1KPROPD(8)                        MIT Kerberos                        KPROPD(8)
2
3
4

NAME

6       kpropd - Kerberos V5 replica KDC update server
7

SYNOPSIS

9       kpropd [-r realm] [-A admin_server] [-a acl_file] [-f replica_dumpfile]
10       [-F    principal_database]    [-p     kdb5_util_prog]     [-P     port]
11       [--pid-file=pid_file] [-D] [-d] [-s keytab_file]
12

DESCRIPTION

14       The  kpropd command runs on the replica KDC server.  It listens for up‐
15       date requests made by the kprop(8) program.  If incremental propagation
16       is  enabled, it periodically requests incremental updates from the pri‐
17       mary KDC.
18
19       When the replica receives a kprop request from the primary, kpropd  ac‐
20       cepts  the  dumped  KDC database and places it in a file, and then runs
21       kdb5_util(8) to load the dumped database into the active database which
22       is  used by krb5kdc(8).  This allows the primary Kerberos server to use
23       kprop(8) to propagate its database to the replica servers.  Upon a suc‐
24       cessful  download of the KDC database file, the replica Kerberos server
25       will have an up-to-date KDC database.
26
27       Where incremental propagation is not used, kpropd is  commonly  invoked
28       out  of inetd(8) as a nowait service.  This is done by adding a line to
29       the /etc/inetd.conf file which looks like this:
30
31          kprop  stream  tcp  nowait  root  /usr/local/sbin/kpropd  kpropd
32
33       kpropd can also run as a standalone daemon,  backgrounding  itself  and
34       waiting  for connections on port 754 (or the port specified with the -P
35       option if given).  Standalone mode is required for incremental propaga‐
36       tion.   Starting  in release 1.11, kpropd automatically detects whether
37       it was run from inetd and runs in standalone mode if it is not.   Prior
38       to  release 1.11, the -S option is required to run kpropd in standalone
39       mode; this option is now accepted for backward compatibility  but  does
40       nothing.
41
42       Incremental  propagation  may be enabled with the iprop_enable variable
43       in kdc.conf(5).  If incremental propagation is enabled, the replica pe‐
44       riodically polls the primary KDC for updates, at an interval determined
45       by the iprop_replica_poll variable.  If the replica  receives  updates,
46       kpropd  updates  its log file with any updates from the primary.  kpro‐
47       plog(8) can be used to view a summary of the update entry  log  on  the
48       replica  KDC.   If  incremental  propagation  is enabled, the principal
49       kiprop/replicahostname@REALM (where replicahostname is the name of  the
50       replica  KDC host, and REALM is the name of the Kerberos realm) must be
51       present in the replica's keytab file.
52
53       kproplog(8) can be used to force full replication  when  iprop  is  en‐
54       abled.
55

OPTIONS

57       -r realm
58              Specifies the realm of the primary server.
59
60       -A admin_server
61              Specifies the server to be contacted for incremental updates; by
62              default, the primary admin server is contacted.
63
64       -f file
65              Specifies the filename where the dumped principal database  file
66              is  to  be  stored;  by  default  the  dumped  database  file is
67              /var/kerberos/krb5kdc/from_master.
68
69       -F kerberos_db
70              Path to the Kerberos database file, if not the default.
71
72       -p     Allows the user to specify the pathname to the kdb5_util(8) pro‐
73              gram; by default the pathname used is /usr/sbin/kdb5_util.
74
75       -D     In this mode, kpropd will not detach itself from the current job
76              and run in the background.  Instead, it will run  in  the  fore‐
77              ground.
78
79       -d     Turn  on  debug  mode.  kpropd will print out debugging messages
80              during the database propogation and will run in  the  foreground
81              (implies -D).
82
83       -P     Allow  for  an  alternate  port  number for kpropd to listen on.
84              This is only useful in combination with the -S option.
85
86       -a acl_file
87              Allows the user to specify the path to the kpropd.acl  file;  by
88              default the path used is /var/kerberos/krb5kdc/kpropd.acl.
89
90       --pid-file=pid_file
91              In  standalone  mode,  write  the  process ID of the daemon into
92              pid_file.
93
94       -s keytab_file
95              Path to a keytab to use for acquiring acceptor credentials.
96
97       -x db_args
98              Database-specific arguments.  See Database Options in  kadmin(1)
99              for supported arguments.
100

FILES

102       kpropd.acl
103              Access  file  for  kpropd;  the  default  location  is  /usr/lo‐
104              cal/var/krb5kdc/kpropd.acl.  Each entry is a line containing the
105              principal of a host from which the local machine will allow Ker‐
106              beros database propagation via kprop(8).
107

ENVIRONMENT

109       See kerberos(7) for a description of Kerberos environment variables.
110

SEE ALSO

112       kprop(8), kdb5_util(8), krb5kdc(8), kerberos(7), inetd(8)
113

AUTHOR

115       MIT
116

118       1985-2021, MIT
119
120
121
122
1231.19.1                                                               KPROPD(8)
Impressum