Setting up a slave KDC is fairly simple. Here are the steps you need to
perform:

  1. Create host principals for your master and slave KDCs. These will look
     like host/kdc1.foo.bar@FOO.BAR, or something similar.
  2. In the Kerberos database directory (/usr/krb5/lib/krb5kdc using the
     default configuration) on both your masters and slaves, create a file
     called kpropd.acl and place in it all of the host principals for your
     KDCs.

     For example, if you had three KDCs, kdc1.foo.bar, kdc2.foo.bar, and
     kdc3.foo.bar, this file would contain:

     host/kdc1.foo.bar@FOO.BAR
     host/kdc2.foo.bar@FOO.BAR
     host/kdc3.foo.bar@FOO.BAR

  3. On your slave KDCs, add an entry for kpropd in inetd.conf. A sample
     entry would look like:

     krb5_prop  stream  tcp  nowait root /usr/krb5/sbin/kpropd kpropd

  4. On the master KDC, dump the database into a file using kdb5_util.
     Depending on where you told Kerberos to live, a sample command would
     look like:

     /usr/krb5/sbin/kdb5_util dump /usr/krb5/lib/krb5kdc/slave_datatrans

  5. Run kprop on the master to propagate the database to each slave:

     /usr/krb5/sbin/kprop -f /usr/krb5/lib/krb5kdc/slave_datatrans kdc2.foo.bar
     /usr/krb5/sbin/kprop -f /usr/krb5/lib/krb5kdc/slave_datatrans kdc3.foo.bar

Once you have this working, you probably want to write a script to propagate
the database at regular intervals. Here is the one that I use:

#!/bin/sh
#

kdclist="kdc1.foo.bar kdc2.foo.bar"

/usr/krb5/sbin/kdb5_util dump /var/krb5/krb5kdc/slave_datatrans

for kdc in $kdclist
do
        /usr/krb5/sbin/kprop $kdc > /dev/null
done

The most common error people get when setting up their KDC is the extremely
confusing "Decrypt integrity check failed". This means that the host keys
stored in the KDC don't match the keys stored in the corresponding keytabs
(I bet you recreated the database a couple of times while you were playing
around with the KDC, didn't you?). Installing new host keys on the master
and the slaves will fix this problem.