Deleting Policies
-----------------

To delete a policy, use the `kadmin' `delete_policy' command, which
requires the "delete" administrative privilege.  The syntax is:

     delete_policy [-force] policy_name

The `delete_policy' command has the alias `delpol'.  It prompts for
confirmation before deletion.  For example:

     kadmin: delete_policy guests
     Are you sure you want to delete the policy "guests"?
     (yes/no): yes
     kadmin:

Note that you must cancel the policy from all principals before deleting
it.  The `delete_policy' command will fail if it is in use by any
principals.

Global Operations on the Kerberos Database
==========================================

The `kdb5_util' command is the primary tool for administrating the
Kerberos database.  The syntax is:

     kdb5_util command [kdb5_util_options] [command_options]

The `kdb5_util' command takes the following options, which override the
defaults specified in the configuration files:

-r realm
     specifies the the Kerberos realm of the database.

-d database_name
     specifies the name under which the principal database is stored.

-k master_key_type
     specifies the key type of the master key in the database.

-M master_key_name
     specifies the principal name of the master key in the database.

-m
     indicates that the master database password should be read from
     the TTY rather than fetched from a file on disk.

-sf stash_file
     specifies the stash file of the master database password

-P password
     specifies the master database password.  MIT does not recommend
     using this option.

Dumping a Kerberos Database to a File
-------------------------------------

To dump a Kerberos database into a file, use the `kdb5_util' `dump'
command on one of the KDCs.  The syntax is:

     kdb5_util dump [-old] [-b6] [-b7] [-ov]
     [-verbose] [-mkey_convert] [-new_mkey_file] [filename
     [principals...]]

The `kdb5_util dump' command takes the following options:

-old
     causes the dump to be in the Kerberos 5 Beta 5 and earlier dump
     format ("kdb5_edit load_dump version 2.0").

-b6
     causes the dump to be in the Kerberos 5 Beta 6 format ("kdb5_edit
     load_dump version 3.0").

-b7
     causes the dump to be in the Kerberos 5 Beta 7 format ("kdbt_edit
     load_dump version 4").

-ov
     causes the dump to be in ovsec_adm_export format.  Currently, the
     only way to preserve per-principal policy information is to use
     this in conjunction with a normal dump.

-verbose
     causes the name of each principal and policy to be printed as it is
     dumped.

-mkey_convert
     prompts for a new master password, and then dumps the database with
     all keys reencrypted in this new master key

-new_mkey_file
     reads a new key from the default keytab and then dumps the database
     with all keys reencrypted in this new master key

For example:

     shell% kdb5_util dump dumpfile
     shell%

     shell% kbd5_util dump -verbose dumpfile
     kadmin/admin@ATHENA.MIT.EDU
     krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
     kadmin/history@ATHENA.MIT.EDU
     K/M@ATHENA.MIT.EDU
     kadmin/changepw@ATHENA.MIT.EDU
     shell%

If you specify which principals to dump, you must use the full
principal, as in the following example.  (The line beginning with => is
a continuation of the previous line.):

     shell% kdb5_util dump -verbose dumpfile K/M@ATHENA.MIT.EDU
     => kadmin/admin@ATHENA.MIT.EDU
     kadmin/admin@ATHENA.MIT.EDU
     K/M@ATHENA.MIT.EDU
     shell%

Otherwise, the principals will not match those in the database and will
not be dumped:

     shell% kdb5_util dump -verbose dumpfile K/M kadmin/admin
     shell%

If you do not specify a dump file, `kdb5_util' will dump the database
to the standard output.

There is currently a bug where the default dump format omits the
per-principal policy information.  In order to dump all the data
contained in the Kerberos database, you must perform a normal dump (with
no option flags) and an additional dump using the "-ov" flag to a
different file.

Restoring a Kerberos Database from a Dump File
----------------------------------------------

To restore a Kerberos database dump from a file, use the `kdb5_util'
`load' command on one of the KDCs.  The syntax is:

     kdb5_util load [-old] [-b6] [-b7] [-ov] [-verbose]
     [-update] [-hash] dumpfilename dbname [admin_dbname]

The `kdb5_util load' command takes the following options:

-old
     requires the dump to be in the Kerberos 5 Beta 5 and earlier dump
     format ("kdb5_edit load_dump version 2.0").

-b6
     requires the dump to be in the Kerberos 5 Beta 6 format ("kdb5_edit
     load_dump version 3.0").

-b7
     requires the dump to be in the Kerberos 5 Beta 7 format ("kdb5_edit
     load_dump version 4").

-ov
     requires the dump to be in ovsec_adm_export format.

-verbose
     causes the name of each principal and policy to be printed as it is
     loaded.

-update
     causes records from the dump file to be updated in or added to the
     existing database.  This is useful in conjunction with an
     ovsec_adm_export format dump if you want to preserve per-principal
     policy information, since the current default format does not
     contain this data.

-hash
     causes the database to be stored as a hash rather than a binary
     tree.

For example:

     shell% kdb5_util load dumpfile principal
     shell%

     shell% kdb5_util load -update dumpfile principal
     shell%

If the database file exists, and the -update flag was not given,
`kdb5_util' will overwrite the existing database.

Creating a Stash File
---------------------

A stash file allows a KDC to authenticate itself to the database
utilities, such as `kadmin', `kadmind', `krb5kdc', and `kdb5_util'.

To create a stash file, use the `kdb5_util' `stash' command.  The
syntax is:

     kdb5_util stash [-f keyfile]

For example:

     shell% kdb5_util stash
     kdb5_util: Cannot find/read stored master key while reading master key
     kdb5_util: Warning: proceeding without master key
     Enter KDC database master key:  <= Type the KDC database master password.
     shell%

If you do not specify a stash file, `kdb5_util' will stash the key in
the file specified in your `kdc.conf' file.

