Manually Propagating the Kerberos Database to the Slave KDCs

Typically, a cron job propagates the Kerberos database to slave KDCs. If you need to synchronize a slave KDC with the master KDC outside the periodic cron job, you have two options, the /usr/lib/krb5/kprop_script and the kprop command. For more information, review the script and the kprop(1M) man page.

How to Manually Propagate the Kerberos Database to a Slave KDC

1. Verify that incremental propagation is not enabled on the slave KDC.

   slave# grep sunw_dbprop_enable /etc/krb5/kdc.conf
   sunw_dbprop_enable = true

2. If the value is true, disable incremental propagation and restart the krb5_prop service.

   slave# cp /etc/krb5/kdc.conf /etc/krb5/kdc.conf.sav
   slave# pfedit /etc/krb5/kdc.conf
   ...
   sunw_dbprop_enable = false
   ...
   
   slave# svcadm restart krb5_prop

3. On the master KDC, use one of the following commands to propagate the master KDC database to the slave KDC.
   • The kprop_script command backs up the database before synchronizing the slave KDC.

     master# /usr/lib/krb5/kprop_script slave-KDC

   • The kprop command propagates the current database backup without first making a new backup of the Kerberos database.

     master# /usr/lib/krb5/kprop -f /var/krb5/slave_datatrans slave-KDC

4. (Optional) After manual propagation is complete, restore the original krb5.conf file.

   slave# mv /etc/krb5/kdc.conf.sav /etc/krb5/kdc.conf