An MIT Kerberos KDC With An ACL And A Lockout
An MIT Kerberos KDC: the realm created once with a stash, kadmind behind an ACL, a default policy that locks an account after five wrong passwords, every listener on loopback. The KDC starts on a broken config without a word, so the live test proves each setting by behaviour: the ticket lifetime, the refusals, the lockout. Original role, live-tested on Rocky Linux 10.
Verification
Live-testedReally deployed to a container sandbox, proven idempotent (a second run changes nothing), verified against the role’s assertions, then torn down.
Conformance
- Static validation (yamllint · ansible-lint)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live-tested - applied, verified, destroyed
Last verified 2026-10-03 · podman 4.9.3 · ansible 2.21.4 · how we verify
Cite it in your README
badge · attributionPaste this beside the module in the repository that uses it. The badge is rendered from this artifact's verification record, so it reads live-tested because the record says so, and the link lands on this page.
[](https://www.iac-bazaar.com/catalog/ansible-krb5-kdc?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
Ansible role 1.0.0, live-tested on IaC Bazaar: [An MIT Kerberos KDC With An ACL And A Lockout](https://www.iac-bazaar.com/catalog/ansible-krb5-kdc?utm_source=syndication&utm_medium=readme&utm_campaign=artifact)
```yaml
# An MIT Kerberos KDC With An ACL And A Lockout: https://www.iac-bazaar.com/catalog/ansible-krb5-kdc (download from your IaC Bazaar account)
```Preview:
Documentation
krb5-kdc
An MIT Kerberos KDC from the distribution: the realm's database created once with a stash, kadmind behind an ACL, a default policy that locks an account after repeated wrong passwords, ticket lifetimes you set, and every listener on loopback until you open it. Original role for EL 10, live-tested with podman on Rocky Linux 10.
No download, and no version to pin. EL 10 packages the KDC (krb5-server)
and its tools (krb5-workstation), so the role installs them by name and takes
what the distribution ships: a security update arrives through dnf, not
through a new release of this role. What the role owns is the configuration and
the proof that the service works.
Two units, one realm. The role writes kdc.conf and kadm5.acl,
creates the database once (kdb5_util create -s, the stash beside it so the KDC
starts unattended), and enables krb5kdc and kadmin as the packages ship
them. The master password and the first administrator's password are generated
on the host, once, into root-only files beside the database - unless you pass
your own. The KDC listens on 127.0.0.1:88 by default, kadmind on 749 and
kpasswd on 464, also loopback; the live test reads the sockets.
A KDC that starts on anything. The KDC started, active, on a kdc.conf
with a bad max_life, on one with an unbalanced brace, and on one with an
unknown key (all measured): there is no checker, and the start proves nothing.
So the live test proves the settings by behaviour - the ticket it gets lives
exactly max_life (10 hours, 36000 seconds) although the client asked for 24.
A refusal that exits 0. kadmin -q exits 0 when kadmind refuses it
("Operation requires ``add'' privilege", measured). The live test reads the
message, then asks the database: the principal it tried to add does not exist.
Proven by tickets. The right password gets a ticket and a wrong one "Password incorrect"; the administrator lists the principals through kadmind; a service logs in from a keytab; and after five wrong passwords even the right one is refused - "Client's credentials have been revoked" - by the default policy.
Containers have no kernel keyring. The stock credential cache,
KEYRING:persistent, fails in a container with "Function not implemented",
even for kadmin.local. The role's own calls use a cache in memory, which works
on any host; on yours, the stock cache is left as it is.
License
Commercial - IaC Bazaar EULA. (c) IaC Bazaar.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Variables
- Test
Related modules
ansible-lynis
Lynis from EPEL on a systemd timer, with the units the package keeps only in its docs, your skipped tests in custom.prf, and a minimum hardening index below which the audit unit fails, so a falling score shows as a failed unit. The live test runs the audit, reads the index and the tests that ran, and finds the timer enabled. Original role, live-tested on Rocky Linux 10.
ansible-suricata
Suricata from EPEL watching the default-route interface as the suricata user, ET Open fetched at install and refreshed daily, plus a canary rule that proves the sensor is alive. A root-run check left root-owned logs and a daemon recording nothing; the role prevents it. The live test raises the canary alert while a second lookup is logged, not alerted. Original role, live-tested on Rocky Linux 10.
ansible-aide
AIDE from AppStream on EL 10: a watched tree, a baseline database built once, and the oneshot unit and timer the package does not ship. The live test passes on an unchanged host, FAILS when a file appears inside a watched path and names it, ignores one inside an excluded path, and passes again once the change is gone. Original role, live-tested on Rocky Linux 10.
ansible-389-ds
389 Directory Server from AppStream. A fresh instance listens on every interface and lets anonymous clients read the tree; this role binds both listeners to loopback and limits anonymous clients to the rootDSE. The live test adds a user who binds, sees a wrong password and an anonymous search refused, and reads the LDAPS certificate. Original role, live-tested on Rocky Linux 10.
ansible-authelia
Authelia from the upstream release (sha256-verified) as a hardened system service on loopback with file users and sqlite; its secrets are generated once on the host and reach the service as AUTHELIA_*_FILE variables. The live test hashes a password with Authelia's hasher, logs in, sees a wrong password refused and an anonymous visitor sent to the portal. Original role, live-tested on Rocky 10.
ansible-bandit
bandit on EL 10 from PyPI into a venv of its own with a link in the PATH; the live test runs pip check, then scans a module that passes a string to subprocess.call with shell=True (B602, High, exit 1) and a clean module (exit 0). Pinned. Original role, live-tested on Rocky Linux 10.