8 files changed, 192 insertions, 0 deletions
diff --git a/source/n/krb5/conf/kadmind b/source/n/krb5/conf/kadmind
new file mode 100644
index 000000000..5913ac120
--- /dev/null
+++ b/source/n/krb5/conf/kadmind
@@ -0,0 +1,2 @@
+# To set additional options for kadmind, add them in the variable below:
+KADMIND_OPTIONS=""
diff --git a/source/n/krb5/conf/kdc.conf.example b/source/n/krb5/conf/kdc.conf.example
new file mode 100644
index 000000000..1c7cc3a94
--- /dev/null
+++ b/source/n/krb5/conf/kdc.conf.example
@@ -0,0 +1,35 @@
+[kdcdefaults]
+    kdc_listen = 88
+    kdc_tcp_listen = 88
+
+[realms]
+    ATHENA.MIT.EDU = {
+        kadmind_port = 749
+        max_life = 12h 0m 0s
+        max_renewable_life = 7d 0h 0m 0s
+        master_key_type = aes256-cts-hmac-sha1-96
+        supported_enctypes = aes256-cts-hmac-sha1-96:normal aes128-cts-hmac-sha1-96:normal
+        database_module = openldap_ldapconf
+    }
+
+[logging]
+    kdc = FILE:/var/kerberos/krb5kdc/kdc.log
+    admin_server = FILE:/var/kerberos/krb5kdc/kadmin.log
+
+[dbdefaults]
+    ldap_kerberos_container_dn = cn=krbcontainer,dc=mit,dc=edu
+
+[dbmodules]
+    openldap_ldapconf = {
+        db_library = kldap
+        disable_last_success = true
+        ldap_kdc_dn = "cn=krbadmin,dc=mit,dc=edu"
+            # this object needs to have read rights on
+            # the realm container and principal subtrees
+        ldap_kadmind_dn = "cn=krbadmin,dc=mit,dc=edu"
+            # this object needs to have read and write rights on
+            # the realm container and principal subtrees
+        ldap_service_password_file = /etc/kerberos/service.keyfile
+        ldap_servers = ldaps://kerberos.mit.edu
+        ldap_conns_per_server = 5
+    }
diff --git a/source/n/krb5/conf/kpropd b/source/n/krb5/conf/kpropd
new file mode 100644
index 000000000..cc65d10b4
--- /dev/null
+++ b/source/n/krb5/conf/kpropd
@@ -0,0 +1,2 @@
+# To set additional options for kpropd, add them in the variable below:
+KPROPD_OPTIONS=""
diff --git a/source/n/krb5/conf/krb5.conf.example b/source/n/krb5/conf/krb5.conf.example
new file mode 100644
index 000000000..705e7cf30
--- /dev/null
+++ b/source/n/krb5/conf/krb5.conf.example
@@ -0,0 +1,29 @@
+[libdefaults]
+    default_realm = ATHENA.MIT.EDU
+    dns_lookup_kdc = true
+    dns_lookup_realm = false
+
+[realms]
+    ATHENA.MIT.EDU = {
+        kdc = kerberos.mit.edu
+        kdc = kerberos-1.mit.edu
+        kdc = kerberos-2.mit.edu
+        admin_server = kerberos.mit.edu
+        master_kdc = kerberos.mit.edu
+    }
+    EXAMPLE.COM = {
+        kdc = kerberos.example.com
+        kdc = kerberos-1.example.com
+        admin_server = kerberos.example.com
+    }
+
+[domain_realm]
+    mit.edu = ATHENA.MIT.EDU
+
+[capaths]
+    ATHENA.MIT.EDU = {
+           EXAMPLE.COM = .
+    }
+    EXAMPLE.COM = {
+           ATHENA.MIT.EDU = .
+    }
diff --git a/source/n/krb5/conf/krb5kdc b/source/n/krb5/conf/krb5kdc
new file mode 100644
index 000000000..6679d1b80
--- /dev/null
+++ b/source/n/krb5/conf/krb5kdc
@@ -0,0 +1,2 @@
+# To set additional options for krb5kdc, add them in the variable below:
+KRB5KDC_OPTIONS=""
diff --git a/source/n/krb5/conf/rc.kadmind b/source/n/krb5/conf/rc.kadmind
new file mode 100644
index 000000000..2f838a7c4
--- /dev/null
+++ b/source/n/krb5/conf/rc.kadmind
@@ -0,0 +1,40 @@
+#!/bin/sh
+# Start the Kerberos administration server. This typically runs on the
+# master Kerberos server, which stores the KDC database.
