Managing Kerberos and Other Authentication Services in Oracle® Solaris 11.2

Exit Print View

Updated: August 2014

Manually Propagating the Kerberos Database to the Slave KDCs

Typically, a cron job propagates the Kerberos database to slave KDCs. If you need to synchronize a slave KDC with the master KDC outside the periodic cron job, you have two options, the /usr/lib/krb5/kprop_script and the kprop command. For more information, review the script and the kprop(1M) man page.


Caution  -  Do not use these commands if incremental propagation is enabled on the slave KDC.

How to Manually Propagate the Kerberos Database to a Slave KDC

  1. Verify that incremental propagation is not enabled on the slave KDC.
    slave# grep sunw_dbprop_enable /etc/krb5/kdc.conf
    sunw_dbprop_enable = true
  2. If the value is true, disable incremental propagation and restart the krb5_prop service.
    slave# cp /etc/krb5/kdc.conf /etc/krb5/kdc.conf.sav
    slave# pfedit /etc/krb5/kdc.conf
    sunw_dbprop_enable = false
    slave# svcadm restart krb5_prop
  3. On the master KDC, use one of the following commands to propagate the master KDC database to the slave KDC.
    • The kprop_script command backs up the database before synchronizing the slave KDC.
      master# /usr/lib/krb5/kprop_script slave-KDC
    • The kprop command propagates the current database backup without first making a new backup of the Kerberos database.
      master# /usr/lib/krb5/kprop -f /var/krb5/slave_datatrans slave-KDC
  4. (Optional) After manual propagation is complete, restore the original krb5.conf file.
    slave# mv /etc/krb5/kdc.conf.sav /etc/krb5/kdc.conf