blob: 4464d8b3cb9cd02241e7e93f6372b84033e46fb0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
|
[logging]
# Specifies that entity should use the specified
# destination for logging. See the krb5_openlog(3)
# manual page for a list of defined destinations.
#
kdc = FILE:/var/log/heimdal-kdc.log
#
# syslog also supported:
#
# kdc = SYSLOG:INFO
[kdc]
# database = {
#
# dbname = DATABASENAME
# Use this database for this realm. See
# the info documetation how to configure
# diffrent database backends.
#
# realm = REALM
# Specifies the realm that will be stored
# in this database. It realm isn't set,
# it will used as the default database,
# there can only be one entry that doesn't
# have a realm stanza.
#
# mkey_file = FILENAME
# Use this keytab file for the master key
# of this database. If not specified
# DATABASENAME.mkey will be used.
#
# acl_file = PA FILENAME
# Use this file for the ACL list of this
# database.
#
# log_file = FILENAME
# Use this file as the log of changes per-
# formed to the database. This file is
# used by ipropd-master for propagating
# changes to slaves.
#
# }
database = {
dbname = /var/lib/heimdal-kdc/heimdal
acl_file = /etc/heimdal-kdc/kadmind.acl
}
# Maximum size of a kdc request.
#
# max-request = SIZE
# If set pre-authentication is required. Since krb4
# requests are not pre-authenticated they will be
# rejected.
#
# require-preauth = BOOL
# List of ports the kdc should listen to.
#
# ports = list of ports
# List of addresses the kdc should bind to.
#
# addresses = list of interfaces
# Should the kdc answer kdc-requests over http.
#
# enable-http = BOOL
# If this kdc should emulate the AFS kaserver.
#
# enable-kaserver = BOOL
# Verify the addresses in the tickets used in tgs
# requests.
#
# check-ticket-addresses = BOOL
# Allow address-less tickets.
#
# allow-null-ticket-addresses = BOOL
# If the kdc is allowed to hand out anonymous tick-
# ets.
#
# allow-anonymous = BOOL
# Encode as-rep as tgs-rep tobe compatible with mis-
# takes older DCE secd did.
# encode_as_rep_as_tgs_rep = BOOL
# The time before expiration that the user should be
# warned that her password is about to expire.
#
# kdc_warn_pwexpire = TIME
# What type of logging the kdc should use, see also
# [logging]/kdc.
#
# logging = Logging
# use_2b = {
#
# principal = BOOL
# boolean value if the 524 daemon should
# return AFS 2b tokens for principal.
#
# ...
#
# }
# If the LDAP backend is used for storing principals,
# this is the structural object that will be used
# when creating and when reading objects. The
# default value is account .
#
# hdb-ldap-structural-object structural object
# is the dn that will be appended to the principal
# when creating entries. Default value is the search
# dn.
#
# hdb-ldap-create-base creation dn
[kadmin]
# If pre-authentication is required to talk to the
# kadmin server.
#
# require-preauth = BOOL
# If a principal already have its password set for
# expiration, this is the time it will be valid for
# after a change.
#
# password_lifetime = time
# For each entry in default_keys try to parse it as a
# sequence of etype:salttype:salt syntax of this if
# something like:
#
# [(des|des3|etype):](pw-salt|afs3-salt)[:string]
#
# If etype is omitted it means everything, and if
# string is omitted it means the default salt string
# (for that principal and encryption type). Addi-
# tional special values of keytypes are:
#
# v5 The Kerberos 5 salt pw-salt
#
# v4 The Kerberos 4 salt des:pw-salt:
#
# default_keys = keytypes...
# When true, this is the same as
#
# default_keys = des3:pw-salt v4
#
# and is only left for backwards compatibility.
# use_v4_salt = BOOL
[password-quality]
# Check the Password quality assurance in the info documentation
# for more information.
# Library name that contains the password check_func-
# tion
#
# check_library = library-name
# Function name for checking passwords in
# check_library
#
# check_function = function-name
# List of libraries that can do password policy
# checks
#
# policy_libraries = library1 ... libraryN
# List of policy names to apply to the password.
# Builtin policies are among other minimum-length,
# character-class, external-check.
#
# policies = policy1 ... policyN
|
