You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
14 KiB
14 KiB
*****************************************************************************
*****************************************************************************
Kerberos Configuration Keys
*****************************************************************************
*****************************************************************************
Registry entries that Kerberos is interested in:
The following are in HKLM\System\CurrentControlSet\Control\Lsa\Kerberos\Parameters
At boot, these registry entries are read and stored in globals. They are also
runtime configurable.
=============================================================================
Value "SkewTime" , Type REG_DWORD
Whatever it's set to will be the Skew time in minutes, default is KERB_DEFAULT_SKEWTIME minutes
#define KERB_DEFAULT_SKEWTIME 5
EXTERN TimeStamp KerbGlobalSkewTime;
This is the time difference that's tolerated between one machine and the
machine that you are trying to authenticate (dc/another wksta etc).
Units are in 10 ** 7 seconds. If this is a checked build, default in 2 hours.
=============================================================================
Value "LogLevel", Type REG_DWORD
If it's set to anything non-zero, all Kerberos errors will be logged in the
system event log. Default is KERB_DEFAULT_LOGLEVEL
#define KERB_DEFAULT_LOGLEVEL 0
KerbGlobalLoggingLevel saves this value.
=============================================================================
Value "MaxPacketSize" Type REG_DWORD
Whatever this is set to will be max size that we'll try udp with. If the
packet size is bigger than this value, we'll do tcp. Default is
KERB_MAX_DATAGRAM_SIZE bytes
#define KERB_MAX_DATAGRAM_SIZE 1500
KerbGlobalMaxDatagramSiz saves this value
=============================================================================
Value "StartupTime" Type REG_DWORD
In seconds. Wait for the specified number of seconds for the KDC to start
before giving up. Default is KERB_KDC_WAIT_TIME seconds.
#define KERB_KDC_WAIT_TIME 120
KerbGlobalKdcWaitTime saves this value.
=============================================================================
Value "KdcWaitTime" Type REG_DWORD
In seconds. Value passed to winsock as timeout for selecting a response from
a KDC. Default is KerbGlobalKdcCallTimeout seconds.
#define KERB_KDC_CALL_TIMEOUT 10
KerbGlobalKdcCallTimeout saves this value
=============================================================================
Value "KdcBackoffTime" Type REG_DWORD
In seconds. Value that is added to KerbGlobalKdcCallTimeout each successive
call to a KDC in case of a retry. Default is KERB_KDC_CALL_TIMEOUT_BACKOFF
seconds.
#define KERB_KDC_CALL_TIMEOUT_BACKOFF 10
KerbGlobalKdcCallBackoff saves this value.
=============================================================================
Value "KdcSendRetries" Type REG_DWORD
The number of retry attempts a client will make in order to contact a KDC.
Default is KERB_MAX_RETRIES
#define KERB_MAX_RETRIES 3
KerbGlobalKdcSendRetries saves this value
=============================================================================
Value "DefaultEncryptionType" Type REG_DWORD
The default encryption type for PreAuth. As of beta3, this was
KERB_ETYPE_RC4_HMAC_OLD
#ifndef DONT_SUPPORT_OLD_TYPES
KerbGlobalDefaultPreauthEtype = KERB_ETYPE_RC4_HMAC_OLD;
#else
KerbGlobalDefaultPreauthEtype = KERB_ETYPE_RC4_HMAC_NT;
#endif
KerbGlobalDefaultPreauthEtype saves this value
=============================================================================
Value "FarKdcTimeout" Type REG_DWORD
Time in minutes. This timeout is used to invalidate a dc that is in the dc
cache for the Kerberos clients for dc's that are not in the same site as the
client. Default is KERB_BINDING_FAR_DC_TIMEOUT minutes.
#define KERB_BINDING_FAR_DC_TIMEOUT 10
KerbGlobalFarKdcTimeout saves this value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "NearKdcTimeout" Type REG_DWORD
Time in minutes. This timeout is used to invalidate a dc that is in the dc
cache for the Kerberos clients for dcs in the same site as the
client. Default is KERB_BINDING_NEAR_DC_TIMEOUT minutes.
#define KERB_BINDING_NEAR_DC_TIMEOUT 30
KerbGlobalNearKdcTimeout saves this value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "StronglyEncryptDatagram" Type REG_BOOL
Flag decides whether we do 128 bit encryption for datagram. Default is
KERB_DEFAULT_USE_STRONG_ENC_DG
#define KERB_DEFAULT_USE_STRONG_ENC_DG FALSE
KerbGlobalUseStrongEncryptionForDatagram saves this value.
