1 # /etc/krb5.conf -- Kerberos V5 general configuration.
   2 # $Id: krb5.conf,v 1.43 2011/09/23 00:37:20 eagle Exp $
   3 #
   4 # This is the Stanford-wide default Kerberos v5 configuration file.  The
   5 # canonical location of this file is /usr/pubsw/etc/krb5.conf.  To request
   6 # a realm be added to this file, please submit a HelpSU ticket.
   7 #
   8 # This configuration allows any enctypes.  Some systems with really old
   9 # Kerberos software may have to limit to triple-DES and DES.
  10 
  11 [appdefaults]
  12     default_lifetime      = 25hrs
  13     krb4_convert          = false
  14     krb4_convert_524      = false
  15 
  16     ksu = {
  17         forwardable       = false
  18     }
  19 
  20     pam = {
  21         minimum_uid       = 100
  22         forwardable       = true
  23     }
  24 
  25     pam-afs-session = {
  26         minimum_uid       = 100
  27     }
  28 
  29     libkafs = {
  30         IR.STANFORD.EDU = {
  31             afs-use-524   = no
  32         }
  33     }
  34 
  35     passwd_change = {
  36         passwd_file       = /afs/ir.stanford.edu/service/etc/passwd.all
  37         server            = password-change.stanford.edu
  38         port              = 4443
  39         service_principal = service/password-change@stanford.edu
  40     }
  41 
  42     wallet = {
  43         wallet_server     = wallet.stanford.edu
  44     }
  45 
  46 [libdefaults]
  47     default_realm         = stanford.edu
  48     ticket_lifetime       = 25h
  49     renew_lifetime        = 7d
  50     forwardable           = true
  51     noaddresses           = true
  52     allow_weak_crypto     = true
  53 
  54 [realms]
  55     stanford.edu = {
  56         kdc            = krb5auth1.stanford.edu:88
  57         kdc            = krb5auth2.stanford.edu:88
  58         kdc            = krb5auth3.stanford.edu:88
  59         master_kdc     = krb5auth1.stanford.edu:88
  60         admin_server   = krb5-admin.stanford.edu
  61         kpasswd_server = krb5-admin.stanford.edu
  62         default_domain = stanford.edu
  63         kadmind_port   = 749
  64     }
  65     WIN.STANFORD.EDU = {
  66         kdc            = mothra.win.stanford.edu:88
  67         kdc            = rodan.win.stanford.edu:88
  68         kpasswd_server = mothra.win.stanford.edu
  69     }
  70     MS.STANFORD.EDU = {
  71         kdc            = msdc0.ms.stanford.edu:88
  72         kdc            = msdc1.ms.stanford.edu:88
  73         kpasswd_server = msdc0.ms.stanford.edu
  74     }
  75     NT.STANFORD.EDU = {
  76         kdc            = ntdc2.nt.stanford.edu:88
  77         kdc            = ntdc3.nt.stanford.edu:88
  78         kpasswd_server = ntdc2.nt.stanford.edu
  79     }
  80     GUEST.STANFORD.EDU = {
  81         kdc            = guestdc0.guest.stanford.edu:88
  82         kdc            = guestdc1.guest.stanford.edu:88
  83         kpasswd_server = guestdc0.guest.stanford.edu
  84         default_domain = guest.stanford.edu
  85     }
  86     GUESTUAT.STANFORD.EDU = {
  87         kdc            = guestuatdc0.guestuat.stanford.edu:88
  88         kdc            = guestuatdc1.guestuat.stanford.edu:88
  89         kpasswd_server = guestuatdc0.guestuat.stanford.edu
  90         default_domain = guestuat.stanford.edu
  91     }
  92     CS.STANFORD.EDU = {
  93         kdc            = cs-kdc-1.stanford.edu:88
  94         kdc            = cs-kdc-2.stanford.edu:88
  95         kdc            = cs-kdc-3.stanford.edu:88
  96         admin_server   = cs-kdc-1.stanford.edu:749
  97     }
  98     SLAC.STANFORD.EDU = {
  99         kdc            = k5auth1.slac.stanford.edu:88
 100         kdc            = k5auth2.slac.stanford.edu:88
 101         kdc            = k5auth3.slac.stanford.edu:88
 102         admin_server   = k5admin.slac.stanford.edu
 103         kpasswd_server = k5passwd.slac.stanford.edu
 104         default_domain = slac.stanford.edu
 105     }
