Forge Home


Install and configure MIT Kerberos v5


9,935 latest version

3.4 quality score

We run a couple of automated
scans to help you access a
module's quality. Each module is
given a score based on how well
the author has formatted their
code and documentation and
modules are also checked for
malware using VirusTotal.

Please note, the information below
is for guidance only and neither of
these methods should be considered
an endorsement by Puppet.

Version information

  • 0.0.1 (latest)
released May 21st 2014

Start using this module

  • r10k or Code Manager
  • Bolt
  • Manual installation
  • Direct download

Add this module to your Puppetfile:

mod 'viirya-mit_krb5', '0.0.1'
Learn more about managing modules with a Puppetfile

Add this module to your Bolt project:

bolt module add viirya-mit_krb5
Learn more about using this module with an existing project

Manually install this module globally with Puppet module tool:

puppet module install viirya-mit_krb5 --version 0.0.1

Direct download is not typically how you would use a Puppet module to manage your infrastructure, but you may want to download the module in order to inspect the code.



viirya/mit_krb5 — version 0.0.1 May 21st 2014


Table of Contents

  1. Overview
  2. Dependencies
  3. Examples
  4. Classes and Resources
  5. Limitations
  6. License
  7. Development


This Puppet module is a forked version of pfmooney/puppet-mit_krb5. Compared with the original module, this fork adds the tasks of setting up KDC services.

This module is designed to facilitate the installation and configuration of MIT Kerberos. The primary scope includes installing the user utilities (kinit, etc) on the system and populating krb5.conf with the appropriate sections.



class { 'mit_krb5':
  default_realm      => 'INSECURE.LOCAL',
  permitted_enctypes => ['des-cbc-crc', 'des-cbc-md5'],
  allow_weak_crypto  => true,
  install_role       => 'client'  # or 'server'
class { 'mit_krb5::logging':
  default => ['FILE:/var/log/krb5libs.log', 'SYSLOG']
mit_krb5::realm { 'INSECURE.LOCAL':
  kdc          => ['kdc1.insecure.local', 'kdc2.insecure.local'],
  admin_server => 'kpasswd.insecure.local',
mit_krb5::domain_realm { 'INSECURE.LOCAL':
  domains => ['insecure.local', '.insecure.local']

Yields the following krb5.conf:

    default = FILE:/var/log/krb5libs.log
    default = SYSLOG

    default_realm = INSECURE.LOCAL
    permitted_enctypes = des-cbc-crc des-cbc-md5
    allow_weak_crypto = true

        kdc = kdc1.insecure.local
        kdc = kdc2.insecure.local
        admin_server = kpasswd.insecure.local

    insecure.local = INSECURE.LOCAL
    .insecure.local = INSECURE.LOCAL

Code such at this would mimic the example file shipped with CentOS/RHEL:

class { 'mit_krb5::install': }
class { 'mit_krb5':
  default_realm    => 'EXAMPLE.COM',
  dns_lookup_realm => false,
  dns_lookup_kdc   => false,
  ticket_lifetime  => '24h',
  renew_lifetime   => '7d',
  forwardable      => true,
class { 'mit_krb5::logging':
  default      => 'FILE:/var/log/krb5libs.log',
  kdc          => 'FILE:/var/log/krb5kdc.log',
  admin_server => 'FILE:/var/log/kadmind.log'
mit_krb5::realm { 'EXAMPLE.COM':
  kdc          => '',
  admin_server => ''
mit_krb5::domain_realm { 'INSECURE.LOCAL':
  domains => ['', '']

Classes and Resources

The module was structured into resources/classes that resemble the sections of krb5.conf.


Top-level class that installs MIT Kerberos and controls krb5.conf file. Class parameters are used to define contents of [libdefaults] section.

Parameters from libdefaults section

  • default_realm - Must be set to non-empty
  • default_keytab_name
  • default_tgs_enctypes
  • default_tkt_enctypes
  • permitted_enctypes
  • allow_weak_crypto
  • clockskew
  • ignore_acceptor_hostname
  • k5login_authoritative
  • k5login_directory
  • kdc_timesync
  • kdc_req_checksum_type
  • ap_req_checksum_type
  • safe_checksum_type
  • preferred_preauth_types
  • ccache_type
  • dns_lookup_kdc
  • dns_lookup_realm
  • dns_fallback
  • realm_try_domains
  • extra_addresses
  • udp_preference_limit
  • verify_ap_req_nofail
  • ticket_lifetime
  • renew_lifetime
  • noaddresses
  • forwardable
  • proxiable
  • rdns
  • plugin_base_dir

File parameters

  • krb5_conf_path - Path to krb5.conf (default: /etc/krb5.conf)
  • krb5_conf_owner - Owner of krb5.conf (default: root)
  • krb5_conf_group - Group of krb5.conf (default: root)
  • krb5_conf_mode - Mode of krb5.conf (default: 0444)


Class to install Kerberos client package(s). This class is included from mit_krb5. If you wish to set the packages parameter, do so before declaring/including mit_krb5 or use hiera.


  • packages - Override facter-derived defaults for Kerberos packages (default: undef)


Resource to add entries to the [realms] section.

Realm name is specified by resource title

Parameters from realm section

  • kdc - (arrays allowed)
  • admin_server - (arrays allowed)
  • database_module
  • default_domain
  • v4_instance_convert
  • v4_realm
  • auth_to_local_names
  • auth_to_local


Class to configure [logging] section

Parameters from logging section

  • default - (arrays allowed)
  • defaults - Replaces 'default' parameter (for use in Puppet 2.7)
  • admin_server - (arrays allowed)
  • kdc - (arrays allowed)


Resource to add entries to [domain_realm] section.


  • domains - Domains to be mapped into realm - (arrays allowed)
  • realm - Realm to map into - (default: resource title)


Configuration sections other than those listed above are not yet supported. This includes:

  • appdefaults
  • capaths
  • dbdefaults
  • dbmodules
  • login
  • plugins

Stub classes for those sections exist but will throw an error.


Apache License, Version 2.0