Creating and Destroying a Kerberos Database
-------------------------------------------

If you need to create a new Kerberos database, use the `kdb5_util'
`create' command.  The syntax is:

     kdb5_util create [-s]

If you specify the `-s' option, `kdb5_util' will stash a copy of the
master key in a stash file.  (see Creating a Stash File.)  For
example:

     shell% /usr/local/sbin/kdb5_util -r ATHENA.MIT.EDU create -s
     kdb5_util: No such file or directory while setting active database to
     => '/usr/local/var/krb5kdc/principal'
     Initializing database '/usr/local/var/krb5kdc/principal' for
     => realm 'ATHENA.MIT.EDU',
     master key name 'K/M@ATHENA.MIT.EDU'
     You will be prompted for the database Master Password.
     It is important that you NOT FORGET this password.
     Enter KDC database master key:  <= Type the master password.
     Re-enter KDC database master key to verify:  <= Type it again.
     shell%

If you need to destroy the current Kerberos database, use the
`kdb5_util' `destroy' command.  The syntax is:

     kdb5_util destroy [-f]

The `destroy' command destroys the database, first overwriting the disk
sectors and then unlinking the files.  If you specify the `-f' option,
`kdb5_util' will not prompt you for a confirmation before destroying
the database.

     shell% /usr/local/sbin/kdb5_util -r ATHENA.MIT.EDU destroy
     kdb5_util: Deleting KDC database stored in /usr/local/var/krb5kdc/principal, are you sure
     (type yes to confirm)? <== yes
     OK, deleting database '/usr/local/var/krb5kdc/principal'...

     shell%

Cross-realm Authentication
==========================

In order for a KDC in one realm to authenticate Kerberos users in a
different realm, it must share a key with the KDC in the other realm.
In both databases, there must be krbtgt service principals for realms.
These principals should all have the same passwords, key version
numbers, and encryption types.  For example, if the administrators of
ATHENA.MIT.EDU and EXAMPLE.COM wanted to authenticate across the
realms, they would run the following commands on the KDCs in both
realms:

     shell%: kadmin.local -e "des3-hmac-sha1:normal des-cbc-crc:v4"
     kadmin: add_princ -requires_preauth krbtgt/ATHENA.MIT.EDU@EXAMPLE.COM
     Enter password for principal krbtgt/ATHENA.MIT.EDU@EXAMPLE.COM:
     Re-enter password for principal krbtgt/ATHENA.MIT.EDU@EXAMPLE.COM:
     kadmin: add_princ -requires_preauth krbtgt/EXAMPLE.COM@ATHENA.MIT.EDU
     Enter password for principal krbtgt/EXAMPLE.COM@ATHENA.MIT.EDU:
     Enter password for principal krbtgt/EXAMPLE.COM@{No value for `PRIMARYREALML'}:
     kadmin:

Even if most principals in a realm are generally created with the
requires_preauth flag enabled, this flag is not desirable on
cross-realm authentication keys because doing so makes it impossible to
disable preauthentication on a service-by-service basis.  Disabling it
as in the example above is recommended.

It is also very important that these principals have good passwords.
MIT recommends that TGT principal passwords be at least 26 characters
of random ASCII text.

Application Servers
*******************

If you need to install the Kerberos V5 programs on an application
server, please refer to the Kerberos V5 Installation Guide.  Once you
have installed the software, you need to add that host to the Kerberos
database (see Adding or Modifying Principals), and generate a
"keytab" for that host, that contains the host's key.  You also need to
make sure the host's clock is within your maximum clock skew of the
KDCs.

Keytabs
=======

A "keytab" is a host's copy of its own keylist, which is analogous to a
user's password.  An application server that needs to authenticate
itself to the KDC has to have a keytab that contains its own principal
and key.  Just as it is important for users to protect their passwords,
it is equally important for hosts to protect their keytabs.  You should
always store keytab files on local disk, and make them readable only by
root, and you should never send a keytab file over a network in the
clear.  Ideally, you should run the `kadmin' command to extract a
keytab on the host on which the keytab is to reside.

Adding Principals to Keytabs
----------------------------

To generate a keytab, or to add a principal to an existing keytab, use
the `ktadd' command from `kadmin', which requires the "inquire"
administrative privilege.  (If you use the -glob princ_exp option, it
also requires the "list" administrative privilege.)  The syntax is:

     ktadd [-k[eytab] keytab] [-q] [-e
     key:salt_list] [principal | -glob princ_exp]
     [...]

The `ktadd' command takes the following switches:

-k[eytab] keytab
     use keytab as the keytab file.  Otherwise, `ktadd' will use the
     default keytab file (`/etc/krb5.keytab').

-e "enc:salt..."
     Uses the specified list of enctype-salttype pairs for setting the
     key of the principal.  The quotes are necessary if there are
     multiple enctype-salttype pairs.  This will not function against
     kadmin daemons earlier than krb5-1.2.  See Supported Encryption Types
     and Salts for all possible values.

-q
     run in quiet mode.  This causes `ktadd' to display less verbose
     information.

principal | -glob principal expression
     add principal, or all principals matching principal expression to
     the keytab.  The rules for principal expression are the same as
     for the kadmin `list_principals' (see Retrieving a List of Principals)
     command.

Here is a sample session, using configuration files that enable only
`des-cbc-crc' encryption. (The line beginning with => is a continuation
of the previous line.)

     kadmin: ktadd host/daffodil.mit.edu@ATHENA.MIT.EDU
     kadmin: Entry for principal host/daffodil.mit.edu@ATHENA.MIT.EDU with
          kvno 2, encryption type DES-CBC-CRC added to keytab
          WRFILE:/etc/krb5.keytab.
     kadmin:

     kadmin: ktadd -k /usr/local/var/krb5kdc/kadmind.keytab
     => kadmin/admin kadmin/changepw
     kadmin: Entry for principal kadmin/admin@ATHENA.MIT.EDU with
          kvno 3, encryption type DES-CBC-CRC added to keytab
          WRFILE:/usr/local/var/krb5kdc/kadmind.keytab.
     kadmin:

Removing Principals from Keytabs
--------------------------------

To remove a principal from an existing keytab, use the kadmin
`ktremove' command.  The syntax is:

     ktremove [-k[eytab] keytab] [-q] principal [kvno | all | old]

The `ktremove' command takes the following switches:

-k[eytab] keytab
     use keytab as the keytab file.  Otherwise, `ktremove' will use the
     default keytab file (`/etc/krb5.keytab').

