Managing Kerberos and Other Authentication Services in Oracle® Solaris 11.2

Exit Print View

Updated: August 2014

How to Use kdcmgr to Configure a Slave KDC

Before You Begin

The master KDC server is configured.

You must assume the root role. For more information, see Using Your Assigned Administrative Rights in Securing Users and Processes in Oracle Solaris 11.2 .

  1. Create a slave KDC.

    On the command line, run the kdcmgr command and name the administrator, the realm, and the master KDC.

    The script prompts for the two passwords that you created in How to Use kdcmgr to Configure the Master KDC, one for the administrative principal and one for the KDC database.

    kdc2# kdcmgr -a kws/admin -r EXAMPLE.COM create -m kdc1 slave
    Starting server setup
    Setting up /etc/krb5/kdc.conf
    Setting up /etc/krb5/krb5.conf
    Obtaining TGT for kws/admin ...
    Password for kws/admin@EXAMPLE.COM: xxxxxxxx
    Setting up /etc/krb5/kadm5.acl.
    Setting up /etc/krb5/kpropd.acl.
    Waiting for database from master...
    Waiting for database from master...
    Waiting for database from master...
    kdb5_util: Cannot find/read stored master key while reading master key
    kdb5_util: Warning: proceeding without master key
    Enter KDC database master key: xxxxxxxx
    Setup COMPLETE.
  2. (Optional) Display the status of the KDC.
    # kdcmgr status
  3. Synchronize this system's clock with other clocks in the realm by using NTP or another mechanism.

    If you do not have an NTP server, you can use this system as your NTP server.

    For authentication to succeed, every clock must be within the default time that is defined in the libdefaults section of the krb5.conf file. For more information, see the krb5.conf(4) man page. For information about the Network Time Protocol (NTP), see Synchronizing Clocks Between KDCs and Kerberos Clients.

Next Steps

Return to the master KDC after the NTP server is installed to make the master KDC a client of the NTP server.