Release notes suggestion for this change: Administrator experience: * The default Unix domain socket directory for KDC OTP-over-RADIUS verification is now $(runstatedir)/krb5kdc, typically /var/run/krb5kdc or /run/krb5kdc, instead of the KDC database directory.