kadmin

[-r realm] [-p principal] [-q query]
[[-c cache_name] | [-k [-t keytab]]] [-w password] [-s admin_server[:port]

kadmin.local

[-r realm] [-p principal] [-q query]
[-d dbname] [-e "enc:salt ..."] [-m]

-r realm

Use realm as the default database realm.

-p principal

Use principal to authenticate.  Otherwise, kadmin will append "/admin" to the primary principal name of the default ccache, the value of the USER environment variable, or the username as obtained with getpwuid, in order of preference.

-k

Use a keytab to decrypt the KDC response instead of prompting for a password on the TTY.  In this case, the default principal will be host/hostname.  If there is not a keytab specified with the -t option, then the default keytab will be used.

-t keytab

Use keytab to decrypt the KDC response.  This can only be used with the -k option.

-c credentials_cache

Use credentials_cache as the credentials cache.  The credentials_cache should contain a service ticket for the kadmin/admin service; it can be acquired with the kinit(1) program.  If this option is not specified, kadmin requests a new service ticket from the KDC, and stores it in its own temporary ccache.

-w password

Use password instead of prompting for one on the TTY.  Note:  placing the password for a Kerberos principal with administration access into a shell script can be dangerous if unauthorized users gain read access to the script.

-q query

pass query directly to kadmin , which will perform query and then exit.  This can be useful for writing scripts.

-d dbname

Specifies the name of the Kerberos database.

-s admin_server[:port]

Specifies the admin server which kadmin should contact.

-m

Do not authenticate using a keytab.  This option will cause kadmin to prompt for the master database password.

-e enc:salt_list

Sets the list of encryption types and salt types to be used for any new keys created.

1 month ago
2 hours ago
400000 seconds ago
last year
this Monday
next Monday
yesterday
tomorrow
now
second Monday
a fortnight ago
3/31/92 10:00:07 PST
January 23, 1987 10:05pm
22:00 GMT

add_principal [options] newprinc

creates the principal newprinc , prompting twice for a password.  If no policy is specified with the -policy option, and the policy named "default" exists, then that policy is assigned to the principal; note that the assignment of the policy "default" only occurs automatically when a principal is first created, so the policy "default" must already exist for the assignment to occur.  This assignment of "default" can be suppressed with the -clearpolicy option.  This command requires the add privilege.  This command has the aliases addprinc and ank . The options are:

delete_principal [-force] principal

deletes the specified principal from the database.  This command prompts
for deletion, unless the
-force option is given. This command requires the
delete
privilege.  Aliased
to
delprinc .

EXAMPLE:


kadmin: delprinc mwm_user


Are you sure you want to delete the principal


"mwm_user@BLEEP.COM"? (yes/no): yes


Principal "mwm_user@BLEEP.COM" deleted.


Make sure that you have removed this principal from


all ACLs before reusing.


kadmin:

ERRORS:

KADM5_AUTH_DELETE (reequires "delete" privilege)
KADM5_UNK_PRINC (principal does not exist)

modify_principal [options] principal

modifies the specified principal, changing the fields as specified.  The
options are as above for
add_principal ,
except that password changing and flags related to password changing
are forbidden by this command.  In addition, the option
-clearpolicy will clear the current policy of a principal.  This command requires the
modify
privilege.  Aliased to
modprinc .

ERRORS:


KADM5_AUTH_MODIFY (requires "modify" privilege)


KADM5_UNK_PRINC (principal does not exist)


KADM5_UNK_POLICY (policy does not exist)


KADM5_BAD_MASK (shouldn't happen)

change_password [options] principal

changes the password of
principal .
Prompts for a new password if neither
-randkey or
-pw is specified.  Requires the
changepw
privilege, or that the principal that is running the program to be the
same as the one changed.  Aliased to
cpw .
The following options are available:

get_principal [-terse] principal

gets the attributes of
principal .
Requires the
inquire
privilege, or that the principal that is running the the program to be
the same as the one being listed.  With the
-terse option, outputs fields as quoted tab-separated strings.  Alias
getprinc .

