MIT Kerberos: Configuring Kerberos with LDAP

Updated: Sep 23, 2026

 
# If already using local krb5 db and you want to migrate LDAP
kdb5_util dump kdb5_backup.txt

pkg install krb5-ldap

cp /usr/local/sbin/krb5kdc /usr/libexec/
cp /usr/local/sbin/kadmind  /usr/libexec/

rm -Rf /usr/local/var/krb5kdc
ln -s /var/db/krb5kdc /usr/local/var/krb5kdc

cp /usr/local/share/examples/krb5/krb5.conf /usr/local/etc/
ln -s /usr/local/etc/krb5.conf  /etc/krb5.conf


ln -s /var/db/krb5kdc/kdc.conf /usr/local/etc/kdc.conf
ln -s /var/db/krb5kdc/kdc.conf /etc/kdc.conf





kerberos.example.net.	900	CNAME	server1.example.net.
kerberos1.example.net.	900	CNAME	server1.example.net.
_kerberos.example.net.	900	TXT	"EXAMPLE.NET"
_kerberos._tcp.example.net. 900	SRV	10 10 88 server1.example.net.
_kerberos._udp.example.net. 900	SRV	10 10 88 server1.example.net.
_kpasswd._udp.example.net. 900	SRV	10 10 464 server1.example.net.
_kerberos-master._udp.example.net. 900 SRV 10 10 88 server1.example.net.
_kerberos-adm._tcp.example.net.	900 SRV	10 10 749 server1.example.net.

vim /etc/krb5.conf
vim /etc/kdc.conf
 

 
[libdefaults]
	default_realm = EXAMPLE.NET
	default_keytab_name = /etc/krb5.keytab
	default_tgs_enctypes = aes256-cts-hmac-sha1-96
	default_tkt_enctypes = aes256-cts-hmac-sha1-96
	forwardable = true
	dns_lookup_realm = true
	dns_lookup_kdc = true
	ticket_lifetime = 24h
	renew_lifetime = 7d
	preferred_enctypes = aes256-cts:normal aes128-cts:normal


[realms]
	EXAMPLE.NET = {
		kdc = kerberos1.example.net
		admin_server = kerberos.example.net
	}


[domain_realm]
	example.net = EXAMPLE.NET
	.example.net = EXAMPLE.NET

[kadmin]
	default_keys = aes256-cts:normal aes128-cts:normal

[logging]
	default = FILE:/var/log/krb5libs.log
	kdc = FILE:/var/log/krb5kdc.log
	admin_server = FILE:/var/log/kadmin.log
 

 
[kdcdefaults]
    kdc_ports = 88,750
    kdc_tcp_ports = 88

[realms]
    EXAMPLE.NET = {
        database_module = openldap_ldapconf
        kadmind_port = 749
        kpasswd_port = 464
        max_life = 12h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
	default_principal_flags = +preauth
        master_key_type = aes256-cts
        key_stash_file = /var/db/krb5kdc/.k5.EXAMPLE.NET
        acl_file = /var/db/krb5kdc/kadm5.acl
        admin_keytab = /var/db/krb5kdc/kadm5.keytab
        supported_enctypes = aes256-cts:normal aes128-cts:normal
        dict_file = /usr/share/dict/words
    }

[dbdefaults]
    ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,ou=Services,dc=example,dc=net

[dbmodules]

    db_module_dir = /usr/local/lib/krb5/plugins/kdb

    openldap_ldapconf = {
        db_library = kldap

        ldap_servers = ldap://ldap1.example.net ldap://ldap2.example.net

        ldap_kdc_dn = cn=krbtgt,ou=kerberos,ou=Services,dc=example,dc=net
        ldap_kadmind_dn = cn=kadmin,ou=kerberos,ou=Services,dc=example,dc=net
        ldap_service_password_file = /var/db/krb5kdc/service.keyfile

        ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,ou=Services,dc=example,dc=net

        ldap_conns_per_server = 5
    }

[logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log
 

 
[kdcdefaults]
    kdc_ports = 88,750
    kdc_tcp_ports = 88

[realms]
    EXAMPLE.NET = {
        database_module = openldap_ldapconf
        kadmind_port = 749
        kpasswd_port = 464
        max_life = 12h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
	default_principal_flags = +preauth
        master_key_type = aes256-cts
        key_stash_file = /var/db/krb5kdc/.k5.EXAMPLE.NET
        acl_file = /var/db/krb5kdc/kadm5.acl
        admin_keytab = /var/db/krb5kdc/kadm5.keytab
        supported_enctypes = aes256-cts:normal aes128-cts:normal
        dict_file = /usr/share/dict/words
    }

[dbdefaults]
    ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,ou=Services,dc=example,dc=net

[dbmodules]

    db_module_dir = /usr/local/lib/krb5/plugins/kdb

    openldap_ldapconf = {
        db_library = kldap

        ldap_servers = ldapi:///

        ldap_kerberos_container_dn = cn=krbContainer,ou=kerberos,ou=Services,dc=example,dc=net

        ldap_conns_per_server = 5

        ldap_kdc_sasl_mech = EXTERNAL
        ldap_kadmind_sasl_mech = EXTERNAL

    }

[logging]
    kdc = FILE:/var/log/krb5kdc.log
    admin_server = FILE:/var/log/kadmin.log
    default = FILE:/var/log/krb5lib.log
 

 
# Simple
kdb5_ldap_util stashsrvpw -f /var/db/krb5kdc/service.keyfile cn=kadmin,ou=kerberos,ou=Services,dc=example,dc=net
kdb5_ldap_util stashsrvpw -f /var/db/krb5kdc/service.keyfile cn=krbtgt,ou=kerberos,ou=Services,dc=example,dc=net


kdb5_ldap_util create -subtrees dc=example,dc=net -r EXAMPLE.NET -s

kdb5_util load -update kdb5_backup.txt

# kdb5_ldap_util -D cn=Manager,dc=example,dc=net -W -H ldapi:/// create -subtrees dc=example,dc=net -r EXAMPLE.NET -s
service kdc start
cat /var/log/krb5kdc.log
service kadmind start
cat /var/log/kadmin.log
kadmin.local
add_policy -minlength 15 -minclasses 3 default
cpw misiminger@EXAMPLE.NET
cpw -randkey host/server1.example.net@EXAMPLE.NET
cpw -randkey host/server2.example.net@EXAMPLE.NET
add_principal -randkey DNS/server1.example.net@EXAMPLE.NET
add_principal -randkey DNS/server2.example.net@EXAMPLE.NET
add_principal -randkey ldap/server1.example.net@EXAMPLE.NET
add_principal -randkey ldap/server2.example.net@EXAMPLE.NET
ktadd -k /etc/krb5.keytab host/server1.example.net@EXAMPLE.NET
ktadd -k /etc/dns.keytab DNS/server1.example.net@EXAMPLE.NET
ktadd -k /etc/dns.keytab DNS/server2.example.net@EXAMPLE.NET
ktadd -k /root/server2.example.net.keytab host/server2.example.net@EXAMPLE.NET
ktadd -k /etc/ldap.keytab ldap/server1.example.net@EXAMPLE.NET
ktadd -k /etc/ldap.keytab ldap/server2.example.net@EXAMPLE.NET
quit

kinit misiminger
klist