doc/html/admin/backup_host.html

   1 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   2   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   3
   4
   5 <html xmlns="http://www.w3.org/1999/xhtml">
   6   <head>
   7     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   8
   9     <title>Backups of secure hosts &mdash; MIT Kerberos Documentation</title>
  10
  11     <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />
  12     <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
  13     <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />
  14
  15     <script type="text/javascript">
  16       var DOCUMENTATION_OPTIONS = {
  17         URL_ROOT:    '../',
  18         VERSION:     '1.15.2',
  19         COLLAPSE_INDEX: false,
  20         FILE_SUFFIX: '.html',
  21         HAS_SOURCE:  true
  22       };
  23     </script>
  24     <script type="text/javascript" src="../_static/jquery.js"></script>
  25     <script type="text/javascript" src="../_static/underscore.js"></script>
  26     <script type="text/javascript" src="../_static/doctools.js"></script>
  27     <link rel="author" title="About these documents" href="../about.html" />
  28     <link rel="copyright" title="Copyright" href="../copyright.html" />
  29     <link rel="top" title="MIT Kerberos Documentation" href="../index.html" />
  30     <link rel="up" title="For administrators" href="index.html" />
  31     <link rel="next" title="PKINIT configuration" href="pkinit.html" />
  32     <link rel="prev" title="Host configuration" href="host_config.html" />
  33   </head>
  34   <body>
  35     <div class="header-wrapper">
  36         <div class="header">
  37
  38
  39             <h1><a href="../index.html">MIT Kerberos Documentation</a></h1>
  40
  41             <div class="rel">
  42
  43         <a href="../index.html" title="Full Table of Contents"
  44             accesskey="C">Contents</a> |
  45         <a href="host_config.html" title="Host configuration"
  46             accesskey="P">previous</a> |
  47         <a href="pkinit.html" title="PKINIT configuration"
  48             accesskey="N">next</a> |
  49         <a href="../genindex.html" title="General Index"
  50             accesskey="I">index</a> |
  51         <a href="../search.html" title="Enter search criteria"
  52             accesskey="S">Search</a> |
  53     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Backups of secure hosts">feedback</a>
  54             </div>
  55         </div>
  56     </div>
  57
  58     <div class="content-wrapper">
  59       <div class="content">
  60         <div class="document">
  61
  62       <div class="documentwrapper">
  63         <div class="bodywrapper">
  64           <div class="body">
  65
  66   <div class="section" id="backups-of-secure-hosts">
  67 <h1>Backups of secure hosts<a class="headerlink" href="#backups-of-secure-hosts" title="Permalink to this headline">¶</a></h1>
  68 <p>When you back up a secure host, you should exclude the host&#8217;s keytab
  69 file from the backup.  If someone obtained a copy of the keytab from a
  70 backup, that person could make any host masquerade as the host whose
  71 keytab was compromised.  In many configurations, knowledge of the
  72 host&#8217;s keytab also allows root access to the host.  This could be
  73 particularly dangerous if the compromised keytab was from one of your
  74 KDCs.  If the machine has a disk crash and the keytab file is lost, it
  75 is easy to generate another keytab file.  (See <a class="reference internal" href="appl_servers.html#add-princ-kt"><em>Adding principals to keytabs</em></a>.)
  76 If you are unable to exclude particular files from backups, you should
  77 ensure that the backups are kept as secure as the host&#8217;s root
  78 password.</p>
  79 <div class="section" id="backing-up-the-kerberos-database">
  80 <h2>Backing up the Kerberos database<a class="headerlink" href="#backing-up-the-kerberos-database" title="Permalink to this headline">¶</a></h2>
  81 <p>As with any file, it is possible that your Kerberos database could
  82 become corrupted.  If this happens on one of the slave KDCs, you might
  83 never notice, since the next automatic propagation of the database
  84 would install a fresh copy.  However, if it happens to the master KDC,
  85 the corrupted database would be propagated to all of the slaves during
  86 the next propagation.  For this reason, MIT recommends that you back
  87 up your Kerberos database regularly.  Because the master KDC is
  88 continuously dumping the database to a file in order to propagate it
  89 to the slave KDCs, it is a simple matter to have a cron job
  90 periodically copy the dump file to a secure machine elsewhere on your
  91 network.  (Of course, it is important to make the host where these
  92 backups are stored as secure as your KDCs, and to encrypt its
  93 transmission across your network.)  Then if your database becomes
  94 corrupted, you can load the most recent dump onto the master KDC.
  95 (See <a class="reference internal" href="database.html#restore-from-dump"><em>Restoring a Kerberos database from a dump file</em></a>.)</p>
  96 </div>
  97 </div>
  98
  99
 100           </div>
 101         </div>
 102       </div>
 103         </div>
 104         <div class="sidebar">
 105     <h2>On this page</h2>
 106     <ul>
 107 <li><a class="reference internal" href="#">Backups of secure hosts</a><ul>
 108 <li><a class="reference internal" href="#backing-up-the-kerberos-database">Backing up the Kerberos database</a></li>
 109 </ul>
 110 </li>
 111 </ul>
 112
 113     <br/>
 114     <h2>Table of contents</h2>
 115     <ul class="current">
 116 <li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li>
 117 <li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current">
 118 <li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li>
 119 <li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li>
 120 <li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li>
 121 <li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li>
 122 <li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li>
 123 <li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li>
 124 <li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li>
 125 <li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li>
 126 <li class="toctree-l2 current"><a class="current reference internal" href="">Backups of secure hosts</a><ul class="simple">
 127 </ul>
 128 </li>
 129 <li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li>
 130 <li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li>
 131 <li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li>
 132 <li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li>
 133 <li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li>
 134 <li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li>
 135 <li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration  programs</a></li>
 136 <li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li>
 137 <li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li>
 138 <li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li>
 139 <li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li>
 140 <li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li>
 141 </ul>
 142 </li>
 143 <li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li>
 144 <li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li>
 145 <li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li>
 146 <li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li>
 147 <li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li>
 148 <li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li>
 149 <li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li>
 150 <li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li>
 151 <li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li>
 152 </ul>
 153
 154     <br/>
 155     <h4><a href="../index.html">Full Table of Contents</a></h4>
 156     <h4>Search</h4>
 157     <form class="search" action="../search.html" method="get">
 158       <input type="text" name="q" size="18" />
 159       <input type="submit" value="Go" />
 160       <input type="hidden" name="check_keywords" value="yes" />
 161       <input type="hidden" name="area" value="default" />
 162     </form>
 163         </div>
 164         <div class="clearer"></div>
 165       </div>
 166     </div>
 167
 168     <div class="footer-wrapper">
 169         <div class="footer" >
 170             <div class="right" ><i>Release: 1.15.2</i><br />
 171                 &copy; <a href="../copyright.html">Copyright</a> 1985-2017, MIT.
 172             </div>
 173             <div class="left">
 174
 175         <a href="../index.html" title="Full Table of Contents"
 176             >Contents</a> |
 177         <a href="host_config.html" title="Host configuration"
 178             >previous</a> |
 179         <a href="pkinit.html" title="PKINIT configuration"
 180             >next</a> |
 181         <a href="../genindex.html" title="General Index"
 182             >index</a> |
 183         <a href="../search.html" title="Enter search criteria"
 184             >Search</a> |
 185     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Backups of secure hosts">feedback</a>
 186             </div>
 187         </div>
 188     </div>
 189
 190   </body>
 191 </html>