Kerberos is used by the Club to authenticate users across various club machines.
KDCs
In order to provide maximum availability, the Club operates several redundant Key Distribution Centers:
Generally, when performing maintenance on the Kerberos infrastructure, you should update each of these machines in series. This way, if something goes wrong, the other machines can continue to service our users.
Account Management Tasks
There are several tasks which are commonly performed to manage Club accounts:
Binary Log Explosion
Sometimes the KDCs will suddenly fill up all of their disk with /var/lib/heimdal-kdc/log. Predictably, this causes Kerberos to go haywire. This is how to fix it:
On slave KDCs: stop the KDC and kill ipropd-slave.
On the master KDC: kill ipropd-master.
- Remove the logs and rename the old databases on the slave KDCs:
rm /var/heimdal/log mv /var/heimdal/heimdal.db /tmp
Restart ipropd-master on the master KDC.
Restart ipropd-slave on the slave KDCs.
Wait for ipropd to sychronize. On the master KDC the file /var/heimdal/slave-stats will show when the slaves have synced.
- Restart the slave KDCs.
Notice that it is not necessary to stop or restart the master KDC. This should permit other users to log in to club services normally while you are fixing the problem.