30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
|
# File '../../src/include/kerberos-server/helps.rb', line 30
def initialize_kerberos_server_helps(include_target)
textdomain "kerberos-server"
@HELPS = {
"read" => _(
"<p><b><big>Initializing Kerberos Server Configuration</big></b><br>\n</p>\n"
) +
_(
"<p><b><big>Aborting Initialization:</big></b><br>\nSafely abort the configuration utility by pressing <b>Abort</b> now.</p>\n"
),
"write" => _(
"<p><b><big>Saving Kerberos Server Configuration</big></b><br>\n</p>\n"
) +
_(
"<p><b><big>Aborting Saving:</big></b><br>\n" +
"Abort the save procedure by pressing <b>Abort</b>.\n" +
"An additional dialog informs whether it is safe to do so.\n" +
"</p>\n"
),
"AskDBtype" => _(
"<p>Specify where the Kerberos server should store the data.</p>"
) +
_(
"<p><big>Local Database</big> will create a local database for storing the credentials.</p>"
) +
_(
"<p><big>Set Up New LDAP Server as Database Back-End</big> will set up a new LDAP server\non this machine and use it as database back-end.</p>\n"
) +
_(
"<p><big>Use Existing LDAP Server as Database Back-End</big> gives you the\noption to use an external LDAP server as database back-end.</p>\n"
),
"basic" => _(
"<p>Specify the <big>Realm</big> and the <big>Master Password</big> for your Kerberos server.</p>"
) +
_(
"<p>Although your Kerberos realm can be any ASCII string, the convention is to use upper-case letters as in your domain name.</p>\n"
),
"useldap" => _(
"<p>In this dialog, edit some parameters for the LDAP server.</p>"
) +
_(
"<p>With <big>LDAP Server URI</big> specify the location of the LDAP\nserver. For example, <tt>ldaps://host.domain.com</tt>.</p>"
) +
_(
"<p>With <big>LDAP Base DN</big> you can change the base DN of the LDAP server.</p>"
) +
_(
"<p>The <big>Kerberos Container DN</big> specifies the container where the Kerberos server should create \nthe principals and other informational data by default.</p>"
) +
_(
"<p><big>KDC Bind DN</big> is the DN that KDC uses to authenticate to the LDAP server.\nOnly read access is required for this account.</p>\n"
) +
_(
"<p><big>Kadmin Bind DN</big> is the DN that Kadmind uses to authenticate to the LDAP server.\nThis account also needs write access.</p>\n"
),
"newldap" => _(
"<p>In this dialog, edit some parameters to set up an LDAP server.</p>"
) +
_(
"<p>With <big>LDAP Base DN</big> you can change the base DN of the LDAP server.</p>"
) +
_(
"<p>The <big>Kerberos Container DN</big> specifies the container where the Kerberos server should create \nthe principals and other informational data by default.</p>\n"
) +
_("<p><big>KDC Bind DN</big> is the DN for the administrator.</p>") +
_(
"<p>If you select the checkbox <big>Use Previously Entered Password</big>, the password you entered\nas the KDC Master password is also used for the LDAP administrator. \n"
) +
_(
"When the checkbox is not set, you can enter a different password for the LDAP administrator.</p>"
),
"summary" => _(
"<p>This is a short summary about your Kerberos server configuration.</p>"
) +
_(
"<p>With the radio buttons you can enable or disable this service.</p>"
) +
_(
"<p>You can change some values of your configuration by clicking the <b>Edit</b> button.</p>"
),
"adv_database_name" => _(
"<p>This string specifies the location of the Kerberos database for this realm.</p>"
),
"adv_acl_file" => _(
"<p>This string specifies the location of the access control list (ACL) file that kadmin uses to determine the principals' permissions on the database.</p>"
),
"adv_admin_keytab" => _(
"<p>This string specifies the location of the keytab file that kadmin uses to authenticate to the database.</p>"
),
"adv_default_principal_expiration" => _(
"<p>This absolute time specifies the default expiration date of principals created in this realm.</p>"
),
"adv_default_principal_flags" => _(
"<p>These flags specify the default attributes of the principal created in this realm.</p>"
) + "<ul><li><b>" +
_("Allow postdated") + "</b> " +
_(
"Enabling this flag allows the principal to obtain postdateable tickets."
) + "</li>" + "<li><b>" +
_("Allow forwardable") + "</b> " +
_(
"Enabling this flag allows the principal to obtain forwardable tickets."
) + "</li>" + "<li><b>" +
_("Allow renewable") + "</b> " +
_(
"Enabling this flag allows the principal to obtain renewable tickets."
