How to Use kdcmgr to Configure a Slave KDC

Before You Begin

The master KDC server is configured.

You must assume the root role. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.2 .

1. Create a slave KDC.

   On the command line, run the kdcmgr command and name the administrator, the realm, and the master KDC.

   The script prompts for the two passwords that you created in How to Use kdcmgr to Configure the Master KDC, one for the administrative principal and one for the KDC database.

   kdc2# kdcmgr -a kws/admin -r EXAMPLE.COM create -m kdc1 slave
   
   Starting server setup
   ---------------------------------------
   
   Setting up /etc/krb5/kdc.conf
   
   Setting up /etc/krb5/krb5.conf
   Obtaining TGT for kws/admin ...
   Password for kws/admin@EXAMPLE.COM: xxxxxxxx
   
   Setting up /etc/krb5/kadm5.acl.
   
   Setting up /etc/krb5/kpropd.acl.
   
   Waiting for database from master...
   Waiting for database from master...
   Waiting for database from master...
   kdb5_util: Cannot find/read stored master key while reading master key
   kdb5_util: Warning: proceeding without master key
   Enter KDC database master key: xxxxxxxx
   
   ---------------------------------------------------
   Setup COMPLETE.
   
   kdc2#

2. (Optional) Display the status of the KDC.

   # kdcmgr status

3. Synchronize this system's clock with other clocks in the realm by using NTP or another mechanism.

   If you do not have an NTP server, you can use this system as your NTP server.

   For authentication to succeed, every clock must be within the default time that is defined in the libdefaults section of the krb5.conf file. For more information, see the krb5.conf(4) man page. For information about the Network Time Protocol (NTP), see Synchronizing Clocks Between KDCs and Kerberos Clients.

Next Steps

Return to the master KDC after the NTP server is installed to make the master KDC a client of the NTP server.