kdc: Add restart option

[cy]

Summary

Add a new kdc_restart rc variable that manages kdc (or krb5kdc) under
aemon(8). This automatically restarts the kdc should it fail, i.e.
when it's configured to use LDAP as a backend and cannot connect to its
LDAP directory.

Set kdc_restart="YES" to auto restart kdc on abnormal termination.

Set kdc_restart_delay="N" to the number of seconds to delay before
restarting the kdc. The daemon(8) default seconds applies when not set.

Reported by: Lexi Winter <[e-mail]>
PR: 278395

Test Plan

Tested locally.

Tested in PR/278395

[cy]

Remove last "DEFAULT" remnant.

[lexi_le-fay.org]

tested this with MIT kerberos (security/krb5 1.21.2_3) on: FreeBSD 15.0-CURRENT #13 lf/main-n268972-9ef33a35bd71: Fri Mar 29 23:12:04 GMT 2024 [e-mail]:/src/obj/src/freebsd/lf/main/arm64.aarch64/sys/LF

i noticed one issue: if kdc_restart=YES and kdc doesn't start (e.g. LDAP is down), 'service stop' doesn't work; daemon continues trying to start kdc forever and 'service kdc stop' hangs until timeout. i think it would be better if 'service kdc stop' immediately killed the daemon process.

aside from that, it seems to work fine: if LDAP is down, kdc keeps trying to start until LDAP comes back up.

libexec/rc/rc.d/kdc

16

i think this should be "kdc_restart_delay" (lowercase) to match other instances of this option.

[cy]

libexec/rc/rc.d/kdc

16

Oops. Old habits die hard.

[cy]

Fix a stupid typo.