Slave KDCs
Slave KDCs provide an additional source of Kerberos ticket-granting
services in the event of inaccessibility of the master KDC. The number
of slave KDCs you need and the decision of where to place them, both
physically and logically, depends on the specifics of your network.
All of the Kerberos authentication on your network requires that each
client be able to contact a KDC. Therefore, you need to anticipate any
likely reason a KDC might be unavailable and have a slave KDC to take up
the slack.
Some considerations include:
- Have at least one slave KDC as a backup, for when the master KDC is
down, is being upgraded, or is otherwise unavailable.
- If your network is split such that a network outage is likely to cause a
network partition (some segment or segments of the network to become cut
off or isolated from other segments), have a slave KDC accessible to
each segment.
- If possible, have at least one slave KDC in a different building from
the master, in case of power outages, fires, or other localized
disasters.
