This manual page is for Mac OS X version 10.6.3

If you are running a different version of Mac OS X, view the documentation locally:

  • In Terminal, using the man(1) command

Reading manual pages

Manual pages are intended as a quick reference for people who already understand a technology.

  • For more information about the manual page format, see the manual page for manpages(5).

  • For more information about this technology, look for other documentation in the Apple Reference Library.

  • For general information about writing shell scripts, read Shell Scripting Primer.


KRB5KDC(8)                                                                                        KRB5KDC(8)



NAME
       krb5kdc - Kerberos V5 KDC

SYNOPSIS
       krb5kdc [ -a ] [ -x db_args ] [ -d dbname ] [ -k keytype ] [ -M mkeyname ] [ -p portnum ] [ -m ] [ -r
       realm ] [ -4 v4mode ] [ -n ]

DESCRIPTION
       krb5kdc is the Kerberos version 5 Authentication Service and Key Distribution Center (AS/KDC).

       The -a option enables Apple Password Server integration.

       The -x db_args option specifies the database specific arguments.

       Options supported for LDAP database are:

               -x nconns=<number_of_connections>
               specifies the number of connections to be maintained per LDAP server.

               -x host=<ldapuri>
               specifies the LDAP server to connect to by a LDAP URI.

               -x binddn=<binddn>
               specifies the DN of the object used by the KDC server to  bind  to  the  LDAP  server.   This
               object  should  have the rights to read the realm container, principal container and the sub-tree subtree
               tree that is referenced by the realm.

               -x bindpwd=<bind_password>
               specifies the password for the above mentioned binddn. It is  recommended  not  to  use  this
               option.  Instead, the password can be stashed using the stashsrvpw command of kdb5_ldap_util.

       The -r realm option specifies the realm for which the server should provide service; by  default  the
       realm returned by krb5_default_local_realm(3) is used.

       The  -d  dbname option specifies the name under which the principal database can be found; by default
       the database is in DEFAULT_DBM_FILE.  This option does not apply to the LDAP database.

       The -k keytype option specifies the key type of the master key to be entered manually as  a  password
       when -m is given; the default is "des-cbc-crc".

       The  -M  mkeyname option specifies the principal name for the master key in the database; the default
       is KRB5_KDB_M_NAME (usually "K/M" in the KDC's realm).

       The -p portnum option specifies the default UDP port number which the KDC should listen on  for  Ker-beros Kerberos
       beros  version  5 requests.  This value is used when no port is specified in the KDC profile and when
       no port is specified in the Kerberos configuration file.  If no value is available, then the value in
       /etc/services for service "kerberos" is used.

       The  -m option specifies that the master database password should be fetched from the keyboard rather
       than from a file on disk.

       The -4 option specifies how the KDC responds to kerberos IV requests for tickets.  The  command  line
       option  overrides  the  value  in  the  KDC  profile.  The possible values are none, disable, full or
       nopreauth.  These instruct the KDC to not respond to V4 packets,  to  respond  with  a  version  skew
       error,  to issue tickets for all database entries, and to issue tickets for all but preauthentication
       required database entries respectively. The default behaviour is as if none was specified.

       The -n option specifies that the KDC does not put itself in the background and does not  disassociate
       itself  from  the  terminal.  In normal operation, you should always allow the KDC to place itself in
       the background.

       The KDC may service requests for multiple realms (maximum 32 realms).  The realms are listed  on  the
       command  line.   Per-realm  options  that can be specified on the command line pertain for each realm
       that follows it and are superceded by subsequent definitions of the same option.  For example,

       krb5kdc -p 2__1 -r REALM1 -p 2__2 -r REALM2 -r REALM3

       specifies that the KDC listen on port 2001 for REALM1 and on port 2002 for REALM2 and REALM3.   Addi-tionally, Additionally,
       tionally,  per-realm parameters may be specified in the kdc.conf file.  The location of this file may
       be specified by the KRB5_KDC_PROFILE environment variable.  Parameters specified in  this  file  take
       precedence  over  options specified on the command line.  See the kdc.conf(5) description for further
       details.

SEE ALSO
       krb5(3), kdb5_util(8), kdc.conf(5), kdb5_ldap_util(8)

BUGS
       It should fork and go into the background when it finishes reading the master password from the  ter-minal. terminal.
       minal.



                                                                                                  KRB5KDC(8)

Reporting Problems

The way to report a problem with this manual page depends on the type of problem:

Content errors
Report errors in the content of this documentation with the feedback links below.
Bug reports
Report bugs in the functionality of the described tool or API through Bug Reporter.
Formatting problems
Report formatting mistakes in the online version of these pages with the feedback links below.

Did this document help you? Yes It's good, but... Not helpful...