krb5kdc(8) on Solnix vs Linux and the BSDs
On Solnix, krb5kdc is the illumos KDC daemon at /usr/lib/krb5/krb5kdc, not on PATH. It has no -w, -P or -T, and its documented defaults differ from FreeBSD's: database path /var/krb5 and master key type des-cbc-crc.
The manual pages
- Solnix: krb5kdc(8) from
pkgs.solnix.illumos-world-man· illumos.org - FreeBSD: krb5kdc(8) 15.1-RELEASE
What Solnix runs
A default Solnix system runs the illumos krb5kdc, installed as /usr/lib/krb5/krb5kdc. That directory is not /usr/bin, /usr/sbin or /sbin, so call it by full path. The page ships in pkgs.solnix.illumos-world-man. No other variants are shipped. The bundle contains no Linux or OpenBSD/NetBSD counterpart pages.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| FreeBSD | default master key type (-k) | Solnix -k defaults to des-cbc-crc. The listed alternatives are des3-cbc-sha1, arcfour-hmac-md5, arcfour-hmac-md5-exp, aes128-cts-hmac-sha1-96 and aes256-cts-hmac-sha1-96. FreeBSD -k defaults to aes256-cts-hmac-sha1-96.Source: Solnix krb5kdc(8) -k; FreeBSD krb5kdc(8) -k keytype |
| FreeBSD | -d argument and default | Solnix -d takes a database path and defaults to /var/krb5. FreeBSD -d takes a database name and does not apply to the LDAP database. The FreeBSD page gives no default.Source: Solnix krb5kdc(8) -d dbpath; FreeBSD krb5kdc(8) -d dbname |
| FreeBSD | worker processes (-w) | FreeBSD -w numworkers forks worker processes with a supervisor that relays SIGHUP. The Solnix page has no -w, so the manual documents no multi-process mode.Source: FreeBSD krb5kdc(8) -w; Solnix krb5kdc(8) SYNOPSIS |
| FreeBSD | PID file (-P) | FreeBSD -P pid_file writes the KDC's PID to a file for init scripts. The Solnix page has no -P and describes no PID file.Source: FreeBSD krb5kdc(8) -P; Solnix krb5kdc(8) OPTIONS |
| FreeBSD | time offset (-T) | FreeBSD has -T offset, a time offset in seconds intended only for testing. Solnix has no -T.Source: FreeBSD krb5kdc(8) -T; Solnix krb5kdc(8) SYNOPSIS |
| FreeBSD | multiple realms (-r) | FreeBSD -r may be given several times to serve multiple realms. The Solnix page describes -r as one realm name, defaulting to the local realm, and does not say it can be repeated.Source: FreeBSD krb5kdc(8) -r realm; Solnix krb5kdc(8) -r realm |
| FreeBSD | port option (-p) | FreeBSD -p takes a comma-separated list of UDP and TCP ports, overrides kdc.conf [kdcdefaults], and defaults to 88. The Solnix page says only that -p sets the listening port. It gives no list syntax, config file or default.Source: FreeBSD krb5kdc(8) -p portnum; Solnix krb5kdc(8) -p port |
| FreeBSD | signals and log rotation | Solnix documents SIGHUP as closing and reopening log files, for logadm(8). With that method, set the krb5.conf kdc_rotate period to never. The FreeBSD page describes SIGHUP only as relayed to workers under -w.Source: Solnix krb5kdc(8) NOTES SIGHUP; FreeBSD krb5kdc(8) -w |
| FreeBSD | socket activation and environment | FreeBSD (release 1.22 feature) supports systemd socket activation through LISTEN_PID and LISTEN_FDS. The Solnix page documents no environment variables and no socket activation, and refers to krb5envvar(7). Source: FreeBSD krb5kdc(8) ENVIRONMENT; Solnix krb5kdc(8) SEE ALSO |
| FreeBSD | -x LDAP arguments | Solnix lists the LDAP -x arguments inline: binddn, bindpwd, nconns and host. It advises against bindpwd and recommends stashing the password with kdb5_ldap_util stashsrvpw. FreeBSD defers to Database Options in kadmin.Source: Solnix krb5kdc(8) -x; FreeBSD krb5kdc(8) -x db_args |
| FreeBSD | config files referenced | The FreeBSD page points to kdc.conf and krb5.conf. The Solnix page refers only to krb5.conf(5) and does not mention kdc.conf. Source: FreeBSD krb5kdc(8) -p, SEE ALSO; Solnix krb5kdc(8) SEE ALSO |
Standards
- POSIX: krb5kdc is not a POSIX.1-2024 utility.
- Solnix: The Solnix page has no STANDARDS or ATTRIBUTES section in the bundle; it refers to attributes(7).
- FreeBSD: The FreeBSD page has no STANDARDS section in the bundle.
Writing portable scripts
- Do not rely on
-w,-Por-Toutside FreeBSD. Solnix lacks them, so stop and reload the daemon with signals and look it up by process name. - Pass
-kand-dexplicitly: the documented defaults differ (des-cbc-crc and/var/krb5on Solnix; aes256-cts-hmac-sha1-96 on FreeBSD).
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.