MIT Kerberos defaults¶
General defaults¶
| Description | Default | Environment |
|---|---|---|
| keytab file | DEFKTNAME | KRB5_KTNAME |
| Client keytab file | DEFCKTNAME | KRB5_CLIENT_KTNAME |
| Kerberos config file krb5.conf | /etc/krb5.conf:SYSCONFDIR/krb5.conf |
KRB5_CONFIG |
| KDC config file kdc.conf | LOCALSTATEDIR/krb5kdc/kdc.conf |
KRB5_KDC_PROFILE |
| GSS mechanism config file | SYSCONFDIR/gss/mech |
GSS_MECH_CONFIG |
| KDC database path (DB2) | LOCALSTATEDIR/krb5kdc/principal |
|
| Master key stash file | LOCALSTATEDIR/krb5kdc/.k5.realm |
|
| Admin server ACL file kadm5.acl | LOCALSTATEDIR/krb5kdc/kadm5.acl |
|
| OTP socket directory | RUNSTATEDIR/krb5kdc |
|
| Plugin base directory | LIBDIR/krb5/plugins |
|
| replay cache directory | /var/tmp |
KRB5RCACHEDIR |
| Master key default enctype | aes256-cts-hmac-sha1-96 |
|
| Default keysalt list | aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal |
|
| Permitted enctypes | aes256-cts-hmac-sha1-96 aes128-cts-hmac-sha1-96 aes256-cts-hmac-sha384-192 aes128-cts-hmac-sha256-128 des3-cbc-sha1 arcfour-hmac-md5 camellia256-cts-cmac camellia128-cts-cmac |
|
| KDC default port | 88 | |
| Admin server port | 749 | |
| Password change port | 464 |
Replica KDC propagation defaults¶
This table shows defaults used by the kprop and kpropd programs.
| Description | Default | Environment |
|---|---|---|
| kprop database dump file | LOCALSTATEDIR/krb5kdc/replica_datatrans |
|
| kpropd temporary dump file | LOCALSTATEDIR/krb5kdc/from_master |
|
| kdb5_util location | SBINDIR/kdb5_util |
|
| kprop location | SBINDIR/kprop |
|
| kpropd ACL file | LOCALSTATEDIR/krb5kdc/kpropd.acl |
|
| kprop port | 754 | KPROP_PORT |
Default paths for Unix-like systems¶
On Unix-like systems, some paths used by MIT krb5 depend on parameters
chosen at build time. For a custom build, these paths default to
subdirectories of /usr/local. When MIT krb5 is integrated into an
operating system, the paths are generally chosen to match the
operating system’s filesystem layout.
| Description | Symbolic name | Custom build path | Typical OS path |
|---|---|---|---|
| User programs | BINDIR | /usr/local/bin |
/usr/bin |
| Libraries and plugins | LIBDIR | /usr/local/lib |
/usr/lib |
| Parent of KDC state dir | LOCALSTATEDIR | /usr/local/var |
/var |
| Parent of KDC runtime dir | RUNSTATEDIR | /usr/local/var/run |
/run |
| Administrative programs | SBINDIR | /usr/local/sbin |
/usr/sbin |
| Alternate krb5.conf dir | SYSCONFDIR | /usr/local/etc |
/etc |
| Default ccache name | DEFCCNAME | FILE:/tmp/krb5cc_%{uid} |
FILE:/tmp/krb5cc_%{uid} |
| Default keytab name | DEFKTNAME | FILE:/etc/krb5.keytab |
FILE:/etc/krb5.keytab |
The default client keytab name (DEFCKTNAME) typically defaults to
FILE:/usr/local/var/krb5/user/%{euid}/client.keytab for a custom
build. A native build will typically use a path which will vary
according to the operating system’s layout of /var.