KDC(8)

NAME
kdc - Kerberos 5 server

SYNOPSIS
kdc [-c file] [--config-file=file] [-k file] [--key-file=file] [-p] [--no-require-preauth] [-r realm] [--v4-realm=realm]

DESCRIPTION
kdc serves requests for tickets. When it starts, it first checks the flags passed, any options that are not specified with a command line flag is taken from a config file, or from a default compiled-in value.

Options supported:

-c file

--config-file=file
    Specifies the location of the config file, the default is /var/heimdal/kdc.conf. This is the only value that can't be specified in the config file.

-k file

--key-file=file
    The location of the master-key file. All keys in the database is encrypted with this master key. The use of a master key is currently optional, so there is no default. Don't specify a master key file if your database is not encrypted.

-p

--no-require-preauth
    Turn off the requirement for pre-autentication in the initial AS-REQ. The use of pre-authentication makes it more difficult to do offline password attacks. You might want to turn it off if you have clients that doesn't do pre-authentication. Since the version 4 protocol doesn't support any pre-authentication, so serving version 4 clients is just about the same as not requiring pre-athentication. The default is to require pre-authentication.

-r realm

--v4-realm=realm
    What realm this server should act as when dealing with version 4 requests. The database can contain any number of realms, but since the version 4 protocol doesn't contain a realm for the server, it must be explicitly specified. The default is whatever is returned by krb_get_lrealm(). This option is only availabe if the KDC has been compiled with version 4 support.

All activities , are logged to one or more destinations, see krb5.conf(5), and krb5_openlog(3). The entity used for logging is kdc.

CONFIGURATION FILE
The configuration file has the same syntax as the krb5.conf file (you can actually put the configuration in /etc/krb5.conf, and then start the KDC with --config-file=/etc/krb5.conf). All options should be in a section called “kdc”. Options are called the same as the long option name, and takes the same arguments. The only difference is the pre-authentication flag, that has to be specified as:

    require-preauth = no

(in fact you can specify the option as --require-preauth=no).

An example of a config file:

    [kdc]
    	require-preauth = no
    	v4-realm = FOO.SE
    	key-file = /key-file

SEE ALSO
kinit(1)