=============================================================================
Value "MaxReferralCount" type REG_DWORD
Is count of how many KDC referrals client will follow before giving up.
Default is KERB_MAX_REFERRAL_COUNT = 6
KerbGlobalMaxReferralCount saves this value
=============================================================================
Value "KerbDebugLevel" type REG_DWORD
Debug log levels used in DebugLog() macro. Default is DEB_ERROR for CHK builds
and 0 (no logging) for FRE builds. Possible values include:
#define DEB_ERROR 0x00000001
#define DEB_WARN 0x00000002
#define DEB_TRACE 0x00000004
#define DEB_TRACE_API 0x00000008
#define DEB_TRACE_CRED 0x00000010
#define DEB_TRACE_CTXT 0x00000020
#define DEB_TRACE_LSESS 0x00000040
#define DEB_TRACE_TCACHE 0x00000080
#define DEB_TRACE_LOGON 0x00000100
#define DEB_TRACE_KDC 0x00000200
#define DEB_TRACE_CTXT2 0x00000400
#define DEB_TRACE_TIME 0x00000800
#define DEB_TRACE_USER 0x00001000
#define DEB_TRACE_LEAKS 0x00002000
#define DEB_TRACE_SOCK 0x00004000
#define DEB_TRACE_SPN_CACHE 0x00008000
#define DEB_S4U_ERROR 0x00010000
#define DEB_TRACE_S4U 0x00020000
#define DEB_TRACE_BND_CACHE 0x00040000
#define DEB_TRACE_LOOPBACK 0x00080000
#define DEB_TRACE_TKT_RENEWAL 0x00100000
#define DEB_TRACE_U2U 0x00200000
#define DEB_TRACE_LOCKS 0x01000000
#define DEB_USE_LOG_FILE 0x02000000
These values are stored in KerbInfoLevel and KSuppInfoLevel (for common2 routines).
=============================================================================
Value "MaxTokenSize" type REG_DWORD
This sets the QCA value for maximum token size, and is used to allow QCA to
be modified to return a value large enough for tickets containing large numbers
of groups. It is recommended that this value remain less than 50k.
Default #define KERBEROS_MAX_TOKEN 12000
KerbGlobalMaxTokenSize stores this value.
=============================================================================
Value "SpnCacheTimeout" type REG_DWORD
Time in minutes. This timeout is used to determine the lifetime of the SPN cache
entries. Default is 15 minutes. On domain controllers, the default is to not cache SPNs.
Default is #define KERB_SPN_CACHE_TIMEOUT 15
KerbGlobalSpnCacheTimeout stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "S4UCacheTimeout" type REG_DWORD
Time in minutes. This timeout is used to determine the lifetime of the S4U negative cache
entries, which are used to restrict how many S4UProxy requests hit the wire from a given
machine.
Default is #define KERB_S4U_CACHE_TIMEOUT 15
KerbGlobalS4UCacheTimeout stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "S4UTicketLifetime" type REG_DWORD
Time in minutes. This timeout is used to determine the lifetime of tickets obtained by S4U
proxy requests.
Default is #define KERB_S4U_TICKET_LIFETIME 15
KerbGlobalS4UTicketLifetime stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "RetryPdc" type REG_DWORD
0 or non-zero (FALSE, or TRUE). Determines if we'll attempt to contact the PDC
for password expired errors for AS_REQ.
Default is FALSE.
KerbGlobalRetryPdcstores value as a BOOLEAN
=============================================================================
Value "RequestOptions" type REG_DWORD
Determines if there are additional options that need to be emitted as KdcOptions
in TGS_REQ. Meant for future modifications of kdc options, and can be any
RFC1510 value.
Default is :
#define KERB_ADDITIONAL_KDC_OPTIONS (KERB_KDC_OPTIONS_name_canonicalize)
KerbGlobalKdcOptions stored as a ULONG.
=============================================================================
Value "ClientIpAddresses" type REG_DWORD
0 or non-zero (FALSE, or TRUE). Determines if we'll add in IP addresses in
AS_REQ, thus forcing the caddr field to contain IP addresses in all tickets.
Default is FALSE, due to DHCP / NAT issues.
#define KERB_DEFAULT_CLIENT_IP_ADDRESSES 0
KerbGlobalUseClientIpAddresses value as a BOOLEAN
=============================================================================
Value "TgtRenewalTime" type REG_DWORD
Time in seconds. Determines amount of time before a TGT expires when
kerberos will attempt to renew the ticket. Only applies to initial TGTs.
Default is #define KERB_DEFAULT_TGT_RENEWAL_TIME 600
KerbGlobalTgtRenewalTime stores value as a TimeStamp ( 10000000 * 60 * number of minutes).
