1*ebfedea0SLionel Sambuc@c Id 2*ebfedea0SLionel Sambuc@c $NetBSD: migration.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $ 3*ebfedea0SLionel Sambuc 4*ebfedea0SLionel Sambuc@node Migration, Acknowledgments, Programming with Kerberos, Top 5*ebfedea0SLionel Sambuc@chapter Migration 6*ebfedea0SLionel Sambuc 7*ebfedea0SLionel Sambuc@section Migration from MIT Kerberos to Heimdal 8*ebfedea0SLionel Sambuc 9*ebfedea0SLionel Sambuchpropd can read MIT Kerberos dump, the format is the same as used in 10*ebfedea0SLionel Sambucmit-kerberos 1.0b7, and to dump that format use the following command: 11*ebfedea0SLionel Sambuc@samp{kdb5_util dump -b7}. 12*ebfedea0SLionel Sambuc 13*ebfedea0SLionel SambucTo load the MIT Kerberos dump file, use the following command: 14*ebfedea0SLionel Sambuc 15*ebfedea0SLionel Sambuc@samp{/usr/heimdal/libexec/hprop --database=dump-file --master-key=/var/db/krb5kdc/mit_stash --source=mit-dump --decrypt --stdout | /usr/heimdal/libexec/hpropd --stdin} 16*ebfedea0SLionel Sambuc 17*ebfedea0SLionel Sambuc@section General issues 18*ebfedea0SLionel Sambuc 19*ebfedea0SLionel SambucWhen migrating from a Kerberos 4 KDC. 20*ebfedea0SLionel Sambuc 21*ebfedea0SLionel Sambuc@section Order in what to do things: 22*ebfedea0SLionel Sambuc 23*ebfedea0SLionel Sambuc@itemize @bullet 24*ebfedea0SLionel Sambuc 25*ebfedea0SLionel Sambuc@item Convert the database, check all principals that hprop complains 26*ebfedea0SLionel Sambucabout. 27*ebfedea0SLionel Sambuc 28*ebfedea0SLionel Sambuc@samp{hprop -n --source=<NNN>| hpropd -n} 29*ebfedea0SLionel Sambuc 30*ebfedea0SLionel SambucReplace <NNN> with whatever source you have, like krb4-db or krb4-dump. 31*ebfedea0SLionel Sambuc 32*ebfedea0SLionel Sambuc@item Run a Kerberos 5 slave for a while. 33*ebfedea0SLionel Sambuc 34*ebfedea0SLionel Sambuc@c XXX Add you slave first to your kdc list in you kdc. 35*ebfedea0SLionel Sambuc 36*ebfedea0SLionel Sambuc@item Figure out if it does everything you want it to. 37*ebfedea0SLionel Sambuc 38*ebfedea0SLionel SambucMake sure that all things that you use works for you. 39*ebfedea0SLionel Sambuc 40*ebfedea0SLionel Sambuc@item Let a small number of controlled users use Kerberos 5 tools. 41*ebfedea0SLionel Sambuc 42*ebfedea0SLionel SambucFind a sample population of your users and check what programs they use, 43*ebfedea0SLionel Sambucyou can also check the kdc-log to check what ticket are checked out. 44*ebfedea0SLionel Sambuc 45*ebfedea0SLionel Sambuc@item Burn the bridge and change the master. 46*ebfedea0SLionel Sambuc@item Let all users use the Kerberos 5 tools by default. 47*ebfedea0SLionel Sambuc@item Turn off services that do not need Kerberos 4 authentication. 48*ebfedea0SLionel Sambuc 49*ebfedea0SLionel SambucThings that might be hard to get away is old programs with support for 50*ebfedea0SLionel SambucKerberos 4. Example applications are old Eudora installations using 51*ebfedea0SLionel SambucKPOP, and Zephyr. Eudora can use the Kerberos 4 kerberos in the Heimdal 52*ebfedea0SLionel Sambuckdc. 53*ebfedea0SLionel Sambuc 54*ebfedea0SLionel Sambuc@end itemize 55