freeipa/install/share/kdc.conf.template

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88
 restrict_anonymous_to_tgt = true
 spake_preauth_kdc_challenge = edwards25519

[realms]
 $REALM = {
  master_key_type = $MASTER_KEY_TYPE
  supported_enctypes = $SUPPORTED_ENCTYPES
  max_life = 7d
  max_renewable_life = 14d
  acl_file = $KRB5KDC_KADM5_ACL
  dict_file = $DICT_WORDS
  default_principal_flags = +preauth
;  admin_keytab = $KRB5KDC_KADM5_KEYTAB
  pkinit_identity = FILE:$KDC_CERT,$KDC_KEY
  pkinit_anchors = FILE:$KDC_CERT
  pkinit_anchors = FILE:$CACERT_PEM
  pkinit_pool = FILE:$CA_BUNDLE_PEM
  pkinit_indicator = pkinit
  spake_preauth_indicator = hardened
  encrypted_challenge_indicator = hardened
 }
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 18:09:54 -05:00			`[kdcdefaults]`
Make sure we listen only on the krb5 port and therefore disable krb4 support 2008-07-02 09:05:55 -05:00			`kdc_ports = 88`
Make KDC listen to TCP port as well by default 2008-12-12 19:10:04 -06:00			`kdc_tcp_ports = 88`
Restrict anonymous tgts Fixes: https://fedorahosted.org/freeipa/ticket/432 2011-01-12 15:43:00 -06:00			`restrict_anonymous_to_tgt = true`
Enable SPAKE support using krb5.conf.d snippet Because krb5 silently ignores unrecognized options, this is safe on all versions. It lands upstream in krb5-1.17; in Fedora, it was added in krb5-1.6-17. Upstream documentation can be found in-tree at https://github.com/krb5/krb5/blob/master/doc/admin/spake.rst Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com> 2018-04-09 13:33:56 -05:00			`spake_preauth_kdc_challenge = edwards25519`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 18:09:54 -05:00
			`[realms]`
			`$REALM = {`
KRB instance: make provision to work with crypto policy without SHA-1 HMAC types RHEL 9 system-wide crypto policies aim at eventual removal of SHA-1 use. Due to bootstrapping process, force explicitly supported encryption types in kdc.conf or we may end up with AES128-SHA1 and AES256-SHA2 only in FIPS mode at bootstrap time which then fails to initialize kadmin principals requiring use of AES256-SHA2 and AES128-SHA2. Camellia ciphers must be filtered out in FIPS mode, we do that already in the kerberos.ldif. At this point we are not changing the master key encryption type to AES256-SHA2 because upgrading existing deployments is complicated and at the time when a replica configuration is deployed, we don't know what is the encryption type of the master key of the original server as well. Fixes: https://pagure.io/freeipa/issue/9119 Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Julien Rische <jrische@redhat.com> Reviewed-By: Francisco Trivino <ftrivino@redhat.com> 2022-02-25 00:58:24 -06:00			`master_key_type = $MASTER_KEY_TYPE`
			`supported_enctypes = $SUPPORTED_ENCTYPES`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 18:09:54 -05:00			`max_life = 7d`
			`max_renewable_life = 14d`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-22 17:32:52 -05:00			`acl_file = $KRB5KDC_KADM5_ACL`
			`dict_file = $DICT_WORDS`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 18:09:54 -05:00			`default_principal_flags = +preauth`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-22 17:32:52 -05:00			`; admin_keytab = $KRB5KDC_KADM5_KEYTAB`
Configure Anonymous PKINIT on server install Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2016-07-26 10:19:01 -05:00			`pkinit_identity = FILE:$KDC_CERT,$KDC_KEY`
server install: fix KDC PKINIT configuration Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known to IPA. Make sure `cacert.pem` is exported in all installation code paths. Use the KDC certificate itself as a PKINIT anchor in `login_password`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2017-05-03 01:09:03 -05:00			`pkinit_anchors = FILE:$KDC_CERT`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-22 17:32:52 -05:00			`pkinit_anchors = FILE:$CACERT_PEM`
server install: fix KDC PKINIT configuration Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known to IPA. Make sure `cacert.pem` is exported in all installation code paths. Use the KDC certificate itself as a PKINIT anchor in `login_password`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2017-05-03 01:09:03 -05:00			`pkinit_pool = FILE:$CA_BUNDLE_PEM`
Add new authentication indicators in kdc.conf.template As of release 1.17, KDC can be configured to apply authentication indicator for SPAKE, PKINIT, and encrypted challenge preauth via FAST channel, which are not configured in current version of freeIPA. Note that even though the value of encrypted_challenge_indicator is attached only when encrypted challenge preauth is performed along a FAST channel, it's possible to perform FAST without encrypted challenge by using SPAKE. Since there is no reason to force clients not to use SPAKE while using FAST, we made a design choice to merge SPAKE and FAST in a new option called "Hardened Password", which requires user to use at least one of SPAKE or FAST channel. Hence same value attaching to both spake_preauth_indicator and encrypted_challenge_indicator. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com> 2019-07-29 10:17:08 -05:00			`pkinit_indicator = pkinit`
			`spake_preauth_indicator = hardened`
			`encrypted_challenge_indicator = hardened`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 18:09:54 -05:00			`}`