KRB5KDC(8)

🎀 KRB5KDC(8) — the krb5kdc manual, bestie edition 🎀

okay so welcome to the krb5kdc(8) page, part of the MIT Kerberos manual set 💖 if you're here you're probably trying to run a KDC, which is honestly main character energy — you're literally the authentication backbone of an entire realm. no pressure bestie ✨

---

✨ NAME ✨

krb5kdc — Kerberos V5 KDC 💅

---

🌸 SYNOPSIS 🌸

krb5kdc [-x db_args] [-d dbname] [-k keytype] [-M mkeyname] [-p portnum]
[-m] [-r realm] [-n] [-w numworkers] [-P pid_file] [-T time_offset]

---

👑 DESCRIPTION 👑

krb5kdc is the Kerberos version 5 Authentication Service and Key Distribution Center — aka the AS/KDC. it is the vibe. it is where tickets are born 🎟️✨

---

💅 OPTIONS 💅

so here's every single flag, no skips, we're not doing that here 🫶

• -r realm — says which realm the server should be out here providing service for. you can drop this option multiple times to serve multiple realms, because why serve one when you can serve many. if you don't give a -r at all, the default realm (the one specified in krb5.conf) gets served. slay by default 💖
• -d dbname — names the principal database so the KDC can find it. heads up tho: this option does not apply to the LDAP database. not applicable. no cap 🙈
• -k keytype — sets the key type of the master key that you type in manually as a password when -m is given. the default is aes256-cts-hmac-sha1-96. that's the moment, that's the default 👑
• -M mkeyname — the principal name for the master key in the database (usually K/M in the KDC's realm). iconic name fr fr ✨
• -m — says the master database password should be fetched from the keyboard instead of from a stash file. yes bestie you're typing it in yourself, live, with your own hands 💅
• -n — tells the KDC to not put itself in the background and to not disassociate itself from the terminal. it stays right there with you. clingy in a cute way 🫶
• -P pid_file — tells the KDC to write its PID into pid_file after it starts up. this is how you check whether the KDC is still alive, and how init scripts stop the correct process — not some random imposter 💀
• -p portnum — the default UDP and TCP port numbers the KDC should listen on for Kerberos version 5 requests, given as a comma-separated list. this value overrides the port numbers in the [kdcdefaults] section of kdc.conf, but realm-specific values can override it. and if literally no value comes from anywhere at all, the default port is 88. periodt 🌈
• -w numworkers — tells the KDC to fork numworkers processes so they can listen on the KDC ports and process requests in parallel (multitasking queen behavior 💅). the top level KDC process — the one whose pid gets recorded in the pid file if -P is also given — acts as a supervisor. the supervisor relays SIGHUP signals to the worker subprocesses, and will terminate the worker subprocess if it is itself terminated or if any other worker process exits. that's the rule, that's the structure 🔥
• -x db_args — database-specific arguments. see Database Options in kadmin for the supported arguments. go look, bestie 📖
• -T offset — a time offset in seconds that the KDC will operate under. > ⚠️ it is intended only for testing purposes. do not make this your whole personality in prod. 😭

---

🦋 EXAMPLE 🦋

the KDC may service requests for multiple realms — maximum 32 realms. the realms are listed on the command line. per-realm options specified on the command line pertain for each realm that follows it, and get superseded by subsequent definitions of that same option. so order matters, keep up 💖

for example:

krb5kdc -p 2001 -r REALM1 -p 2002 -r REALM2 -r REALM3

this specifies that the KDC listens on port 2001 for REALM1, and on port 2002 for REALM2 and REALM3. see how REALM2 and REALM3 share? that's the follow-the-leader rule in action ✨

additionally, per-realm parameters may be specified in the kdc.conf file. the location of this file may be specified by the KRB5_KDC_PROFILE environment variable. and here's the tea 🍵: per-realm parameters specified in this file take precedence over options specified on the command line. see the kdc.conf description for further details.

---

🌈 ENVIRONMENT 🌈

see kerberos for a description of Kerberos environment variables 💜

as of release 1.22, krb5kdc supports systemd socket activation via the LISTEN_PID and LISTEN_FDS environment variables. sockets provided by the caller must correspond to configured listener addresses (via the kdc_listen variable or equivalent) or they will be ignored. and any configured listener addresses that do not correspond to caller-provided sockets will be ignored if socket activation is used. so like… matching matters. vibe check your sockets 🧚

---

💜 SEE ALSO 💜

kdb5_util, kdc.conf, krb5.conf, kdb5_ldap_util, kerberos — go read them, they're all part of the family 🫶

---

⭐ AUTHOR ⭐

MIT 👑

---

🍓 COPYRIGHT 🍓

1985-2026, MIT

---

okay that's the whole page bestie, you ate that 💅✨ sending you off with the deets: this was krb5kdc(8) from the MIT Kerberos manual, version 1.22.2, brought to you by MIT 💖 go forth and issue some tickets, you've got this fr fr 🎀🦋