Here's the very final version I come up with, then.
# These templates have been reviewed by the debian-l10n-english # team # # If modifications/additions/rewording are needed, please ask # for an advice to email@example.com # # Even minor modifications require translation updates and such # changes should be coordinated with translators and reviewers. Template: krb5-admin-server/newrealm Type: note _Description: Setting up a Kerberos Realm This package contains the administrative tools required to run the Kerberos master server. . However, installing this package does not automatically set up a Kerberos realm. This can be done later by running the 'krb5_newrealm' command. . Please also read the /usr/share/doc/krb5-kdc/README.KDC file and the administration guide found in the krb5-doc package. Template: krb5-admin-server/kadmind Type: boolean Default: true _Description: Run the Kerberos V5 administration daemon (kadmind)? Kadmind serves requests to add/modify/remove principals in the Kerberos database. . It is required by the kpasswd program, used to change passwords. With standard setups, this daemon should run on the master KDC.
# These templates have been reviewed by the debian-l10n-english # team # # If modifications/additions/rewording are needed, please ask # for an advice to firstname.lastname@example.org # # Even minor modifications require translation updates and such # changes should be coordinated with translators and reviewers. Template: krb5-kdc/debconf Type: boolean Default: true _Description: Create the Kerberos KDC configuration automatically? The Kerberos Domain Controller (KDC) configuration files, in /etc/krb5kdc, may be created automatically. . By default, an example template will be copied into this directory with local parameters filled in. . Administrators who already have infrastructure to manage their Kerberos configuration may wish to disable these automatic configuration changes. Template: krb5-kdc/krb4-mode Type: select __Choices: disable, full, nopreauth, none Default: none _Description: Kerberos V4 compatibility mode to use: By default, Kerberos V4 requests are allowed from principals that do not require preauthentication ('nopreauth'). This allows Kerberos V4 services to exist while requiring most users to use Kerberos V5 clients to get their initial tickets. These tickets can then be converted to Kerberos V4 tickets. . Alternatively, the mode can be set to 'full', allowing Kerberos V4 clients to get initial tickets even when preauthentication would normally be required; to 'disable', returning protocol version errors to all Kerberos V4 clients; or to 'none', which tells the KDC to not respond to Kerberos V4 requests at all. Template: krb5-kdc/run-krb524 Type: boolean _Description: Run a Kerberos V5 to Kerberos V4 ticket conversion daemon? Krb524d is a daemon that converts Kerberos V5 tickets into Kerberos V4 tickets for the krb524init program. . It is recommended to enable that daemon if Kerberos V4 is enabled, especially when Kerberos V4 compatibility is set to 'nopreauth'. Template: krb5-kdc/purge_data_too Type: boolean Default: false _Description: Should the data be purged as well as the package files? By default, purging this package will not delete the KDC database in /var/lib/krb5kdc/principal since this database cannot be recovered once it is deleted. . Choose this option if you wish to delete the KDC database when this package is purged, deleting all of the user accounts and passwords in the KDC.
Description: Digital signature