-q
     run in quiet mode.  This causes `ktremove' to display less verbose
     information.

principal
     the principal to remove from the keytab.  (Required.)

kvno
     remove all entries for the specified principal whose Key Version
     Numbers match kvno.

all
     remove all entries for the specified principal

old
     remove all entries for the specified principal except those with
     the highest kvno.

For example:

     kadmin: ktremove -k /usr/local/var/krb5kdc/kadmind.keytab kadmin/admin
     kadmin: Entry for principal kadmin/admin with kvno 3 removed
          from keytab WRFILE:/usr/local/var/krb5kdc/kadmind.keytab.
     kadmin:

Clock Skew
==========

In order to prevent intruders from resetting their system clocks in
order to continue to use expired tickets, Kerberos V5 is set up to
reject ticket requests from any host whose clock is not within the
specified maximum clock skew of the KDC (as specified in the `kdc.conf'
file).  Similarly, hosts are configured to reject responses from any
KDC whose clock is not within the specified maximum clock skew of the
host (as specified in the `krb5.conf' file).  The default value for
maximum clock skew is 300 seconds, or five minutes.

MIT suggests that you add a line to client machines' `/etc/rc' files to
synchronize the machine's clock to your KDC at boot time.  On UNIX
hosts, assuming you had a kdc called `kerberos' in your realm, this
would be:

     gettime -s kerberos

If the host is not likely to be rebooted frequently, you may also want
to set up a cron job that adjusts the time on a regular basis.

Getting DNS Information Correct
===============================

Several aspects of Kerberos rely on name service.  In order for Kerberos
to provide its high level of security, it is less forgiving of name
service problems than some other parts of your network.  It is important
that your Domain Name System (DNS) entries and your hosts have the
correct information.

Each host's canonical name must be the fully-qualified host name
(including the domain), and each host's IP address must reverse-resolve
to the canonical name.

Other than the `localhost' entry, make all entries in each machine's
`/etc/hosts' file in the following form:

     IP address      fully-qualified hostname        aliases

Here is a sample `/etc/hosts' file:

     # this is a comment
     127.0.0.1       localhost localhost@mit.edu
     10.0.0.6       daffodil.mit.edu trillium wake-robin

Additionally, on Solaris machines, you need to be sure the "hosts"
entry in the file
`/etc/nsswitch.conf' includes the source "dns" as well as "file".

Finally, each host's keytab file must include a host/key pair for the
host's canonical name.  You can list the keys in a keytab file by
issuing the command `klist -k'.  For example:

     viola# klist -k
     Keytab name: /etc/krb5.keytab
     KVNO Principal
     ---- ------------------------------------------------------------
        1 host/daffodil.mit.edu@ATHENA.MIT.EDU

If you telnet to the host with a fresh credentials cache (ticket file),
and then `klist', the host's service principal should be
host/fully-qualified-hostname@REALM_NAME.

Configuring Your Firewall to Work With Kerberos V5
==================================================

If you need off-site users to be able to get Kerberos tickets in your
realm, they must be able to get to your KDC.  This requires either that
you have a slave KDC outside your firewall, or you configure your
firewall to allow UDP requests into at least one of your KDCs, on
whichever port the KDC is running.  (The default is port 88; other
ports may be specified in the KDC's kdc.conf file.)  Similarly, if you
need off-site users to be able to change their passwords in your realm,
they must be able to get to your Kerberos admin server.  The default
port for the admin server is 749.

If your on-site users inside your firewall will need to get to KDCs in
other realms, you will also need to configure your firewall to allow
outgoing TCP and UDP requests to port 88.  Additionally, if they will
need to get to any Kerberos V4 KDCs, you may also need to allow TCP and
UDP requests to port 750.  If your on-site users inside your firewall
will need to get to Kerberos admin servers in other realms, you will
also need to allow outgoing TCP and UDP requests to port
749.

If any of your KDCs are outside your firewall, you will need to allow
`kprop' requests to get through to the remote KDC.  `Kprop' uses the
krb5_prop service on port 754 (tcp).

If you need your off-site users to have access to machines inside your
firewall, you need to allow TCP connections from their off-site hosts on
the appropriate ports for the programs they will be using.  The
following lines from `/etc/services' show the default port numbers for
the Kerberos V5 programs:

     ftp           21/tcp           # Kerberos ftp and telnet use the
     telnet        23/tcp           # default ports
     kerberos      88/udp    kdc    # Kerberos V5 KDC
     kerberos      88/tcp    kdc    # Kerberos V5 KDC
     klogin        543/tcp          # Kerberos authenticated rlogin
     kshell        544/tcp   cmd    # and remote shell
     kerberos-adm  749/tcp          # Kerberos 5 admin/changepw
     kerberos-adm  749/udp          # Kerberos 5 admin/changepw
     krb5_prop     754/tcp          # Kerberos slave propagation
     eklogin       2105/tcp         # Kerberos auth. & encrypted rlogin
     krb524        4444/tcp         # Kerberos 5 to 4 ticket translator

By default, Kerberos V5 `telnet' and `ftp' use the same ports as the
standard `telnet' and `ftp' programs, so if you already allow telnet
and ftp connections through your firewall, the Kerberos V5 versions
will get through as well.  If you do not already allow telnet and ftp
connections through your firewall, but need your users to be able to
use Kerberos V5 telnet and ftp, you can either allow ftp and telnet
connections on the standard ports, or switch these programs to
non-default port numbers and allow ftp and telnet connections on those
ports to get through.

