MIT Kerberos: Basic Configuration

Updated: Sep 23, 2026

 
pkg install krb5


rm -Rf /usr/local/var/krb5kdc
ln -s /var/db/krb5kdc /usr/local/var/krb5kdc

cp /usr/local/share/examples/krb5/krb5.conf /usr/local/etc/
ln -s /usr/local/etc/krb5.conf  /etc/krb5.conf


ln -s /var/db/krb5kdc/kdc.conf /usr/local/etc/kdc.conf
ln -s /var/db/krb5kdc/kdc.conf /etc/kdc.conf





kerberos.example.net.	900	CNAME	server1.example.net.
kerberos1.example.net.	900	CNAME	server1.example.net.
_kerberos.example.net.	900	TXT	"EXAMPLE.NET"
_kerberos._tcp.example.net. 900	SRV	10 10 88 server1.example.net.
_kerberos._udp.example.net. 900	SRV	10 10 88 server1.example.net.
_kpasswd._udp.example.net. 900	SRV	10 10 464 server1.example.net.
_kerberos-master._udp.example.net. 900 SRV 10 10 88 server1.example.net.
_kerberos-adm._tcp.example.net.	900 SRV	10 10 749 server1.example.net.

vim /etc/krb5.conf
vim /etc/kdc.conf

 

 
[libdefaults]
	default_realm = EXAMPLE.NET
	default_keytab_name = /etc/krb5.keytab
	default_tgs_enctypes = aes256-cts-hmac-sha1-96
	default_tkt_enctypes = aes256-cts-hmac-sha1-96
	forwardable = true
	dns_lookup_realm = true
	dns_lookup_kdc = true
	ticket_lifetime = 24h
	renew_lifetime = 7d
	preferred_enctypes = aes256-cts:normal aes128-cts:normal


[realms]
	EXAMPLE.NET = {
		kdc = kerberos1.example.net
		admin_server = kerberos.example.net
	}


[domain_realm]
	example.net = EXAMPLE.NET
	.example.net = EXAMPLE.NET

[kadmin]
	default_keys = aes256-cts:normal aes128-cts:normal

[logging]
	default = FILE:/var/log/krb5libs.log
	kdc = FILE:/var/log/krb5kdc.log
	admin_server = FILE:/var/log/kadmin.log
 

 
[kdcdefaults]
        kdc_listen = 88
        kdc_tcp_listen = 88

[realms]
        EXAMPLE.NET = {
                database_name = /var/db/krb5kdc/principal
                acl_file = /var/db/krb5kdc/kadm5.acl
                key_stash_file = /var/db/krb5kdc/.k5.EXAMPLE.NET
                kadmind_port = 749
                kdc_listen = 88
                kdc_tcp_listen = 88
                max_life = 10h 0m 0s
                max_renewable_life = 7d 0h 0m 0s
                master_key_type = aes256-cts
                supported_enctypes = aes256-cts:normal aes128-cts:normal
        }

[logging]
        kdc = FILE:/var/log/krb5kdc.log
        admin_server = FILE:/var/log/kadmin.log
        default = FILE:/var/log/krb5lib.log
 

 
kdb5_util create -r EXAMPLE.NET -s

ls /var/db/krb5kdc/

vim /var/db/krb5kdc/kadm5.acl

*/admin@EXAMPLE.NET        *

kadmin.local

?
list_principals
add_policy -minlength 15 -minclasses 3 default

add_principal admin/admin@EXAMPLE.NET
add_principal +requires_preauth misiminger@EXAMPLE.NET
add_principal -randkey host/server1.example.net@EXAMPLE.NET
add_principal -randkey host/server2.example.net@EXAMPLE.NET
add_principal -randkey DNS/server1.example.net@EXAMPLE.NET
ktadd -k /etc/krb5.keytab host/server1.example.net@EXAMPLE.NET
ktadd -k /etc/dns.keytab DNS/server1.example.net@EXAMPLE.NET
ktadd -k /root/server2.example.net.keytab host/server2.example.net@EXAMPLE.NET
quit


vim /etc/rc.conf
kdc_enable="YES"
kadmind_enable="YES"

service kdc start
service kadmind start

kinit misiminger@EXAMPLE.NET
klist