NAME

       kpropd - Kerberos V5 replica KDC update server

SYNOPSIS

       kpropd  [-r  realm]  [-A  admin_server]  [-a  acl_file] [-f replica_dumpfile] [-F principal_database] [-p
       kdb5_util_prog] [-P port] [--pid-file=pid_file] [-d] [-t]

DESCRIPTION

       The kpropd command runs on the replica KDC server.  It listens for update requests made by  the  kprop(8)
       program.   If  incremental  propagation is enabled, it periodically requests incremental updates from the
       master KDC.

       When the replica receives a kprop request from the master, kpropd accepts the  dumped  KDC  database  and
       places  it  in  a  file,  and then runs kdb5_util(8) to load the dumped database into the active database
       which is used by krb5kdc(8).  This allows the master Kerberos server to use  kprop(8)  to  propagate  its
       database  to  the  replica  servers.   Upon  a  successful download of the KDC database file, the replica
       Kerberos server will have an up-to-date KDC database.

       Where incremental propagation is not used, kpropd is  commonly  invoked  out  of  inetd(8)  as  a  nowait
       service.  This is done by adding a line to the /etc/inetd.conf file which looks like this:

          kprop  stream  tcp  nowait  root  /usr/local/sbin/kpropd  kpropd

       kpropd  can also run as a standalone daemon, backgrounding itself and waiting for connections on port 754
       (or the port specified with the -P option  if  given).   Standalone  mode  is  required  for  incremental
       propagation.   Starting  in  release 1.11, kpropd automatically detects whether it was run from inetd and
       runs in standalone mode if it is not.  Prior to release 1.11, the -S option is required to run kpropd  in
       standalone mode; this option is now accepted for backward compatibility but does nothing.

       Incremental  propagation  may  be  enabled with the iprop_enable variable in kdc.conf(5).  If incremental
       propagation is enabled, the replica periodically polls  the  master  KDC  for  updates,  at  an  interval
       determined  by  the iprop_replica_poll variable.  If the replica receives updates, kpropd updates its log
       file with any updates from the master.  kproplog(8) can be used to view a summary of the update entry log
       on the replica KDC.  If incremental propagation is enabled,  the  principal  kiprop/replicahostname@REALM
       (where  replicahostname is the name of the replica KDC host, and REALM is the name of the Kerberos realm)
       must be present in the replica's keytab file.

       kproplog(8) can be used to force full replication when iprop is enabled.

OPTIONS

       -r realm
              Specifies the realm of the master server.

       -A admin_server
              Specifies the server to be contacted for incremental updates; by default, the master admin  server
              is contacted.

       -f file
              Specifies  the  filename  where the dumped principal database file is to be stored; by default the
              dumped database file is /etc/krb5kdc/from_master.

       -p     Allows the user to specify the pathname to the kdb5_util(8) program; by default the pathname  used
              is /usr/sbin/kdb5_util.

       -d     Turn  on  debug mode.  In this mode, kpropd will not detach itself from the current job and run in
              the background.  Instead, it will run in the foreground and print out  debugging  messages  during
              the database propagation.

       -t     In  standalone  mode  without  incremental  propagation, exit after one dump file is received.  In
              incremental propagation mode, exit as soon as the database is up to date, or if the master returns
              an error.

       -P     Allow for an alternate port number for kpropd to listen on.  This is only  useful  in  combination
              with the -S option.

       -a acl_file
              Allows  the  user  to  specify  the  path  to  the  kpropd.acl  file;  by default the path used is
              /etc/krb5kdc/kpropd.acl.

       --pid-file=pid_file
              In standalone mode, write the process ID of the daemon into pid_file.

ENVIRONMENT

       kpropd uses the following environment variables:

       • KRB5_CONFIG

       • KRB5_KDC_PROFILE

FILES

       kpropd.acl
              Access file for kpropd; the default location is /usr/local/var/krb5kdc/kpropd.acl.  Each entry  is
              a  line  containing  the  principal  of  a  host  from which the local machine will allow Kerberos
              database propagation via kprop(8).

ENVIRONMENT

       See kerberos(7) for a description of Kerberos environment variables.

SEE ALSO

       kprop(8), kdb5_util(8), krb5kdc(8), kerberos(7), inetd(8)

AUTHOR

       MIT

COPYRIGHT

       1985-2019, MIT

1.17                                                                                                   KPROPD(8)