Kerberos V5 `rlogin' uses the `klogin' service, which by default uses
port 543.  Encrypted Kerberos V5 rlogin uses the `eklogin' service,
which by default uses port 2105.

Kerberos V5 `rsh' uses the `kshell' service, which by default uses port
544.  However, the server must be able to make a TCP connection from
the kshell port to an arbitrary port on the client, so if your users
are to be able to use `rsh' from outside your firewall, the server they
connect to must be able to send outgoing packets to arbitrary port
numbers.  Similarly, if your users need to run `rsh' from inside your
firewall to hosts outside your firewall, the outside server needs to be
able to connect to an arbitrary port on the machine inside your
firewall.  Because Kerberos V5 `rcp' uses `rsh', the same issues apply.
If you need to use `rsh' (or `rcp') through your firewall and are
concerned with the security implications of allowing connections to
arbitrary ports, MIT suggests that you have rules that specifically
name these applications and, if possible, list the allowed hosts.

The book `UNIX System Security', by David Curry, is a good starting
point for learning to configure firewalls.

Backups of Secure Hosts
***********************

When you back up a secure host, you should exclude the host's keytab
file from the backup.  If someone obtained a copy of the keytab from a
backup, that person could make any host masquerade as the host whose
keytab was compromised.  This could be particularly dangerous if the
compromised keytab was from one of your KDCs.  If the machine has a disk
crash and the keytab file is lost, it is easy to generate another keytab
file.  (see Adding Principals to Keytabs.)  If you are unable to
exclude particular files from backups, you should ensure that the
backups are kept as secure as the host's root password.

Backing Up the Kerberos Database
================================

As with any file, it is possible that your Kerberos database could
become corrupted.  If this happens on one of the slave KDCs, you might
never notice, since the next automatic propagation of the database would
install a fresh copy.  However, if it happens to the master KDC, the
corrupted database would be propagated to all of the slaves during the
next propagation.  For this reason, MIT recommends that you back up
your Kerberos database regularly.  Because the master KDC is
continuously dumping the database to a file in order to propagate it to
the slave KDCs, it is a simple matter to have a cron job periodically
copy the dump file to a secure machine elsewhere on your network.  (Of
course, it is important to make the host where these backups are stored
as secure as your KDCs, and to encrypt its transmission across your
network.)  Then if your database becomes corrupted, you can load the
most recent dump onto the master KDC.  (see Restoring a Kerberos Database from a Dump File.)

Bug Reporting
*************

In any complex software, there will be bugs.  If you have successfully
built and installed Kerberos V5, please use the `krb5-send-pr' program
to fill out a Problem Report should you encounter any errors in our
software.

Bug reports that include proposed fixes are especially welcome.  If you
do include fixes, please send them using either context diffs or unified
diffs (using `diff -c' or `diff -u', respectively).  Please be careful
when using "cut and paste" or other such means to copy a patch into a
bug report; depending on the system being used, that can result in
converting TAB characters into spaces, which makes applying the patches
more difficult.

The `krb5-send-pr' program is installed in the directory
`/usr/local/sbin'.

The `krb5-send-pr' program enters the problem report into our Problem
Report Management System (PRMS), which automatically assigns it to the
engineer best able to help you with problems in the assigned category.

The `krb5-send-pr' program will try to intelligently fill in as many
fields as it can.  You need to choose the "category", "class",
"severity", and "priority" of the problem, as well as giving us as much
information as you can about its exact nature.

The PR category will be one of:

     krb5-admin   krb5-appl    krb5-build   krb5-clients
     krb5-doc     krb5-kdc     krb5-libs    krb5-misc
     pty          telnet       test

Choose the category that best describes the area under which your
problem falls.

The class can be "sw-bug", "doc-bug", "change-request", or "support".
The first two are exactly as their names imply.  Use change-request
when the software is behaving according to specifications, but you want
to request changes in some feature or behavior.  The support class is
intended for more general questions about building or using Kerberos V5.

The severity of the problem indicates the problem's impact on the
usability of Kerberos V5.  If a problem is "critical", that means the
product, component or concept is completely non-operational, or some
essential functionality is missing, and no workaround is known.  A
"serious" problem is one in which the product, component or concept is
not working properly or significant functionality is missing.  Problems
that would otherwise be considered critical are rated serious when a
workaround is known.  A "non-critical" problem is one that is indeed a
problem, but one that is having a minimal effect on your ability to use
Kerberos V5.  E.g., The product, component or concept is working in
general, but lacks features, has irritating behavior, does something
wrong, or doesn't match its documentation.  The default severity is
serious.

The priority indicates how urgent this particular problem is in
relation to your work.  Note that low priority does not imply low
importance.  A priority of "high" means a solution is needed as soon as
possible.  A priority of "medium" means the problem should be solved no
later than the next release.  A priority of "low" means the problem
should be solved in a future release, but it is not important to your
work how soon this happens.  The default priority is medium.

Note that a given severity does not necessarily imply a given priority.
For example, a non-critical problem might still have a high priority if
you are faced with a hard deadline.  Conversely, a serious problem might
have a low priority if the feature it is disabling is one that you do
not need.

It is important that you fill in the release field and tell us what
changes you have made, if any.

