IPROP(8) BSD System Manager's Manual IPROP(8) NNAAMMEE iipprroopp, iipprrooppdd--mmaasstteerr, iipprrooppdd--ssllaavvee -- propagate transactions from a Heim- dal Kerberos master KDC to slave KDCs SSYYNNOOPPSSIISS iipprrooppdd--mmaasstteerr [--cc _s_t_r_i_n_g | ----ccoonnffiigg--ffiillee==_s_t_r_i_n_g] [--rr _s_t_r_i_n_g | ----rreeaallmm==_s_t_r_i_n_g] [--kk _k_s_p_e_c | ----kkeeyyttaabb==_k_s_p_e_c] [--dd _f_i_l_e | ----ddaattaabbaassee==_f_i_l_e] [----ssllaavvee--ssttaattss--ffiillee==_f_i_l_e] [----ttiimmee--mmiissssiinngg==_t_i_m_e] [----ttiimmee--ggoonnee==_t_i_m_e] [----ddeettaacchh] [----vveerrssiioonn] [----hheellpp] iipprrooppdd--ssllaavvee [--cc _s_t_r_i_n_g | ----ccoonnffiigg--ffiillee==_s_t_r_i_n_g] [--rr _s_t_r_i_n_g | ----rreeaallmm==_s_t_r_i_n_g] [--kk _k_s_p_e_c | ----kkeeyyttaabb==_k_s_p_e_c] [----ttiimmee--lloosstt==_t_i_m_e] [----ddeettaacchh] [----vveerrssiioonn] [----hheellpp] _m_a_s_t_e_r DDEESSCCRRIIPPTTIIOONN iipprrooppdd--mmaasstteerr is used to propagate changes to a Heimdal Kerberos database from the master Kerberos server on which it runs to slave Kerberos servers running iipprrooppdd--ssllaavvee. The slaves are specified by the contents of the _s_l_a_v_e_s file in the KDC's database directory, e.g. _/_v_a_r_/_h_e_i_m_d_a_l_/_s_l_a_v_e_s. This has principals one per-line of the form iprop/_s_l_a_v_e@_R_E_A_L_M where _s_l_a_v_e is the hostname of the slave server in the given _R_E_A_L_M, e.g. iprop/kerberos-1.example.com@EXAMPLE.COM On a slave, the argument _m_a_s_t_e_r specifies the hostname of the master server from which to receive updates. In contrast to hprop(8), which sends the whole database to the slaves regularly, iipprroopp normally sends only the changes as they happen on the master. The master keeps track of all the changes by assigning a version number to every transaction to the database. The slaves know which was the latest version they saw, and in this way it can be determined if they are in sync or not. A log of all the transactions is kept on the master. When a slave is at an older version than the oldest one in the log, the whole database has to be sent. The log of transactions is also used to implement a two-phase commit (with roll-forward for recovery) method of updating the HDB. Transac- tions are first recorded in the log, then in the HDB, then the log is updated to mark the transaction as committed. The changes are propagated over a secure channel (on port 2121 by default). This should normally be defined as ``iprop/tcp'' in _/_e_t_c_/_s_e_r_v_i_c_e_s or another source of the services database. The master and slaves must each have access to a keytab with keys for the iipprroopp service principal on the local host. There is a keep-alive feature logged in the master's _s_l_a_v_e_-_s_t_a_t_s file (e.g. _/_v_a_r_/_h_e_i_m_d_a_l_/_s_l_a_v_e_-_s_t_a_t_s). Supported options for iipprrooppdd--mmaasstteerr: --cc _s_t_r_i_n_g, ----ccoonnffiigg--ffiillee==_s_t_r_i_n_g --rr _s_t_r_i_n_g, ----rreeaallmm==_s_t_r_i_n_g --kk _k_s_p_e_c, ----kkeeyyttaabb==_k_s_p_e_c keytab to get authentication from --dd _f_i_l_e, ----ddaattaabbaassee==_f_i_l_e Database (default per KDC) ----ssllaavvee--ssttaattss--ffiillee==_f_i_l_e file for slave status information ----ttiimmee--mmiissssiinngg==_t_i_m_e time before slave is polled for presence (default 2 min) ----ttiimmee--ggoonnee==_t_i_m_e time of inactivity after which a slave is considered gone (default 5 min) ----ddeettaacchh detach from console ----vveerrssiioonn ----hheellpp Supported options for iipprrooppdd--ssllaavvee: --cc _s_t_r_i_n_g, ----ccoonnffiigg--ffiillee==_s_t_r_i_n_g --rr _s_t_r_i_n_g, ----rreeaallmm==_s_t_r_i_n_g --kk _k_s_p_e_c, ----kkeeyyttaabb==_k_s_p_e_c keytab to get authentication from ----ttiimmee--lloosstt==_t_i_m_e time before server is considered lost (default 5 min) ----ddeettaacchh detach from console ----vveerrssiioonn ----hheellpp Time arguments for the relevant options above may be specified in forms like 5 min, 300 s, or simply a number of seconds. FFIILLEESS _s_l_a_v_e_s, _s_l_a_v_e_-_s_t_a_t_s in the database directory. _i_p_r_o_p_d_-_m_a_s_t_e_r_._p_i_d, _i_p_r_o_p_d_-_s_l_a_v_e_._p_i_d in the database directory, or in the directory named by the HEIM_PIDFILE_DIR environment variable. SSEEEE AALLSSOO krb5.conf(5), hprop(8), hpropd(8), iprop-log(8), kdc(8). BSD May 24, 2005 BSD