) + "</li>" + "<li><b>" +
_("Allow proxiable") + "</b> " +
_("Enabling this flag allows the principal to obtain proxy tickets.") + "</li>" + "<li><b>" +
_("Enable user-to-user authentication") + "</b> " +
_(
"Enabling this flag allows the principal to obtain a session key for another user, permitting user-to-user authentication for this principal."
) + "</li>" + "<li><b>" +
_("Requires preauth") + "</b> " +
_(
"If this flag is enabled on a client principal, that principal is required to preauthenticate to the KDC before receiving any tickets. If you enable this flag on a service principal, the service tickets for this principal will only be issued to clients with a TGT that has the preauthenticated ticket set."
) + "</li>" + "<li><b>" +
_("Requires hwauth") + "</b> " +
_(
"If this flag is enabled, the principal is required to preauthenticate using a hardware device before receiving any tickets."
) + "</li>" + "<li><b>" +
_("Allow service") + "</b> " +
_(
"Enabling this flag allows the KDC to issue service tickets for this principal."
) + "</li>" + "<li><b>" +
_("Allow tgs request") + "</b> " +
_(
"Enabling this flag allows a principal to obtain tickets based on a ticket-granting-ticket, rather than repeating the authentication process that was used to obtain the TGT."
) + "</li>" + "<li><b>" +
_("Allow tickets") + "</b> " +
_(
"Enabling this flag means that the KDC will issue tickets for this principal. Disabling this flag essentially deactivates the principal within this realm."
) + "</li>" + "<li><b>" +
_("Need change") + "</b> " +
_("Enabling this flag forces a password change for this principal.") + "</li>" + "<li><b>" +
_("Password changing service") + "</b> " +
_(
"If this flag is enabled, it marks this principal as a password change service. This should only be used in special cases, for example, if a user's password has expired, the user has to get tickets for that principal to be able to change it without going through the normal password authentication."
) + "</li></ul>",
"adv_dict_file" => _(
"<p>The string location of the dictionary file containing strings that are not allowed as passwords. If this tag is not set or if there is no policy assigned to the principal, no check will be done.</p>"
),
"adv_kadmind_port" => _(
"<p>This port number specifies the port on which the kadmind daemon listens for this realm.</p>"
),
"adv_kpasswd_port" => _(
"<p>This port number specifies the port on which the kadmind daemon listens for this realm.</p>"
),
"adv_key_stash_file" => _(
"<p>This string specifies the location where the master key has been stored with kdb5_stash.</p>"
),
"adv_kdc_ports" => _(
"<p>This string specifies the list of ports that the KDC listens to for this realm.</p>"
),
"adv_master_key_name" => _(
"<p>This string specifies the name of the principal associated with the master key. The default value is K/M.</p>"
),
"adv_master_key_type" => _(
"<p>This key type string represents the master keys key type.</p>"
),
"adv_max_life" => _(
"<p>This delta time specifies the maximum time period that a ticket may be valid for in this realm.</p>"
),
"adv_max_renew_life" => _(
"<p>This delta time specifies the maximum time period that a ticket may be renewed for in this realm.</p>"
),
"adv_supported_enctypes" => _(
"<p>A list of key/salt strings that specifies the default key/salt combinations of principals for this realm.</p>"
),
"adv_kdc_supported_enctypes" => _(
"<p>Specifies the permitted key/salt combinations of principals for this realm.</p>"
),
"adv_reject_bad_transit" => _(
"<p>Specifies whether or not the list of transited realms for cross-realm tickets should be checked against the transit path computed from the realm names and the [capaths] section of its krb5.conf file</p>"
),
"adv_ldap_conns_per_server" => _(
"<p>This LDAP specific tag indicates the number of connections to be maintained via the LDAP server.</p>"
),
"adv_ldap_service_password_file" => _(
"<p>This LDAP-specific tag indicates the file containing the stashed passwords for the objects used for starting the Kerberos servers.</p>"
),
"adv_kdb_subtrees" => _(
"<p>Specifies the list of subtrees containing the principals of a realm. The list contains the DNs of the subtree objects separated by colon(:).</p><p>The search scope specifies the scope for searching the principals under the subtree.</p>"
),
"adv_kdb_containerref" => _(
"<p>Specifies the DN of the container object in which the principals of a realm will be created. If the container reference is not configured for a realm, the principals will be created in the realm container.</p>"
),
"adv_kdb_maxtktlife" => _(
"<p>Specifies maximum ticket life for principals in this realm.</p>"
),
"adv_kdb_maxrenewlife" => _(
"<p>Specifies maximum renewable life of tickets for principals in this realm.</p>"
)
}
end
|