As stated earlier in this section, MIT recommends that on a
secure host, you disable the standard ftp, login,
telnet, shell, and exec services in
/etc/inetd.conf. We also recommend that secure hosts have an empty
/etc/hosts.equiv file and that there not be a .rhosts file
in root's home directory. You can grant Kerberos-authenticated
root access to specific Kerberos principals by placing those principals
in the file .k5login in root's home directory.
We recommend that backups of secure machines exclude the keytab file
(/etc/krb5.keytab). If this is not possible, the backups should
at least be done locally, rather than over a network, and the backup
tapes should be physically secured.
Finally, the keytab file and any programs run by root, including the Kerberos V5 binaries, should be kept on local disk. The keytab file should be readable only by root.