A sample filled-out form from a company named "Toasters, Inc." might
look like this:

     To: krb5-bugs@mit.edu
     Subject: misspelled "Kerberos" in title of installation guide
     From: jcb
     Reply-To: jcb
     Cc:
     X-send-pr-version: 3.99

     >Submitter-Id:	mit
     >Originator:	Jeffrey C. Gilman Bigler
     >Organization:
     mit
     >Confidential:	no
     >Synopsis:	Misspelled "Kerberos" in title of installation guide
     >Severity:	non-critical
     >Priority:	low
     >Category:	krb5-doc
     >Class:		doc-bug
     >Release:	1.0-development
     >Environment:
     	<machine, os, target, libraries (multiple lines)>
     System: ULTRIX imbrium 4.2 0 RISC
     Machine: mips
     >Description:
             Misspelled "Kerberos" in title of "Kerboros V5 Installation Guide"
     >How-To-Repeat:
             N/A
     >Fix:
             Correct the spelling.

If the `krb5-send-pr' program does not work for you, or if you did not
get far enough in the process to have an installed and working
`krb5-send-pr', you can generate your own form, using the above as an
example.

Appendix
********

Kerberos Error Messages
=======================

Kerberos V5 Library Error Codes
-------------------------------

This is the Kerberos v5 library error code table.  Protocol error codes
are
ERROR_TABLE_BASE_krb5 + the protocol error code number; other error
codes start at ERROR_TABLE_BASE_krb5 + 128.

