如何重新配置从 KDC 服务器以使用增量传播

开始之前

您必须承担 root 角色。有关更多信息，请参见在 Oracle Solaris 11.2 中确保用户和进程的安全 中的使用所指定的管理权限。

1. 向 kdc.conf 中添加项。

   第一个新项将启用增量传播。第二个新项将轮询时间设为两分钟。

   kdc2 # pfedit /etc/krb5/kdc.conf
   [kdcdefaults]
   kdc_ports = 88,750
   
   [realms]
   EXAMPLE.COM= {
   profile = /etc/krb5/krb5.conf
   database_name = /var/krb5/principal
   acl_file = /etc/krb5/kadm5.acl
   kadmind_port = 749
   max_life = 8h 0m 0s
   max_renewable_life = 7d 0h 0m 0s
   sunw_dbprop_enable = true
   sunw_dbprop_slave_poll = 2m
   }

2. 将 kiprop 主体添加到 krb5.keytab 文件中。

   kdc2 # /usr/sbin/kadmin -p kws/admin
   Enter password: xxxxxxxx
   kadmin: ktadd kiprop/kdc2.example.com
   Entry for principal kiprop/kdc2.example.com with kvno 3,
   encryption type AES-256 CTS mode
   with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
   Entry for principal kiprop/kdc2.example.com with kvno 3,
   encryption type AES-128 CTS mode
   with 96-bit SHA-1 HMAC added to keytab WRFILE:/etc/krb5/krb5.keytab.
   Entry for principal kiprop/kdc2.example.com with kvno 3, encryption type Triple DES cbc
   mode with HMAC/sha1 added to keytab WRFILE:/etc/krb5/krb5.keytab.
   kadmin: quit

3. 重新启动 kpropd。

   kdc2 # svcadm restart network/security/krb5_prop