IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2024-12-25 08:21:05 -06:00
Code Issues Packages Projects Releases Wiki Activity
d2d487bccc
freeipa/install/share/kdc.conf.template

24 lines
620 B
Plaintext
Raw Normal View History

Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
[kdcdefaults]
Make sure we listen only on the krb5 port and therefore disable krb4 support
2008-07-02 09:05:55 -05:00
kdc_ports = 88
Make KDC listen to TCP port as well by default
2008-12-12 19:10:04 -06:00
kdc_tcp_ports = 88
Restrict anonymous tgts Fixes: https://fedorahosted.org/freeipa/ticket/432
2011-01-12 15:43:00 -06:00
restrict_anonymous_to_tgt = true
Enable SPAKE support using krb5.conf.d snippet Because krb5 silently ignores unrecognized options, this is safe on all versions. It lands upstream in krb5-1.17; in Fedora, it was added in krb5-1.6-17. Upstream documentation can be found in-tree at https://github.com/krb5/krb5/blob/master/doc/admin/spake.rst Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Christian Heimes <cheimes@redhat.com>
2018-04-09 13:33:56 -05:00
spake_preauth_kdc_challenge = edwards25519
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
[realms]
$REALM = {
Use strongest keytype for master key
2010-11-01 08:33:14 -05:00
master_key_type = aes256-cts
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
max_life = 7d
max_renewable_life = 14d
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-22 17:32:52 -05:00
acl_file = $KRB5KDC_KADM5_ACL
dict_file = $DICT_WORDS
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
default_principal_flags = +preauth
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-22 17:32:52 -05:00
; admin_keytab = $KRB5KDC_KADM5_KEYTAB
Configure Anonymous PKINIT on server install Allow anonymous pkinit to be used so that unenrolled hosts can perform FAST authentication (necessary for 2FA for example) using an anonymous krbtgt obtained via Pkinit. https://fedorahosted.org/freeipa/ticket/5678 Signed-off-by: Simo Sorce <simo@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2016-07-26 10:19:01 -05:00
pkinit_identity = FILE:$KDC_CERT,$KDC_KEY
server install: fix KDC PKINIT configuration Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known to IPA. Make sure `cacert.pem` is exported in all installation code paths. Use the KDC certificate itself as a PKINIT anchor in `login_password`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-03 01:09:03 -05:00
pkinit_anchors = FILE:$KDC_CERT
Fix kdc.conf.template to use ipaplatform.paths. https://fedorahosted.org/freeipa/ticket/5343 Reviewed-By: David Kupka <dkupka@redhat.com>
2016-03-22 17:32:52 -05:00
pkinit_anchors = FILE:$CACERT_PEM
server install: fix KDC PKINIT configuration Set `pkinit_pool` in `kdc.conf` to a CA certificate bundle of all CAs known to IPA. Make sure `cacert.pem` is exported in all installation code paths. Use the KDC certificate itself as a PKINIT anchor in `login_password`. https://pagure.io/freeipa/issue/6831 Reviewed-By: Stanislav Laznicka <slaznick@redhat.com> Reviewed-By: Martin Babinsky <mbabinsk@redhat.com>
2017-05-03 01:09:03 -05:00
pkinit_pool = FILE:$CA_BUNDLE_PEM
Add new authentication indicators in kdc.conf.template As of release 1.17, KDC can be configured to apply authentication indicator for SPAKE, PKINIT, and encrypted challenge preauth via FAST channel, which are not configured in current version of freeIPA. Note that even though the value of encrypted_challenge_indicator is attached only when encrypted challenge preauth is performed along a FAST channel, it's possible to perform FAST without encrypted challenge by using SPAKE. Since there is no reason to force clients not to use SPAKE while using FAST, we made a design choice to merge SPAKE and FAST in a new option called "Hardened Password", which requires user to use at least one of SPAKE or FAST channel. Hence same value attaching to both spake_preauth_indicator and encrypted_challenge_indicator. Resolves: https://pagure.io/freeipa/issue/8001 Signed-off-by: Changmin Teng <cteng@redhat.com> Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com> Reviewed-By: Simo Sorce <ssorce@redhat.com> Reviewed-By: Robbie Harwood <rharwood@redhat.com>
2019-07-29 10:17:08 -05:00
pkinit_indicator = pkinit
spake_preauth_indicator = hardened
encrypted_challenge_indicator = hardened
Added krbinstance to configure the kerberos server Added/Modified ldif files to add the needed schemas and basic DIT, SASL configuration and ACLs Added tenmpate files foir kerberos configuration Added required packages section to README Minor mods to dsinstance Untested!
2007-06-28 18:09:54 -05:00
}
Reference in New Issue Copy Permalink