  0. KRB5KDC_ERR_NONE:  No error

  1. KRB5KDC_ERR_NAME_EXP:  Client's entry in database has expired

  2. KRB5KDC_ERR_SERVICE_EXP:  Server's entry in database has expired

  3. KRB5KDC_ERR_BAD_PVNO:  Requested protocol version not supported

  4. KRB5KDC_ERR_C_OLD_MAST_KVNO:  Client's key is encrypted in an old
     master key

  5. KRB5KDC_ERR_S_OLD_MAST_KVNO:  Server's key is encrypted in an old
     master key

  6. KRB5KDC_ERR_C_PRINCIPAL_UNKNOWN:  Client not found in Kerberos
     database

  7. KRB5KDC_ERR_S_PRINCIPAL_UNKNOWN:  Server not found in Kerberos
     database

  8. KRB5KDC_ERR_PRINCIPAL_NOT_UNIQUE:  Principal has multiple entries
     in Kerberos database

  9. KRB5KDC_ERR_NULL_KEY:  Client or server has a null key

 10. KRB5KDC_ERR_CANNOT_POSTDATE:  Ticket is ineligible for postdating

 11. KRB5KDC_ERR_NEVER_VALID:  Requested effective lifetime is negative
     or too short

 12. KRB5KDC_ERR_POLICY:  KDC policy rejects request

 13. KRB5KDC_ERR_BADOPTION:  KDC can't fulfill requested option

 14. KRB5KDC_ERR_ETYPE_NOSUPP:  KDC has no support for encryption type

 15. KRB5KDC_ERR_SUMTYPE_NOSUPP:  KDC has no support for checksum type

 16. KRB5KDC_ERR_PADATA_TYPE_NOSUPP:  KDC has no support for padata type

 17. KRB5KDC_ERR_TRTYPE_NOSUPP:  KDC has no support for transited type

 18. KRB5KDC_ERR_CLIENT_REVOKED:  Clients credentials have been revoked

 19. KRB5KDC_ERR_SERVICE_REVOKED:  Credentials for server have been
     revoked

 20. KRB5KDC_ERR_TGT_REVOKED:  TGT has been revoked

 21. KRB5KDC_ERR_CLIENT_NOTYET:  Client not yet valid - try again later

 22. KRB5KDC_ERR_SERVICE_NOTYET:  Server not yet valid - try again later

 23. KRB5KDC_ERR_KEY_EXP:  Password has expired

 24. KRB5KDC_ERR_PREAUTH_FAILED:  Preauthentication failed

 25. KRB5KDC_ERR_PREAUTH_REQUIRED:  Additional pre-authentication
     required

 26. KRB5KDC_ERR_SERVER_NOMATCH:  Requested server and ticket don't
     match

 27. KRB5PLACEHOLD_27:  KRB5 error code 27

 28. KRB5PLACEHOLD_28:  KRB5 error code 28

 29. KRB5PLACEHOLD_29:  KRB5 error code 29

 30. KRB5PLACEHOLD_30:  KRB5 error code 30

 31. KRB5KRB_AP_ERR_BAD_INTEGRITY:  Decrypt integrity check failed

 32. KRB5KRB_AP_ERR_TKT_EXPIRED:  Ticket expired

 33. KRB5KRB_AP_ERR_TKT_NYV:  Ticket not yet valid

 34. KRB5KRB_AP_ERR_REPEAT:  Request is a replay

 35. KRB5KRB_AP_ERR_NOT_US:  The ticket isn't for us

 36. KRB5KRB_AP_ERR_BADMATCH:  Ticket/authenticator don't match

 37. KRB5KRB_AP_ERR_SKEW:  Clock skew too great

 38. KRB5KRB_AP_ERR_BADADDR:  Incorrect net address

 39. KRB5KRB_AP_ERR_BADVERSION:  Protocol version mismatch

 40. KRB5KRB_AP_ERR_MSG_TYPE:  Invalid message type

 41. KRB5KRB_AP_ERR_MODIFIED:  Message stream modified

 42. KRB5KRB_AP_ERR_BADORDER:  Message out of order

 43. KRB5KRB_AP_ERR_ILL_CR_TKT:  Illegal cross-realm ticket

 44. KRB5KRB_AP_ERR_BADKEYVER:  Key version is not available

 45. KRB5KRB_AP_ERR_NOKEY:  Service key not available

 46. KRB5KRB_AP_ERR_MUT_FAIL:  Mutual authentication failed

 47. KRB5KRB_AP_ERR_BADDIRECTION:  Incorrect message direction

 48. KRB5KRB_AP_ERR_METHOD:  Alternative authentication method required

 49. KRB5KRB_AP_ERR_BADSEQ:  Incorrect sequence number in message

 50. KRB5KRB_AP_ERR_INAPP_CKSUM:  Inappropriate type of checksum in
     message

 51. KRB5KRB_AP_PATH_NOT_ACCEPTED: Policy rejects transited path

 52. KRB5KRB_ERR_RESPONSE_TOO_BIG: Response too big for UDP, retry with
     TCP

 53. KRB5PLACEHOLD_53:  KRB5 error code 53

 54. KRB5PLACEHOLD_54:  KRB5 error code 54

 55. KRB5PLACEHOLD_55:  KRB5 error code 55

 56. KRB5PLACEHOLD_56:  KRB5 error code 56

 57. KRB5PLACEHOLD_57:  KRB5 error code 57

 58. KRB5PLACEHOLD_58:  KRB5 error code 58

 59. KRB5PLACEHOLD_59:  KRB5 error code 59

 60. KRB5KRB_ERR_GENERIC:  Generic error (see e-text)

 61. KRB5KRB_ERR_FIELD_TOOLONG:  Field is too long for this
     implementation

 62. KRB5PLACEHOLD_62:  KRB5 error code 62

 63. KRB5PLACEHOLD_63:  KRB5 error code 63

 64. KRB5PLACEHOLD_64:  KRB5 error code 64

 65. KRB5PLACEHOLD_65:  KRB5 error code 65

 66. KRB5PLACEHOLD_66:  KRB5 error code 66

 67. KRB5PLACEHOLD_67:  KRB5 error code 67

 68. KRB5PLACEHOLD_68:  KRB5 error code 68

 69. KRB5PLACEHOLD_69:  KRB5 error code 69

 70. KRB5PLACEHOLD_70:  KRB5 error code 70

 71. KRB5PLACEHOLD_71:  KRB5 error code 71

 72. KRB5PLACEHOLD_72:  KRB5 error code 72

 73. KRB5PLACEHOLD_73:  KRB5 error code 73

 74. KRB5PLACEHOLD_74:  KRB5 error code 74

 75. KRB5PLACEHOLD_75:  KRB5 error code 75

 76. KRB5PLACEHOLD_76:  KRB5 error code 76

 77. KRB5PLACEHOLD_77:  KRB5 error code 77

 78. KRB5PLACEHOLD_78:  KRB5 error code 78

 79. KRB5PLACEHOLD_79:  KRB5 error code 79

 80. KRB5PLACEHOLD_80:  KRB5 error code 80

 81. KRB5PLACEHOLD_81:  KRB5 error code 81

 82. KRB5PLACEHOLD_82:  KRB5 error code 82

 83. KRB5PLACEHOLD_83:  KRB5 error code 83

 84. KRB5PLACEHOLD_84:  KRB5 error code 84

 85. KRB5PLACEHOLD_85:  KRB5 error code 85

 86. KRB5PLACEHOLD_86:  KRB5 error code 86

 87. KRB5PLACEHOLD_87:  KRB5 error code 87

 88. KRB5PLACEHOLD_88:  KRB5 error code 88

 89. KRB5PLACEHOLD_89:  KRB5 error code 89

 90. KRB5PLACEHOLD_90:  KRB5 error code 90

 91. KRB5PLACEHOLD_91:  KRB5 error code 91

 92. KRB5PLACEHOLD_92:  KRB5 error code 92

 93. KRB5PLACEHOLD_93:  KRB5 error code 93

 94. KRB5PLACEHOLD_94:  KRB5 error code 94

 95. KRB5PLACEHOLD_95:  KRB5 error code 95

