diff --git a/gnu/services/kerberos.scm b/gnu/services/kerberos.scm
index 1a7cc5774a..8ebcec3291 100644
--- a/gnu/services/kerberos.scm
+++ b/gnu/services/kerberos.scm
@@ -296,19 +296,19 @@ (define-configuration krb5-configuration
 
   (dns-canonicalize-hostname?
    (boolean/unset  unset-field)
-   "Whether name lookups will be used to canonicalize host names for use in 
+   "Whether name lookups will be used to canonicalize host names for use in
 service principal names.")
 
   (dns-lookup-kdc?
    (boolean/unset unset-field)
- "Should DNS SRV records should be used to locate the KDCs and other servers 
+   "Should DNS SRV records should be used to locate the KDCs and other servers
 not appearing in the realm specification")
 
   (err-fmt
    (string/unset unset-field)
-   "Custom error message formatting. If not #f error messages will be formatted 
-by substituting a normal error message for %M and an error code for %C in the 
-value.")
+   "Custom error message formatting. If not #f error messages will be
+formatted by substituting a normal error message for %M and an error code for
+%C in the value.")
 
   (forwardable?
    (boolean/unset unset-field)
@@ -316,9 +316,9 @@ (define-configuration krb5-configuration
 
   (ignore-acceptor-hostname?
    (boolean/unset unset-field)
-   "When accepting GSSAPI or krb5 security contexts for host-based service 
-principals, ignore any hostname passed by the calling application, and allow 
-clients to authenticate to any service principal in the keytab matching the 
+   "When accepting GSSAPI or krb5 security contexts for host-based service
+principals, ignore any hostname passed by the calling application, and allow
+clients to authenticate to any service principal in the keytab matching the
 service name and realm name.")
 
   (k5login-authoritative?
@@ -328,23 +328,23 @@ (define-configuration krb5-configuration
 
   (k5login-directory
    (string/unset unset-field)
-   "If not #f, the library will look for a local user's @file{k5login} file 
-within the named directory (instead of the user's home directory), with a 
-file name corresponding to the local user name.")
+   "If not #f, the library will look for a local user's @file{k5login} file
+within the named directory (instead of the user's home directory), with a file
+name corresponding to the local user name.")
 
   (kcm-mach-service
    (string/unset unset-field)
-   "The name of the bootstrap service used to contact the KCM daemon for the 
+   "The name of the bootstrap service used to contact the KCM daemon for the
 KCM credential cache type.")
 
   (kcm-socket
    (file-name unset-field)
- "Path to the Unix domain socket used to access the KCM daemon for the KCM 
+   "Path to the Unix domain socket used to access the KCM daemon for the KCM
 credential cache type.")
 
   (kdc-default-options
    (non-negative-integer/unset unset-field)
-   "Default KDC options (logored for multiple values) when requesting initial 
+   "Default KDC options (logored for multiple values) when requesting initial
 tickets.")
 
   (kdc-timesync
@@ -353,17 +353,18 @@ (define-configuration krb5-configuration
 
   (kdc-req-checksum-type
    (non-negative-integer/unset unset-field)
-   "The type of checksum to use for the KDC requests. Relevant only for DES 
+   "The type of checksum to use for the KDC requests. Relevant only for DES
 keys")
 
   (noaddresses?
    (boolean/unset unset-field)
-   "If true, initial ticket requests will not be made with address restrictions.
-This enables their use across NATs.")
+   "If true, initial ticket requests will not be made with address
+restrictions.  This enables their use across NATs.")
 
   (permitted-enctypes
    (space-separated-string-list/unset unset-field)
-   "All encryption types that are permitted for use in session key encryption.")
+   "All encryption types that are permitted for use in session key
+encryption.")
 
   (plugin-base-dir
    (file-name unset-field)
@@ -371,8 +372,8 @@ (define-configuration krb5-configuration
 
   (preferred-preauth-types
    (comma-separated-integer-list/unset unset-field)
-   "The preferred pre-authentication types which the client will attempt before 
-others.")
+   "The preferred pre-authentication types which the client will attempt
+before others.")
 
   (proxiable?
    (boolean/unset unset-field)
@@ -380,12 +381,12 @@ (define-configuration krb5-configuration
 
   (rdns?
    (boolean/unset unset-field)
-   "Should reverse DNS lookup be used in addition to forward name lookup to 
+   "Should reverse DNS lookup be used in addition to forward name lookup to
 canonicalize host names for use in service principal names.")
 
   (realm-try-domains
    (integer/unset unset-field)
-   "Should a host's domain components should be used to determine the Kerberos 
+   "Should a host's domain components should be used to determine the Kerberos
 realm of the host.")
 
   (renew-lifetime
@@ -402,13 +403,13 @@ (define-configuration krb5-configuration
 
   (udp-preference-limit
    (non-negative-integer/unset unset-field)
-   "When sending messages to the KDC, the library will try using TCP
-before UDP if the size of the message greater than this limit.")
+   "When sending messages to the KDC, the library will try using TCP before
+UDP if the size of the message greater than this limit.")
 
   (verify-ap-rereq-nofail?
    (boolean/unset unset-field)
- "If true, then attempts to verify initial credentials will fail if the client
-machine does not have a keytab.")
+   "If true, then attempts to verify initial credentials will fail if the
+client machine does not have a keytab.")
 
   (realms
    (realm-list '())
