freeipa/install/share/kdc.conf.template

[kdcdefaults]
 kdc_ports = 88
 kdc_tcp_ports = 88
 restrict_anonymous_to_tgt = true

[realms]
 $REALM = {
  master_key_type = aes256-cts
  max_life = 7d
  max_renewable_life = 14d
  acl_file = $KRB5KDC_KADM5_ACL
  dict_file = $DICT_WORDS
  default_principal_flags = +preauth
;  admin_keytab = $KRB5KDC_KADM5_KEYTAB
  pkinit_identity = FILE:$KDC_CERT,$KDC_KEY
  pkinit_anchors = FILE:$CACERT_PEM
 }
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 19:09:54 -04:00			`[kdcdefaults]`
Make sure we listen only on the krb5 port and therefore disable krb4 support 2008-07-02 10:05:55 -04:00			`kdc_ports = 88`
Make KDC listen to TCP port as well by default 2008-12-12 20:10:04 -05:00			`kdc_tcp_ports = 88`
Restrict anonymous tgts Fixes: https://fedorahosted.org/freeipa/ticket/432 2011-01-12 16:43:00 -05:00			`restrict_anonymous_to_tgt = true`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 19:09:54 -04:00
			`[realms]`
			`$REALM = {`
Use strongest keytype for master key 2010-11-01 09:33:14 -04:00			`master_key_type = aes256-cts`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 19:09:54 -04:00			`max_life = 7d`
			`max_renewable_life = 14d`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-23 00:32:52 +02:00			`acl_file = $KRB5KDC_KADM5_ACL`
			`dict_file = $DICT_WORDS`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 19:09:54 -04:00			`default_principal_flags = +preauth`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-23 00:32:52 +02:00			`; admin_keytab = $KRB5KDC_KADM5_KEYTAB`
Configure Anonymous PKINIT on server install Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com> 2016-07-26 11:19:01 -04:00			`pkinit_identity = FILE:$KDC_CERT,$KDC_KEY`
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com> 2016-03-23 00:32:52 +02:00			`pkinit_anchors = FILE:$CACERT_PEM`
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested! 2007-06-28 19:09:54 -04:00			`}`