 96. KRB5PLACEHOLD_96:  KRB5 error code 96

 97. KRB5PLACEHOLD_97:  KRB5 error code 97

 98. KRB5PLACEHOLD_98:  KRB5 error code 98

 99. KRB5PLACEHOLD_99:  KRB5 error code 99

100. KRB5PLACEHOLD_100:  KRB5 error code 100

101. KRB5PLACEHOLD_101:  KRB5 error code 101

102. KRB5PLACEHOLD_102:  KRB5 error code 102

103. KRB5PLACEHOLD_103:  KRB5 error code 103

104. KRB5PLACEHOLD_104:  KRB5 error code 104

105. KRB5PLACEHOLD_105:  KRB5 error code 105

106. KRB5PLACEHOLD_106:  KRB5 error code 106

107. KRB5PLACEHOLD_107:  KRB5 error code 107

108. KRB5PLACEHOLD_108:  KRB5 error code 108

109. KRB5PLACEHOLD_109:  KRB5 error code 109

110. KRB5PLACEHOLD_110:  KRB5 error code 110

111. KRB5PLACEHOLD_111:  KRB5 error code 111

112. KRB5PLACEHOLD_112:  KRB5 error code 112

113. KRB5PLACEHOLD_113:  KRB5 error code 113

114. KRB5PLACEHOLD_114:  KRB5 error code 114

115. KRB5PLACEHOLD_115:  KRB5 error code 115

116. KRB5PLACEHOLD_116:  KRB5 error code 116

117. KRB5PLACEHOLD_117:  KRB5 error code 117

118. KRB5PLACEHOLD_118:  KRB5 error code 118

119. KRB5PLACEHOLD_119:  KRB5 error code 119

120. KRB5PLACEHOLD_120:  KRB5 error code 120

121. KRB5PLACEHOLD_121:  KRB5 error code 121

122. KRB5PLACEHOLD_122:  KRB5 error code 122

123. KRB5PLACEHOLD_123:  KRB5 error code 123

124. KRB5PLACEHOLD_124:  KRB5 error code 124

125. KRB5PLACEHOLD_125:  KRB5 error code 125

126. KRB5PLACEHOLD_126:  KRB5 error code 126

127. KRB5PLACEHOLD_127:  KRB5 error code 127

128. KRB5_ERR_RCSID:  (RCS Id string for the krb5 error table)

129. KRB5_LIBOS_BADLOCKFLAG:  Invalid flag for file lock mode

130. KRB5_LIBOS_CANTREADPWD:  Cannot read password

131. KRB5_LIBOS_BADPWDMATCH:  Password mismatch

132. KRB5_LIBOS_PWDINTR:  Password read interrupted

133. KRB5_PARSE_ILLCHAR:  Illegal character in component name

134. KRB5_PARSE_MALFORMED:  Malformed representation of principal

135. KRB5_CONFIG_CANTOPEN:  Can't open/find Kerberos configuration file

136. KRB5_CONFIG_BADFORMAT:  Improper format of Kerberos configuration
     file

137. KRB5_CONFIG_NOTENUFSPACE:  Insufficient space to return complete
     information

138. KRB5_BADMSGTYPE:  Invalid message type specified for encoding

139. KRB5_CC_BADNAME:  Credential cache name malformed

140. KRB5_CC_UNKNOWN_TYPE:  Unknown credential cache type

141. KRB5_CC_NOTFOUND:  Matching credential not found

142. KRB5_CC_END:  End of credential cache reached

143. KRB5_NO_TKT_SUPPLIED:  Request did not supply a ticket

144. KRB5KRB_AP_WRONG_PRINC:  Wrong principal in request

145. KRB5KRB_AP_ERR_TKT_INVALID:  Ticket has invalid flag set

146. KRB5_PRINC_NOMATCH:  Requested principal and ticket don't match

147. KRB5_KDCREP_MODIFIED:  KDC reply did not match expectations

148. KRB5_KDCREP_SKEW:  Clock skew too great in KDC reply

149. KRB5_IN_TKT_REALM_MISMATCH:  Client/server realm mismatch in
     initial ticket request

150. KRB5_PROG_ETYPE_NOSUPP:  Program lacks support for encryption type

151. KRB5_PROG_KEYTYPE_NOSUPP:  Program lacks support for key type

152. KRB5_WRONG_ETYPE:  Requested encryption type not used in message

153. KRB5_PROG_SUMTYPE_NOSUPP:  Program lacks support for checksum type

154. KRB5_REALM_UNKNOWN:  Cannot find KDC for requested realm

155. KRB5_SERVICE_UNKNOWN:  Kerberos service unknown

156. KRB5_KDC_UNREACH:  Cannot contact any KDC for requested realm

157. KRB5_NO_LOCALNAME:  No local name found for principal name

158. KRB5_MUTUAL_FAILED:  Mutual authentication failed

159. KRB5_RC_TYPE_EXISTS:  Replay cache type is already registered

160. KRB5_RC_MALLOC:  No more memory to allocate (in replay cache code)

161. KRB5_RC_TYPE_NOTFOUND:  Replay cache type is unknown

162. KRB5_RC_UNKNOWN:  Generic unknown RC error

163. KRB5_RC_REPLAY:  Message is a replay

164. KRB5_RC_IO:  Replay I/O operation failed XXX

165. KRB5_RC_NOIO:  Replay cache type does not support non-volatile
     storage

166. KRB5_RC_PARSE:  Replay cache name parse/format error

167. KRB5_RC_IO_EOF:  End-of-file on replay cache I/O

168. KRB5_RC_IO_MALLOC:  No more memory to allocate (in replay cache I/O
     code)

169. KRB5_RC_IO_PERM:  Permission denied in replay cache code

170. KRB5_RC_IO_IO:  I/O error in replay cache i/o code

171. KRB5_RC_IO_UNKNOWN:  Generic unknown RC/IO error

172. KRB5_RC_IO_SPACE:  Insufficient system space to store replay
     information

173. KRB5_TRANS_CANTOPEN:  Can't open/find realm translation file

174. KRB5_TRANS_BADFORMAT:  Improper format of realm translation file

175. KRB5_LNAME_CANTOPEN:  Can't open/find lname translation database

176. KRB5_LNAME_NOTRANS:  No translation available for requested
     principal

177. KRB5_LNAME_BADFORMAT:  Improper format of translation database
     entry

178. KRB5_CRYPTO_INTERNAL:  Cryptosystem internal error

179. KRB5_KT_BADNAME:  Key table name malformed

180. KRB5_KT_UNKNOWN_TYPE:  Unknown Key table type

181. KRB5_KT_NOTFOUND:  Key table entry not found

182. KRB5_KT_END:  End of key table reached

183. KRB5_KT_NOWRITE:  Cannot write to specified key table

184. KRB5_KT_IOERR:  Error writing to key table

185. KRB5_NO_TKT_IN_RLM:  Cannot find ticket for requested realm

186. KRB5DES_BAD_KEYPAR:  DES key has bad parity

187. KRB5DES_WEAK_KEY:  DES key is a weak key

188. KRB5_BAD_ENCTYPE:  Bad encryption type

189. KRB5_BAD_KEYSIZE:  Key size is incompatible with encryption type

190. KRB5_BAD_MSIZE:  Message size is incompatible with encryption type

