1.3. Create the Database and Set Up First Administrator

Use the utilty kdb5_util to create the Kerberos database.

The -s option allows storing the master server key for database in a stash file.

If the stash file is not present, you must log into the KDC with the master password (specified during installation) each time it starts. This will automatically regenerate the master server key.

Edit the Access Control List (/var/kerberos/krb5kdc/kadm5.acl in RHEL or CentOS and /var/lib/kerberos/krb5kdc/kadm5.acl in SLES ) to define the principals that have admin (modifying) access to the database.

A simple example would be a single entry:

*/admin@EXAMPLE.COM *

This specifies that all principals with the /admin instance extension have full access to the database.

Restart kadmin.

Create the first user principal.

On the KDC machine, execute the following as root user:

/usr/sbin/kadmin.local -q "addprinc <username>/admin"

Other principals can now be created either on the KDC machine itself or through the network, using this principal.

Start Kerberos.