HP-UX Reference (11i v3 07/02) - 4 File Formats (vol 8)

k
krb5.conf(4) krb5.conf(4)
appdefaults Section
Each tag in the [appdefaults]
section names a Kerberos V5 application or an option that is used by
some Kerberos V5 application(s). The value of the tag is a subsection with relations that define the default
behaviors for that application. The four ways to set values for options are as follows, in decreasing order of
precedence:
#1)
application = {
realm1 = {
option = value
}
realm2 = {
option = value
}
}
#2)
application = {
option1 = value
option2 = value
}
#3)
realm = {
option = value
}
#4)
option = value
The list of specifiable options for each application may be found in the respective application man pages.
The application defaults specified in this section are overridden by those specified in the
[realms] sec-
tion.
login Section
The
[login] section is used to configure the behavior of the Kerberos V5 login program,
login.krb5 .
realms Section
Each tag in the
[realms] section of the file names a Kerberos realm. The value of the tag is a subsection
where the relations in that subsection define the properties of that particular realm. For example:
[realms]
ATHENA.MIT.EDU = {
kdc = KERBEROS.MIT.EDU
kdc = KERBEROS-1.MIT.EDU:750
kdc = KERBEROS-2.MIT.EDU:88
admin_server = KERBEROS.MIT.EDU
default_domain = MIT.EDU
v4_instance_convert = {
mit = mit.edu
lithium = lithium.lcs.mit.edu
}
}
For each realm, the following tags may be specified in the realm’s subsection:
kdc The value of this relation is the name of a host running a Key Distribution Center for
that realm. An optional port number (preceded by a colon) may be appended to the
hostname.
admin_server Identifies the host where the administration server is running. Typically this is the
Master Kerberos server. NOTE: Listing a secondary admin server may update the
password on the secondary. This may result in an inconsistency if there is no pass-
word sync mechanism from the secondary to the Master server. This occurs in the fol-
lowing cases:
• The secondary server is listed above the primary. In this case the
admin_server will find the secondary server first and update the password
on the secondary server.
202 Hewlett-Packard Company − 3 − HP-UX 11i Version 3: February 2007