KRB5.CONF(5)

NAME
/etc/krb5.conf - Configuration file for Kerberos 5

DESCRIPTION
The /etc/krb5.conf file specifies several configuration parameters for the Kerberos 5 library, as well as for some programs.

The file consists of one or more sections, containing a number of bindings. The value of each binding can be either a string or a list of other bindings. The grammar looks like:

    file:
    	/* empty */
    	sections
    sections:
    	section sections
    	section
    section:
    	'[' section_name ']' bindings
    section_name:
    	STRING
    bindings:
    	binding bindings
    	binding
    binding:
    	name '=' STRING
    	name '=' '{' bindings '}'
    name:
    	STRING

STRINGs consists of one or more non-white space characters. Currently recognised sections and bindings are:

[libdefaults]

    default_realm = REALM
        Default realm to use, this is also known as your “local realm”. The default is the result of krb5_get_host_realm(local hostname).

    clockskew = time
        Maximum time differential (in seconds) allowed when comparing times. Default is 300 seconds (five minutes).

    kdc_timeout = time
        Maximum time to wait for a reply from the kdc, default is 3 seconds.

    v4_name_convert

    v4_instance_resolve
        These are decribed in the krb5_425_conv_principal(3) manual page.

    capath = realm-routing-table

    default_etypes = etypes...
        A list of default etypes to use.

    default_etypes_des = etypes...
        A list of default etypes to use when requesting a DES credential.

    default_keytab_name = keytab
        The keytab to use if none other is specified, default is “FILE:/etc/krb5.keytab”.

    kdc_timesync = boolean
        Try to keep track of the time differential between the local machine and the KDC, and then compensate for that when issuing requests.

    max_retries = number
        The max number of times to try to contact each KDC.

    ticket_lifetime = time
        Default ticket lifetime.

    renew_lifetime = time
        Default renewable ticket lifetime.

    verify_ap_req_nofail = boolean
        Enable to make a failure to verify obtained credentials non-fatal. This can be useful if there is no keytab on a host.

    warn_pwexpire = time
        How soon to warn for expiring password. Default is seven days.

    http_proxy = proxy-spec
        A HTTP-proxy to use when talking to the KDC via HTTP.

    dns_proxy = proxy-spec
        Enable using DNS via HTTP.

    extra_addresses = address...
        A list of addresses to get tickets for along with all local addresses.

    time_format = string
        How to print time strings in logs, this string is passed to strftime(3).

    log_utc = boolean
        Write log-entries using UTC instead of your local time zone.

[domain_realm]
    This is a list of mappings from DNS domain to Kerberos realm. Each binding in this section looks like:

        domain = realm

    The domain can be either a full name of a host or a trailing component, in the latter case the domain-string should start with a perid.

[realms]

    REALM = {

        kdc = host[:port]
            Specifies a kdc for this realm. If the optional port is absent, the default value for the “kerberos/udp” service will be used.

        v4_instance_convert

        v4_name_convert

        default_domain
            See krb5_425_conv_principal(3).

    }

[logging]

    entity = destination
        Specifies that entity should use the specified destination for logging. See the krb5_openlog(3) manual page for a list of defined destinations.

EXAMPLE

    [lib_defaults]
    	default_domain = FOO.SE
    [domain_realm]
    	.foo.se = FOO.SE
    	.bar.se = FOO.SE
    [realms]
    	FOO.SE = {
    		kdc = kerberos.foo.se
    		v4_name_convert = {
    			rcmd = host
    		}
    		v4_instance_convert = {
    			xyz = xyz.bar.se
    		}
    		default_domain = foo.se
    	}
    [logging]
    	kdc = FILE:/var/heimdal/kdc.log
    	kdc = SYSLOG:INFO
    	default = SYSLOG:INFO:USER

SEE ALSO
krb5_openlog(3), krb5_425_conv_principal(3), strftime(3), Source(tm)