"If you choose to install a stash file..."

[Ken Hornstein]

>In addition to needing to enter a passphrase to launch krb5kdc (with
>the -m option), it looks like kdb5_util will also need a passphrase,
>understandably.
>
>This means that the traditional cronjob-triggered kprop -> kpropd
>replication won't work either, right?

Actually, it shouldn't need a passphrase; the dump files contain the
encrypted keys not the decrypted ones, and that's what kprop/kpropd
pass around.  I thought that the MIT folks told me that they run without
a stash file, and I see they have three KDCs.

--Ken