 106     WIN.SLAC.STANFORD.EDU = {
 107         kdc            = winmaster2.win.slac.stanford.edu
 108         default_domain = win.slac.stanford.edu
 109     }
 110     ATHENA.MIT.EDU = {
 111         kdc            = kerberos.mit.edu:88
 112         kdc            = kerberos-1.mit.edu:88
 113         kdc            = kerberos-2.mit.edu:88
 114         kdc            = kerberos-3.mit.edu:88
 115         admin_server   = kerberos.mit.edu
 116         default_domain = mit.edu
 117     }
 118     ISC.ORG = {
 119         kdc            = k1.isc.org:88
 120         kdc            = k2.isc.org:88
 121         admin_server   = k1.isc.org:749
 122         default_domain = isc.org
 123     }
 124     OPENLDAP.ORG = {
 125         kdc            = kerberos.openldap.org
 126         default_domain = openldap.org
 127     }
 128     SUCHDAMAGE.ORG = {
 129         kdc            = kerberos.suchdamage.org:88
 130         admin_server   = kerberos.suchdamage.org:749
 131         default_domain = suchdamage.org
 132     }
 133     VIX.COM = {
 134         kdc            = kerberos-0.vix.com:88
 135         kdc            = kerberos-1.vix.com:88
 136         kdc            = kerberos-2.vix.com:88
 137         admin_server   = kerberos-0.vix.com:749
 138         default_domain = vix.com
 139     }
 140     ZEPA.NET = {
 141         kdc            = kerberos.zepa.net
 142         kdc            = kerberos-too.zepa.net
 143         admin_server   = kerberos.zepa.net
 144     }
 145 
 146 [domain_realm]
 147     stanford.edu                = stanford.edu
 148     .stanford.edu               = stanford.edu
 149     .dc.stanford.org            = stanford.edu
 150     .sunet                      = stanford.edu
 151     .eyrie.org                  = stanford.edu
 152     .killfile.org               = stanford.edu
 153     .lpch.net                   = stanford.edu
 154     .lpch.org                   = stanford.edu
 155     .oit.duke.edu               = stanford.edu
 156     win.stanford.edu            = WIN.STANFORD.EDU
 157     .win.stanford.edu           = WIN.STANFORD.EDU
 158     daper.stanford.edu          = IT.WIN.STANFORD.EDU
 159     gsbworkspace.stanford.edu   = IT.WIN.STANFORD.EDU
 160     infraappprod.stanford.edu   = IT.WIN.STANFORD.EDU
 161     radmed.stanford.edu         = IT.WIN.STANFORD.EDU
 162     windows-new.stanford.edu    = IT.WIN.STANFORD.EDU
 163     windows.stanford.edu        = IT.WIN.STANFORD.EDU
 164     workspace.stanford.edu      = IT.WIN.STANFORD.EDU
 165     ms.stanford.edu             = MS.STANFORD.EDU
 166     .ms.stanford.edu            = MS.STANFORD.EDU
 167     nt.stanford.edu             = NT.STANFORD.EDU
 168     .nt.stanford.edu            = NT.STANFORD.EDU
 169     guest.stanford.edu          = GUEST.STANFORD.EDU
 170     .guest.stanford.edu         = GUEST.STANFORD.EDU
 171     guest-mgmt.stanford.edu     = GUEST.STANFORD.EDU
 172     guest-mgmt2.stanford.edu    = GUEST.STANFORD.EDU
 173     guestidmweb.stanford.edu    = GUEST.STANFORD.EDU
 174     guestuat.stanford.edu       = GUESTUAT.STANFORD.EDU
 175     .guestuat.stanford.edu      = GUESTUAT.STANFORD.EDU
 176     guestuat-mgmt.stanford.edu  = GUESTUAT.STANFORD.EDU
 177     guestuatidmweb.stanford.edu = GUESTUAT.STANFORD.EDU
 178     .slac.stanford.edu          = SLAC.STANFORD.EDU
 179     .isc.org                    = ISC.ORG
 180     mit.edu                     = ATHENA.MIT.EDU
 181     .mit.edu                    = ATHENA.MIT.EDU
 182     openldap.org                = OPENLDAP.ORG
 183     .openldap.org               = OPENLDAP.ORG
 184     whoi.edu                    = ATHENA.MIT.EDU
 185     .whoi.edu                   = ATHENA.MIT.EDU
 186     .vix.com                    = VIX.COM
 187     zepa.net                    = ZEPA.NET
 188     .zepa.net                   = ZEPA.NET
 189 
 190 [logging]
 191     kdc          = SYSLOG:NOTICE
 192     admin_server = SYSLOG:NOTICE
 193     default      = SYSLOG:NOTICE