |
| | application data for |
| | current user |
+------------------+----------------------------+
|%{SYSTEM} | (Windows) Windows system |
| | folder |
+------------------+----------------------------+
|%{WINDOWS} | (Windows) Windows folder |
+------------------+----------------------------+
|%{USERCONFIG} | (Windows) Per-user MIT |
| | krb5 config file directory |
+------------------+----------------------------+
|%{COMMONCONFIG} | (Windows) Common MIT krb5 |
| | config file directory |
+------------------+----------------------------+

SAMPLE KRB5.CONF FILE
Here is an example of a generic krb5.conf file:

[libdefaults]
default_realm = ATHENA.MIT.EDU
dns_lookup_kdc = true
dns_lookup_realm = false

[realms]
ATHENA.MIT.EDU = {
kdc = kerberos.mit.edu
kdc = kerberos-1.mit.edu
kdc = kerberos-2.mit.edu
admin_server = kerberos.mit.edu
primary_kdc = kerberos.mit.edu
}
EXAMPLE.COM = {
kdc = kerberos.example.com
kdc = kerberos-1.example.com
admin_server = kerberos.example.com
}

[domain_realm]
mit.edu = ATHENA.MIT.EDU

[capaths]
ATHENA.MIT.EDU = {
EXAMPLE.COM = .
}
EXAMPLE.COM = {
ATHENA.MIT.EDU = .
}

FILES
/etc/krb5.conf

DragonFly On-Line Manual Pages

NAME

STRUCTURE

SECTIONS

PKINIT OPTIONS

PARAMETER EXPANSION

FILES

SEE ALSO

AUTHOR

COPYRIGHT