1@c Id 2@c $NetBSD: migration.texi,v 1.1.1.2 2011/04/14 14:08:08 elric Exp $ 3 4@node Migration, Acknowledgments, Programming with Kerberos, Top 5@chapter Migration 6 7@section Migration from MIT Kerberos to Heimdal 8 9hpropd can read MIT Kerberos dump, the format is the same as used in 10mit-kerberos 1.0b7, and to dump that format use the following command: 11@samp{kdb5_util dump -b7}. 12 13To load the MIT Kerberos dump file, use the following command: 14 15@samp{/usr/heimdal/libexec/hprop --database=dump-file --master-key=/var/db/krb5kdc/mit_stash --source=mit-dump --decrypt --stdout | /usr/heimdal/libexec/hpropd --stdin} 16 17@section General issues 18 19When migrating from a Kerberos 4 KDC. 20 21@section Order in what to do things: 22 23@itemize @bullet 24 25@item Convert the database, check all principals that hprop complains 26about. 27 28@samp{hprop -n --source=<NNN>| hpropd -n} 29 30Replace <NNN> with whatever source you have, like krb4-db or krb4-dump. 31 32@item Run a Kerberos 5 slave for a while. 33 34@c XXX Add you slave first to your kdc list in you kdc. 35 36@item Figure out if it does everything you want it to. 37 38Make sure that all things that you use works for you. 39 40@item Let a small number of controlled users use Kerberos 5 tools. 41 42Find a sample population of your users and check what programs they use, 43you can also check the kdc-log to check what ticket are checked out. 44 45@item Burn the bridge and change the master. 46@item Let all users use the Kerberos 5 tools by default. 47@item Turn off services that do not need Kerberos 4 authentication. 48 49Things that might be hard to get away is old programs with support for 50Kerberos 4. Example applications are old Eudora installations using 51KPOP, and Zephyr. Eudora can use the Kerberos 4 kerberos in the Heimdal 52kdc. 53 54@end itemize 55