Configuration Steps for Setting Up Parallel Propagation

The high-level configuration steps to enable parallel propagation are as follows:

1. On the master KDC, change the kprop_script entry in its cron job to include arguments for only the KDC slaves that will perform the succeeding propagation (the propagation slaves).

2. On each propagation slave, add a kprop_script entry to its cron job, which must include arguments for the slaves to propagate. To successfully propagate in parallel, the cron job should be set up to run after the propagation slave is itself propagated with the new Kerberos database.

   ---

   Note -  The amount of time necessary for a propagation slave to be propagated depends on factors such as network bandwidth and the size of the Kerberos database.

   ---

3. On each slave KDC, set up the appropriate permissions to be propagated by adding the host principal name of its propagating KDC to its kpropd.acl file.

Example 4-16  Setting Up Parallel Propagation in Kerberos

Using the example in Figure 4–2, the master KDC's kprop_script entry would look similar to the following:

0 3 * * * /usr/lib/krb5/kprop_script slave-1.example.com slave-4.example.com

The slave-1's kprop_script entry would look similar to the following:

0 4 * * * /usr/lib/krb5/kprop_script slave-2.example.com slave-3.example.com

Note that the propagation on the slave starts an hour after it is propagated by the master.

The kpropd.acl file on the propagation slaves would contain the following entry:

host/master.example.com@EXAMPLE.COM

The kpropd.acl file on the KDC slaves being propagated by slave-1 would contain the following entry:

host/slave-1.example.com@EXAMPLE.COM