IPROP(8)

💖 IPROP — bestie edition 💖

okay so this is iprop(8), and the whole squad here is iprop, ipropd-master, and ipropd-slave — together they propagate transactions from a Heimdal Kerberos master KDC to slave KDCs. no cap, that's literally the whole job. 💅

---

✨ SYNOPSIS ✨

ipropd-master [-c string | --config-file=string] [-r string |
              --realm=string] [-k kspec | --keytab=kspec] [-d file |
              --database=file] [--slave-stats-file=file]
              [--time-missing=time] [--time-gone=time] [--detach]
              [--version] [--help]
ipropd-slave [-c string | --config-file=string] [-r string |
              --realm=string] [-k kspec | --keytab=kspec]
              [--time-lost=time] [--detach] [--version] [--help] master

---

🌸 DESCRIPTION 🌸

ipropd-master is the one doing the ✨ sending ✨. it takes all the changes happening to a Heimdal Kerberos database and propagates them from the master Kerberos server it's running on, out to all the slave Kerberos servers that are running ipropd-slave. it's giving master-class main character energy, honestly.

So like, who are the slaves? they're defined by whatever's inside the slaves file in the KDC's database directory — think /var/heimdal/slaves. That file has principals, one per line, written like this:

iprop/slave@REALM

where slave is the hostname of the slave server inside that REALM. For example, bestie, literally this:

iprop/kerberos-1.example.com@EXAMPLE.COM

And on a slave? the argument master tells it the hostname of the master server it should be receiving updates from. simple as. 🦋

Now here's the tea ☕ — and this is the big difference from hprop(8): hprop(8) just ships the whole entire database over to the slaves on a regular schedule. iprop does NOT do that. iprop normally sends only the changes, as they happen on the master. so much chiller.

How does it keep track? The master gives every single transaction to the database a version number, and it keeps a log of all of them. The slaves know the latest version they've seen, so we can figure out whether they're in sync or not. And if a slave is sitting at an older version than the oldest one in the log?? welp. 😭 the whole database has to be sent. no way around it.

That transaction log is also doing some serious heavy lifting: it implements a two-phase commit method (with roll-forward for recovery ✨) of updating the HDB. The order is iconic and non-negotiable:

1. transactions get recorded in the log first,
2. then in the HDB,
3. then the log gets updated to mark the transaction as committed.

All these changes travel over a secure channel, on port 2121 by default. Normally you'd define that as "iprop/tcp" in /etc/services or wherever else your services database lives. And the master and every slave each need access to a keytab holding the keys for the iprop service principal on the local host. 🔑

There's also a keep-alive feature, and it gets logged in the master's slave-stats file (like /var/heimdal/slave-stats).

---

👑 Supported options for ipropd-master:

• -c string, --config-file=string — config file time. (no extra notes, it's just that)
• -r string, --realm=string — realm time. (same deal)
• -k kspec, --keytab=kspec — keytab to get authentication from 🔐
• -d file, --database=file — Database (default per KDC)
• --slave-stats-file=file — file for slave status information 📊
• --time-missing=time — time before slave is polled for presence (default 2 min)
• --time-gone=time — time of inactivity after which a slave is considered gone (default 5 min) 💀
• --detach — detach from console
• --version
• --help

---

🧚 Supported options for ipropd-slave:

• -c string, --config-file=string — config file, again
• -r string, --realm=string — realm, again
• -k kspec, --keytab=kspec — keytab to get authentication from 🔐
• --time-lost=time — time before server is considered lost (default 5 min) 😭
• --detach — detach from console
• --version
• --help

oh and btw, time arguments for any of those time options up there? they can be written like 5 min, or 300 s, or just a plain number of seconds. ur welcome 🫶

---

🎀 FILES 🎀

• slaves, slave-stats — in the database directory 📁
• ipropd-master.pid, ipropd-slave.pid — in the database directory, or in the directory named by the HEIM_PIDFILE_DIR environment variable

---

💜 SEE ALSO 💜

krb5.conf(5), hprop(8), hpropd(8), iprop-log(8), kdc(8).

---

and that's the whole page, bestie 💅 this one came from the Debian crew and it's dated May 24, 2005 — vintage, honestly, but it still ate. mwah 🎀💖✨