191. KRB5_CC_TYPE_EXISTS:  Credentials cache type is already registered.

192. KRB5_KT_TYPE_EXISTS:  Key table type is already registered.

193. KRB5_CC_IO:  Credentials cache I/O operation failed XXX

194. KRB5_FCC_PERM:  Credentials cache file permissions incorrect

195. KRB5_FCC_NOFILE:  No credentials cache found

196. KRB5_FCC_INTERNAL:  Internal credentials cache error

197. KRB5_CC_WRITE:  Error writing to credentials cache

198. KRB5_CC_NOMEM:  No more memory to allocate (in credentials cache
     code)

199. KRB5_CC_FORMAT:  Bad format in credentials cache

200. KRB5_INVALID_FLAGS:  Invalid KDC option combination (library
     internal error) [for dual tgt library calls]

201. KRB5_NO_2ND_TKT:  Request missing second ticket [for dual tgt
     library calls]

202. KRB5_NOCREDS_SUPPLIED:  No credentials supplied to library routine

203. KRB5_SENDAUTH_BADAUTHVERS:  Bad sendauth version was sent

204. KRB5_SENDAUTH_BADAPPLVERS:  Bad application version was sent (via
     sendauth)

205. KRB5_SENDAUTH_BADRESPONSE:  Bad response (during sendauth exchange)

206. KRB5_SENDAUTH_REJECTED:  Server rejected authentication (during
     sendauth exchange)

207. KRB5_PREAUTH_BAD_TYPE:  Unsupported preauthentication type

208. KRB5_PREAUTH_NO_KEY:  Required preauthentication key not supplied

209. KRB5_PREAUTH_FAILED:  Generic preauthentication failure

210. KRB5_RCACHE_BADVNO:  Unsupported replay cache format version number

211. KRB5_CCACHE_BADVNO:  Unsupported credentials cache format version
     number

212. KRB5_KEYTAB_BADVNO:  Unsupported key table format version number

213. KRB5_PROG_ATYPE_NOSUPP:  Program lacks support for address type

214. KRB5_RC_REQUIRED:  Message replay detection requires rcache
     parameter

215. KRB5_ERR_BAD_HOSTNAME:  Hostname cannot be canonicalized

216. KRB5_ERR_HOST_REALM_UNKNOWN:  Cannot determine realm for host

217. KRB5_SNAME_UNSUPP_NAMETYPE:  Conversion to service principal
     undefined for name type

218. KRB5KRB_AP_ERR_V4_REPLY:  Initial Ticket response appears to be
     Version 4 error

219. KRB5_REALM_CANT_RESOLVE:  Cannot resolve KDC for requested realm

220. KRB5_TKT_NOT_FORWARDABLE:  Requesting ticket can't get forwardable
     tickets

221. KRB5_FWD_BAD_PRINCIPAL:  Bad principal name while trying to forward
     credentials

222. KRB5_GET_IN_TKT_LOOP:  Looping detected inside krb5_get_in_tkt

223. KRB5_CONFIG_NODEFREALM:  Configuration file does not specify
     default realm

224. KRB5_SAM_UNSUPPORTED:  Bad SAM flags in obtain_sam_padata

225. KRB5_KT_NAME_TOOLONG: Keytab name too long

226. KRB5_KT_KVNONOTFOUND: Key version number for principal in key
     table is incorrect

227. KRB5_APPL_EXPIRED: This application has expired

228. KRB5_LIB_EXPIRED: This Krb5 library has expired

229. KRB5_CHPW_PWDNULL: New password cannot be zero length

230. KRB5_CHPW_FAIL: Password change failed

231. KRB5_KT_FORMAT: Bad format in keytab

232. KRB5_NOPERM_ETYPE: Encryption type not permitted

233. KRB5_CONFIG_ETYPE_NOSUPP: No supported encryption types (config
     file error?)

234. KRB5_OBSOLETE_FN: Program called an obsolete, deleted function

235. KRB5_EAI_FAIL: unknown getaddrinfo failure

236. KRB5_EAI_NODATA: no data available for host/domain name

237. KRB5_EAI_NONAME: host/domain name not found

238. KRB5_EAI_SERVICE: service name unknown

239. KRB5_ERR_NUMERIC_REALM: Cannot determine realm for numeric host
     address

Kerberos V5 Database Library Error Codes
----------------------------------------

This is the Kerberos v5 database library error code table.

  0. KRB5_KDB_RCSID:  (RCS Id string for the kdb error table)

  1. KRB5_KDB_INUSE:  Entry already exists in database

  2. KRB5_KDB_UK_SERROR:  Database store error

  3. KRB5_KDB_UK_RERROR:  Database read error

  4. KRB5_KDB_UNAUTH:  Insufficient access to perform requested
     operation

  5. KRB5_KDB_NOENTRY:  No such entry in the database

  6. KRB5_KDB_ILL_WILDCARD:  Illegal use of wildcard

  7. KRB5_KDB_DB_INUSE:  Database is locked or in use-try again later

  8. KRB5_KDB_DB_CHANGED:  Database was modified during read

  9. KRB5_KDB_TRUNCATED_RECORD:  Database record is incomplete or
     corrupted

 10. KRB5_KDB_RECURSIVELOCK:  Attempt to lock database twice

 11. KRB5_KDB_NOTLOCKED:  Attempt to unlock database when not locked

 12. KRB5_KDB_BADLOCKMODE:  Invalid kdb lock mode

 13. KRB5_KDB_DBNOTINITED:  Database has not been initialized

 14. KRB5_KDB_DBINITED:  Database has already been initialized

 15. KRB5_KDB_ILLDIRECTION:  Bad direction for converting keys

 16. KRB5_KDB_NOMASTERKEY:  Cannot find master key record in database

 17. KRB5_KDB_BADMASTERKEY:  Master key does not match database

 18. KRB5_KDB_INVALIDKEYSIZE:  Key size in database is invalid

 19. KRB5_KDB_CANTREAD_STORED:  Cannot find/read stored master key

 20. KRB5_KDB_BADSTORED_MKEY:  Stored master key is corrupted

 21. KRB5_KDB_CANTLOCK_DB:  Insufficient access to lock database

 22. KRB5_KDB_DB_CORRUPT:  Database format error

 23. KRB5_KDB_BAD_VERSION:  Unsupported version in database entry

 24. KRB5_KDB_BAD_SALTTYPE:  Unsupported salt type

 25. KRB5_KDB_BAD_ENCTYPE:  Unsupported encryption type

 26. KRB5_KDB_BAD_CREATEFLAGS: Bad database creation flags

 27. KRB5_KDB_NO_PERMITTED_KEY: No matching key in entry having a
     permitted enc type

 28. KRB5_KDB_NO_MATCHING_KEY: No matching key in entry