Kerberos KDC

The heart of Kerberos is the MIT Kerberos KDC (``Key Distribution Center''.)

The KDC is a daemon, krb5kdc. It's running on two hosts (at this time, niven01 and niven02, both happen to be HP/UX.) These hosts are known to the Kerberos clients because they're mentioned in /etc/krb5.conf.

Niven01 is the master server: 1) it's listed first, and therefore gets all the connections, and 2) it's also listed under admin_server, so it gets the updates.

Niven02 is the slave server, running roughly an hour behind niven01 via a complete periodic data base copy; it will see service only only in an emergency when niven01 fails to respond to queries. The hourly database propagation is initiated by niven01, which runs /krb5/sbin/propagate from cron.

Managing accounts

The kadmin program is the general purpose administrative tool. It should be able to work from any host, but needs to be accessed through an admin account and we don't have those set up. I use kadmin.local, which works only on the master service host and (I think) uses kadm5.keytab. The interfaces are identical, and they have a little bit of online help. kpasswd is like kadmin, but its function requires no special principal.

The Kerberos version of populate also works on the local host via keytab ucsktab (that's what's adding those thousands of users and keeping the passwords up to date.)

Host principals

Each host that wants services like telnetd, needs a file /etc/krb5.keytab with an entry for a host principal instance named after the host - so for melville, that principal looks like ``host/melville.u.washington.edu''. /krb5/sbin/newtabs makes new keytabs for the hostnames you specify, and saves them in /var/krb5/krb5kdc/keytabs/new. Don't delete the keytabs on niven01, unless you know what you're doing, and likewise don't make new keytabs unless the ones you need have definitely not been created. There's a script /ux01/tools/keytabdist that may help get them where they need to go, if you have .rhosts access there.

Master/Slave management

To switch a slave in as master, kill kadmind on the master and start it on the slave, then switch domain names or whatever we can think of along those lines (the alternative is to change all krb5.confs, which is probably not the way to go.)

The files specific to the KDC are in /krb5/var/krb5kdc.

Logging

Ticket transaction logging is going to LOG_LOCAL3, because that's what I put in krb5.conf. kpropdsyslog output goes to LOG_DAEMON, maybe other servers do this; we don't normally have a log defined for that facility.

Documentation

The docs are mainly a couple of .ps files in /tulsa/src/krb5-1.0/doc. The installation guide has most of the best; the administrators guide is good for cross-reference while going through the installation guide. Man pages are also available, currently in /krb5/man.