Migration

hpropd can read from a MIT Kerberos dump, the format is the same as used in mit-kerberos 1.0b7. To dump in this format use the following command:

kdb5_util dump -b7

To load the MIT Kerberos dump file, use the following command:

/usr/heimdal/libexec/hprop \
		--database=dump-file \
		--master-key=/var/db/krb5kdc/mit_stash \
		--source=mit-dump \
		--decrypt --stdout | \
	/usr/heimdal/libexec/hpropd --stdin

Process Order for the migration:

1. Convert the database, check all principals that hprop complains about.

   hprop -n --source=<NNN> | hpropd -n

   Replace <NNN> with whatever source you have such askrb4-db or krb4-dump.
2. Run a Kerberos 5 slave for a while.
3. Figure out if it does everything you want it to. Make sure that all things that you use work for you.
4. Let a small number of controlled users use Kerberos 5 tools. Find a sample population of your users and check what programs they use, you can also check the kdc-log to check what and which kinds of tickets are checked out.
5. Burn the bridge and change the master.
6. Let all users use the Kerberos 5 tools by default.
7. Turn off services that do not need Kerberos 4 authentication.

Things that may be hard to get away with are old programs with support for Kerberos 4. For example old Eudora installations using KPOP, and Zephyr. Eudora can use the Kerberos 4 kerberos in the Heimdal KDC.

Please see also Kerberos 4 issues.