doc/html/basic/stash_file_def.html

   1
   2 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
   3   "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
   4
   5 <html xmlns="http://www.w3.org/1999/xhtml">
   6   <head>
   7     <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
   8     <title>stash file &#8212; MIT Kerberos Documentation</title>
   9     <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />
  10     <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
  11     <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />
  12     <script type="text/javascript">
  13       var DOCUMENTATION_OPTIONS = {
  14         URL_ROOT:    '../',
  15         VERSION:     '1.20.1',
  16         COLLAPSE_INDEX: false,
  17         FILE_SUFFIX: '.html',
  18         HAS_SOURCE:  true,
  19         SOURCELINK_SUFFIX: '.txt'
  20       };
  21     </script>
  22     <script type="text/javascript" src="../_static/jquery.js"></script>
  23     <script type="text/javascript" src="../_static/underscore.js"></script>
  24     <script type="text/javascript" src="../_static/doctools.js"></script>
  25     <link rel="author" title="About these documents" href="../about.html" />
  26     <link rel="index" title="Index" href="../genindex.html" />
  27     <link rel="search" title="Search" href="../search.html" />
  28     <link rel="copyright" title="Copyright" href="../copyright.html" />
  29     <link rel="next" title="Supported date and time formats" href="date_format.html" />
  30     <link rel="prev" title="replay cache" href="rcache_def.html" />
  31   </head>
  32   <body>
  33     <div class="header-wrapper">
  34         <div class="header">
  35
  36
  37             <h1><a href="../index.html">MIT Kerberos Documentation</a></h1>
  38
  39             <div class="rel">
  40
  41         <a href="../index.html" title="Full Table of Contents"
  42             accesskey="C">Contents</a> |
  43         <a href="rcache_def.html" title="replay cache"
  44             accesskey="P">previous</a> |
  45         <a href="date_format.html" title="Supported date and time formats"
  46             accesskey="N">next</a> |
  47         <a href="../genindex.html" title="General Index"
  48             accesskey="I">index</a> |
  49         <a href="../search.html" title="Enter search criteria"
  50             accesskey="S">Search</a> |
  51     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__stash file">feedback</a>
  52             </div>
  53         </div>
  54     </div>
  55
  56     <div class="content-wrapper">
  57       <div class="content">
  58         <div class="document">
  59
  60       <div class="documentwrapper">
  61         <div class="bodywrapper">
  62           <div class="body" role="main">
  63
  64   <div class="section" id="stash-file">
  65 <span id="stash-definition"></span><h1>stash file<a class="headerlink" href="#stash-file" title="Permalink to this headline">¶</a></h1>
  66 <p>The stash file is a local copy of the master key that resides in
  67 encrypted form on the KDC’s local disk.  The stash file is used to
  68 authenticate the KDC to itself automatically before starting the
  69 <a class="reference internal" href="../admin/admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a> and <a class="reference internal" href="../admin/admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a> daemons (e.g., as part of the
  70 machine’s boot sequence).  The stash file, like the keytab file (see
  71 <a class="reference internal" href="../admin/install_appl_srv.html#keytab-file"><span class="std std-ref">The keytab file</span></a>) is a potential point-of-entry for a break-in, and
  72 if compromised, would allow unrestricted access to the Kerberos
  73 database.  If you choose to install a stash file, it should be
  74 readable only by root, and should exist only on the KDC’s local disk.
  75 The file should not be part of any backup of the machine, unless
  76 access to the backup data is secured as tightly as access to the
  77 master password itself.</p>
  78 <div class="admonition note">
  79 <p class="first admonition-title">Note</p>
  80 <p class="last">If you choose not to install a stash file, the KDC will prompt you for the master key each time it starts up.
  81 This means that the KDC will not be able to start automatically, such as after a system reboot.</p>
  82 </div>
  83 </div>
  84
  85
  86           </div>
  87         </div>
  88       </div>
  89         </div>
  90         <div class="sidebar">
  91     <h2>On this page</h2>
  92     <ul>
  93 <li><a class="reference internal" href="#">stash file</a></li>
  94 </ul>
  95
  96     <br/>
  97     <h2>Table of contents</h2>
  98     <ul class="current">
  99 <li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li>
 100 <li class="toctree-l1"><a class="reference internal" href="../admin/index.html">For administrators</a></li>
 101 <li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li>
 102 <li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li>
 103 <li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li>
 104 <li class="toctree-l1 current"><a class="reference internal" href="index.html">Kerberos V5 concepts</a><ul class="current">
 105 <li class="toctree-l2"><a class="reference internal" href="ccache_def.html">Credential cache</a></li>
 106 <li class="toctree-l2"><a class="reference internal" href="keytab_def.html">keytab</a></li>
 107 <li class="toctree-l2"><a class="reference internal" href="rcache_def.html">replay cache</a></li>
 108 <li class="toctree-l2 current"><a class="current reference internal" href="#">stash file</a></li>
 109 <li class="toctree-l2"><a class="reference internal" href="date_format.html">Supported date and time formats</a></li>
 110 </ul>
 111 </li>
 112 <li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li>
 113 <li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li>
 114 <li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li>
 115 <li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li>
 116 <li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li>
 117 </ul>
 118
 119     <br/>
 120     <h4><a href="../index.html">Full Table of Contents</a></h4>
 121     <h4>Search</h4>
 122     <form class="search" action="../search.html" method="get">
 123       <input type="text" name="q" size="18" />
 124       <input type="submit" value="Go" />
 125       <input type="hidden" name="check_keywords" value="yes" />
 126       <input type="hidden" name="area" value="default" />
 127     </form>
 128         </div>
 129         <div class="clearer"></div>
 130       </div>
 131     </div>
 132
 133     <div class="footer-wrapper">
 134         <div class="footer" >
 135             <div class="right" ><i>Release: 1.20.1</i><br />
 136                 &copy; <a href="../copyright.html">Copyright</a> 1985-2022, MIT.
 137             </div>
 138             <div class="left">
 139
 140         <a href="../index.html" title="Full Table of Contents"
 141             >Contents</a> |
 142         <a href="rcache_def.html" title="replay cache"
 143             >previous</a> |
 144         <a href="date_format.html" title="Supported date and time formats"
 145             >next</a> |
 146         <a href="../genindex.html" title="General Index"
 147             >index</a> |
 148         <a href="../search.html" title="Enter search criteria"
 149             >Search</a> |
 150     <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__stash file">feedback</a>
 151             </div>
 152         </div>
 153     </div>
 154
 155   </body>
 156 </html>