Re: [krbdev.mit.edu #8837] kprop replication does not work due to wrong DNS domain handling

<URL: https://krbdev.mit.edu/rt/Ticket/Display.html?id=8837 >

On 2019-10-03 17:56, Greg Hudson via RT wrote:
> Do you have a setting for dns_canonicalize_hostname in krb5.conf?


This is what I use, same on master and replica KDC:

~$ cat /etc/krb5.conf
[libdefaults]
    default_realm = EXAMPLE.COM
    forwardable = true
    proxiable = true

[realms]
    EXAMPLE.COM = {
        kdc = kdc10-1.example.com
        kdc = kdc10-2.example.com
        master_kdc = kdc10-1.example.com
        admin_server = kdc10-1.example.com
    }

[domain_realm]
    .example.com = EXAMPLE.COM
    example.com = EXAMPLE.COM


~$ sudo cat /etc/krb5kdc/kdc.conf
[kdcdefaults]

[realms]
    EXAMPLE.COM = {
        database_name = /var/lib/krb5kdc/principal
        admin_keytab = FILE:/etc/krb5kdc/kadm5.keytab
        acl_file = /etc/krb5kdc/kadm5.acl
        key_stash_file = /etc/krb5kdc/stash
        max_life = 10h 0m 0s
        max_renewable_life = 7d 0h 0m 0s
        master_key_type = des3-hmac-sha1
        default_principal_flags = +preauth
    }