includedir  /etc/krb5.conf.d

[libdefaults]
    # "dns_canonicalize_hostname" and "rdns" are better set to false for improved security.
    # If set to true, the canonicalization mechanism performed by Kerberos client may
    # allow service impersonification, the consequence is similar to conducting TLS certificate
    # verification without checking host name.
    # If left unspecified, the two parameters will have default value true, which is less secure.
    dns_canonicalize_hostname = false
    rdns = false
#	default_realm = EXAMPLE.COM 
	default_ccache_name = KEYRING:persistent:%{uid}

[realms]
#	EXAMPLE.COM = {
#                kdc = kerberos.example.com
#		admin_server = kerberos.example.com
#	}

[logging]
    kdc = FILE:/var/log/krb5/krb5kdc.log
    admin_server = FILE:/var/log/krb5/kadmind.log
    default = SYSLOG:NOTICE:DAEMON
