kprop(8)

NAME
kprop - network utility for Kerberos database propagation

SYNOPSIS
kadmin database slaves_file [-force] [-safe] [-clear] [-realm realm]

DESCRIPTION
The kprop daemon runs on a Kerberos master and propagates the Kerberos database to the Kerberos slaves, where it is received by the waiting kpropd daemon.

The first parameter, database, is the name of the file out of which data is extracted. This file is not the db-formatted Kerberos database, /etc/kerberosIV/principal.db. See the db(3) reference page for more information. The database is a file created by the
    kdb_util slave dump
command. It is an ASCII representation of the Kerberos database.

The second parameter that must be supplied is slaves_file, the name of the file on the Kerberos master that lists the Kerberos slaves to which kprop propagates the Kerberos master database. The slaves file contains one line for each host running a secondary server consisting on just the hostname of the machine.

The Kerberos utility first determines whether the ASCII Kerberos database, database, was correctly dumped by kdb_util(8). It accomplishes this by determining if database is older than the database.dump.ok file created by kdb_util(8) during the slave dump operation. If it is older, the dump did not succeed or is not yet finished. If the dump did not complete successfully or has not yet completed, the master database is not transferred to any Kerberos slave.

Otherwise, kprop determines, for each slave server listed in the slaves file, whether or not the database has changed since the last successful transfer to the slave. It determines this for slave server cactus by comparing the modification time of the cactus-last-prop file, which is stored in the same directory as the slaves file, with the modification time of database. If the /etc/cactus-last-prop file is newer, then the database, need not be transferred to cactus.

Finally, kprop propagates the database to those servers which need a new copy of the database and updates the modification time of the /etc/server-last-prop file for these slave servers.

If the [-safe] option is specified, the data sent over the network is guaranteed to be authenticated at the destination and protected against modifications in transit. That is, kprop and kpropd(8), which are Kerberos principals, become Kerberos-authenticated to each other and send messages formatted by krb_mk_safe.

If the [-clear] option is specified, all of the data will be sent in cleartext (unencrypted). This switch is useful when first setting up the Kerberos environment.

If the [-realm] option is specified, its argument is used as the current realm name rather than the default specified in krb.conf(5) file.

If the [-force] option is specified, kprop is forced to propagate the Kerberos database to the slaves, even if there are no recent changes to the database. Without the force flag, the Kerberos database is not propagated if the database file has not changed since the last successful transfer.

BUGS
This utility does not support the transfer of encrypted data.

The [-clear] and [-safe] options are not implemented.

SEE ALSO
kerberos(1), kpropd(8)
``A Subsystem Utilities Package for UNIX'' by Ken Raeburn