| acl | list of string matching [^
]+ | kadmind ACL entries. |
| adminServer | string matching [A-Za-z0-9][A-Za-z0-9.-]* | Host name of the Kerberos administration server. |
| enable | boolean | Enable the package-owned Kerberos KDC. |
| enableAdminServer | boolean | Enable the kadmind remote administration service. |
| kdcServers | list of string matching [A-Za-z0-9][A-Za-z0-9.-]* | Ordered KDC host names published to clients. |
| masterPassword | submodule | Opaque initial KDC database master password. |
| maxLife | string matching [1-9][0-9]*[smhd] | Maximum ticket lifetime. |
| maxRenewableLife | string matching [1-9][0-9]*[smhd] | Maximum renewable ticket lifetime. |
| realm | string matching [A-Z0-9][A-Z0-9.-]* | Kerberos realm served by this KDC. |