"kdc" (since you might want to use IPsec on your Kerberos server, and might be using GSSAPI to authenticate Phase 1) and "ppp" (since racoon(8) needs to know about all of your network interfaces).