=============================================================================
Value "AllowTgtSessionKey" type REG_DWORD
0 or non-zero (FALSE, or TRUE). Determines if we'll allow session keys to
be exported with initial, or cross realm TGTs.
Default is FALSE, due to security concerns.
KerbGlobalAllowTgtSessionKey stores value as a BOOLEAN
=============================================================================
*****************************************************************************
*****************************************************************************
KDC Configuration Keys
*****************************************************************************
*****************************************************************************
The following keys apply to the KDC only, and are located at:
HKLM\System\CurrentControlSet\Services\Kdc. The are runtime configurable.
=============================================================================
Value "KdcUseClientAddresses" type REG_DWORD
0 or non-zero (FALSE, or TRUE). Determines if we'll add in IP addresses in
TGS_REP.
Default is FALSE, due to DHCP / NAT issues.
KdcUseClientAddresses stores value as a BOOLEAN.
=============================================================================
Value "KdcDontCheckAddresses" type REG_DWORD
0 or non-zero (FALSE, or TRUE). Determines if we'll check IP addresses for
TGS_REQ vs. what's in the TGT caddr field.
Default is TRUE, meaning we won't check IP addresses, due to DHCP and NAT issues.
KdcDontCheckAddresses stores value as a BOOLEAN.
=============================================================================
Value "NewConnectionTimeout" type REG_DWORD
Time in seconds. Determines how long after an initial TCP endpoint connection
that we'll keep listening for data before disconnecting.
Default is 50 seconds.
KdcExistingConnectionTimeout stores value as a ULONG.
=============================================================================
Value "MaxDatagramReplySize" type REG_DWORD
Size in bytes. Determines the upper threshold of UDP packet size in TGS_REP
and AS_REP, before the KDC will return a KRB_ERR_RESPONSE_TOO_BIG requiring
the client to switch to TCP.
Default is #define KERB_MAX_DATAGRAM_REPLY_SIZE 4000
KdcGlobalMaxDatagramReplySize stores value as a ULONG.
=============================================================================
Value "KdcExtraLogLevel" type REG_DWORD
ULONG flag used to determine extra KDC logging in event logs and audits.
Values are:
#define LOG_SPN_UNKNOWN 0x1 - audit SPN unknown errors
#define LOG_PKI_ERRORS 0x2 - log detailed PKINIT errors
#define LOG_ALL_KLIN 0x4 - log all KDC errors with KLIN information.
Default is #define LOG_DEFAULT LOG_PKI_ERRORS
KdcExtraLogLevel stores value as a ULONG.
=============================================================================
Value "KdcDebugLevel" type REG_DWORD
ULONG flag used to determine level of debug spew in DebugLog() macros. Available
in both FRE and CHK builds.
Values are:
#define DEB_ERROR 0x00000001
#define DEB_WARN 0x00000002
#define DEB_TRACE 0x00000004
#define DEB_TRACE_API 0x00000008
#define DEB_TRACE_CRED 0x00000010
#define DEB_TRACE_CTXT 0x00000020
#define DEB_TRACE_LSESS 0x00000040
#define DEB_TRACE_TCACHE 0x00000080
#define DEB_TRACE_LOGON 0x00000100
#define DEB_TRACE_KDC 0x00000200
#define DEB_TRACE_CTXT2 0x00000400
#define DEB_TRACE_TIME 0x00000800
#define DEB_TRACE_USER 0x00001000
#define DEB_TRACE_LEAKS 0x00002000
#define DEB_TRACE_SOCK 0x00004000
#define DEB_TRACE_SPN_CACHE 0x00008000
#define DEB_S4U_ERROR 0x00010000
#define DEB_TRACE_S4U 0x00020000
#define DEB_TRACE_BND_CACHE 0x00040000
#define DEB_TRACE_LOOPBACK 0x00080000
#define DEB_TRACE_TKT_RENEWAL 0x00100000
#define DEB_TRACE_U2U 0x00200000
#define DEB_TRACE_LOCKS 0x01000000
#define DEB_USE_LOG_FILE 0x02000000
Default is DEB_ERROR for CHK builds, and 0 (no logging) for FRE builds.
Additionally, the value:
#define DEB_USE_EXT_ERRORS 0x10000000
will cause the klin macros and extended information to be returned in the
edata field of KERB_ERRORS as PKERB_EXT_ERROR.
KdcInfoLevel and KSuppinfolevel stores value as a ULONG. KSuppInfolevel
determines logging for common2 library.
=============================================================================