+
+# To change the default options, edit /etc/default/kadmind.
+if [ -r /etc/default/kadmind ]; then
+  . /etc/default/kadmind
+fi
+
+start_atd() {
+  if ! /usr/bin/pgrep --ns $$ --euid root -f "^/usr/sbin/kadmind" 1> /dev/null 2> /dev/null ; then
+    echo "Starting kadmind:  /usr/sbin/kadmind $KADMIND_OPTIONS"
+    /usr/sbin/kadmind $KADMIND_OPTIONS
+  fi
+}
+
+stop_atd() {
+  echo "Stopping kadmind."
+  /usr/bin/pkill --ns $$ --euid root -f "^/usr/sbin/kadmind" 2> /dev/null
+}
+
+restart_atd() {
+  stop_atd
+  sleep 1
+  start_atd
+}
+
+case "$1" in
+'start')
+  start_atd
+  ;;
+'stop')
+  stop_atd
+  ;;
+'restart')
+  restart_atd
+  ;;
+*)
+  echo "usage $0 start|stop|restart"
+esac
diff --git a/source/n/krb5/conf/rc.kpropd b/source/n/krb5/conf/rc.kpropd
new file mode 100644
index 000000000..8dde85d87
--- /dev/null
+++ b/source/n/krb5/conf/rc.kpropd
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Start the Kerberos V5 slave KDC update server. This runs on a slave
+# (secondary) KDC server. It allows the master Kerberos server to use
+# kprop(8) to propagate its database to the slave servers.
+
+# To change the default options, edit /etc/default/kpropd.
+if [ -r /etc/default/kpropd ]; then
+  . /etc/default/kpropd
+fi
+
+start_atd() {
+  if ! /usr/bin/pgrep --ns $$ --euid root -f "^/usr/sbin/kpropd" 1> /dev/null 2> /dev/null ; then
+    echo "Starting kpropd:  /usr/sbin/kpropd $KPROPD_OPTIONS"
+    /usr/sbin/kpropd $KPROPD_OPTIONS
+  fi
+}
+
+stop_atd() {
+  echo "Stopping kpropd."
+  /usr/bin/pkill --ns $$ --euid root -f "^/usr/sbin/kpropd" 2> /dev/null
+}
+
+restart_atd() {
+  stop_atd
+  sleep 1
+  start_atd
+}
+
+case "$1" in
+'start')
+  start_atd
+  ;;
+'stop')
+  stop_atd
+  ;;
+'restart')
+  restart_atd
+  ;;
+*)
+  echo "usage $0 start|stop|restart"
+esac
diff --git a/source/n/krb5/conf/rc.krb5kdc b/source/n/krb5/conf/rc.krb5kdc
new file mode 100644
index 000000000..5e9baef1a
--- /dev/null
+++ b/source/n/krb5/conf/rc.krb5kdc
@@ -0,0 +1,41 @@
+#!/bin/sh
+# Start krb5kdc, which is the Kerberos version 5 Authentication Service
+# and Key Distribution Center (AS/KDC). This needs to run first on both
+# master and secondary KDCs.
+
+# To change the default options, edit /etc/default/krb5kdc.
+if [ -r /etc/default/krb5kdc ]; then
+  . /etc/default/krb5kdc
+fi
+
+start_atd() {
+  if ! /usr/bin/pgrep --ns $$ --euid root -f "^/usr/sbin/krb5kdc" 1> /dev/null 2> /dev/null ; then
+    echo "Starting krb5kdc:  /usr/sbin/krb5kdc $KRB5KDC_OPTIONS"
+    /usr/sbin/krb5kdc $KRB5KDC_OPTIONS
+  fi
+}
+
+stop_atd() {
+  echo "Stopping krb5kdc."
+  /usr/bin/pkill --ns $$ --euid root -f "^/usr/sbin/krb5kdc" 2> /dev/null
+}
+
+restart_atd() {
+  stop_atd
+  sleep 1
+  start_atd
+}
+
+case "$1" in
+'start')
+  start_atd
+  ;;
+'stop')
+  stop_atd
+  ;;
+'restart')
+  restart_atd
+  ;;
+*)
+  echo "usage $0 start|stop|restart"
+esac