kprop is a command-line utility used for propagating a Kerberos database from a master KDC to a slave KDC. This command must be run on the master KDC. See the Solaris System Administration Guide, Vol. 6 on how to set up periodic propagation between the master KDC and slave KDCs.

To propagate a Kerberos database, the following conditions must be met:

• The slave KDCs must have an /etc/krb5/kpropd.acl file that contains the principals for the master KDC and all the slave KDCs.
• A keytab containing a host principal entry must exist on each slave KDC.
• The database to be propagated must be dumped to a file using kdb5_util(1M).

The following options are supported:

-d

Enable debug mode. Default is debug mode disabled.

-f file

File to be sent to the slave KDC. Default is the /var/krb5/slave_datatrans file.

-p port-number

Propagate port-number. Default is port 754.

-r realm

Realm where propagation will occur. Default realm is the local realm.

-s keytab

Location of the keytab. Default location is /etc/krb5/krb5.keytab.

The following operands are supported:

host

Name of the slave KDC.

/etc/krb5/kpropd.acl

List of principals of all the KDCs; resides on each slave KDC.

/etc/krb5/krb5.keytab

Keytab for Kerberos clients.

/var/krb5/slave_datatrans

Kerberos database propagated to the KDC slaves.

See attributes(5) for descriptions of the following attributes:

kpasswd(1), gkadmin(1M), kadmind(1M), kadmin.local(1M), kdb5_util(1M), kadm5.acl(4), kdc.conf(4), attributes(5), SEAM(5)

Solaris System Administration Guide, Security Services