1.3. Creating the Database and Setting Up the First Administrator

Use the utility kdb5_util to create the Kerberos database:

	Note
	The `-s` option stores the master server key for the database in a stash file. If the stash file is not present, you must log into the KDC with the master password (specified during installation) each time it starts. This will automatically regenerate the master server key.

Set up the KDC Access Control List (ACL):
- On RHEL, CentOS, or Oracle Linux add administrators to /var/kerberos/krb5kdc/kadm5.acl.
- On SLES, add administrators to /var/lib/kerberos/krb5kdc/kadm5.acl.
Note
For example, the following line grants full access to the database for users with the admin extension:
*/admin@EXAMPLE.COM *
Restart kadmin for the change to take effect.
Create the first user principal. This must be done at a terminal window on the KDC machine itself, while you are logged in as root. Notice the .local. Normal kadmin usage requires that a principal with appropriate access already exist. The kadmin.local command can be used even if no principals exist.
```
/usr/sbin/kadmin.local -q "addprinc $username/admin"
```
Now this user can create additional principals either on the KDC machine or through the network. The following instruction assume you are using the KDC machine.
On the KDC, start Kerberos:
- On RHEL, CentOS, or Oracle Linux:
```
/sbin/service krb5kdc start
/sbin/service kadmin start
```
- On SLES:
```
rckrb5kdc start
rckadmind start
```