EXAMPLES:


kadmin: getprinc tlyu/admin


Principal: tlyu/admin@BLEEP.COM


Expiration date: [never]


Last password change: Mon Aug 12 14:16:47 EDT 1996


Password expiration date: [none]


Maximum ticket life: 0 days 10:00:00


Maximum renewable life: 7 days 00:00:00


Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)


Last successful authentication: [never]


Last failed authentication: [never]


Failed password attempts: 0


Number of keys: 2


Key: vno 1, DES cbc mode with CRC-32, no salt


Key: vno 1, DES cbc mode with CRC-32, Version 4


Attributes:


Policy: [none]


kadmin: getprinc -terse systest


systest@BLEEP.COM 3 86400 604800 1


785926535 753241234 785900000


tlyu/admin@BLEEP.COM 786100034 0 0


kadmin:

ERRORS:

KADM5_AUTH_GET (requires the get (inquire) privilege)
KADM5_UNK_PRINC (principal does not exist)

list_principals [expression]

Retrieves all or some principal names.  
Expression
is a shell-style glob expression that can contain the wild-card
characters ?, *, and []'s.  All principal names matching the
expression are printed.  If no expression is provided, all principal
names are printed.  If the expression does not contain an "@" character,
an "@" character followed by the local realm is appended to the
expression.  Requires the
list
priviledge.  Alias
listprincs ,
get_principals ,
get_princs .

EXAMPLES:


kadmin:  listprincs test*


test3@SECURE-TEST.OV.COM


test2@SECURE-TEST.OV.COM


test1@SECURE-TEST.OV.COM


testuser@SECURE-TEST.OV.COM


kadmin:

add_policy [options] policy

adds the named policy to the policy database.  Requires the
add
privilege.  Aliased to
addpol .
The following options are available:

delete_policy [-force] policy

deletes the named policy.  Prompts for confirmation before deletion.
The command will fail if the policy is in use by any principals.
Requires the
delete
privilege.  Alias
delpol .

EXAMPLE:


kadmin: del_policy guests


Are you sure you want to delete the policy "guests"?


(yes/no): yes


kadmin:

ERRORS:

KADM5_AUTH_DELETE (requires the delete privilege)
KADM5_UNK_POLICY (policy does not exist)
KADM5_POLICY_REF (reference count on policy is not zero)

modify_policy [options] policy

modifies the named policy.  Options are as above for
add_policy .
Requires the
modify
privilege.  Alias
modpol .

ERRORS:


KADM5_AUTH_MODIFY (requires the modify privilege)


KADM5_UNK_POLICY (policy does not exist)

get_policy [-terse] policy

displays the values of the named policy.  Requires the
inquire
privilege.  With the
-terse flag, outputs the fields as quoted strings separated by tabs.  Alias
getpol .

EXAMPLES:


kadmin: get_policy admin


Policy: admin


Maximum password life: 180 days 00:00:00


Minimum password life: 00:00:00


Minimum password length: 6


Minimum number of password character classes: 2


Number of old keys kept: 5


Reference count: 17


kadmin: get_policy -terse admin


admin 15552000 0 6 2 5 17


kadmin:

ERRORS:

KADM5_AUTH_GET (requires the get privilege)
KADM5_UNK_POLICY (policy does not exist)

list_policies [expression]

Retrieves all or some policy names.  
Expression
is a shell-style glob expression that can contain the wild-card
characters ?, *, and []'s.  All policy names matching the expression
are printed.  If no expression is provided, all existing policy names
are printed.  Requires the
list
priviledge.  Alias
listpols ,
get_policies ,
getpols .

EXAMPLES:


kadmin:  listpols


test-pol


dict-only


once-a-min


test-pol-nopw


kadmin:  listpols t*


test-pol


test-pol-nopw


kadmin:

ktadd [-k keytab] [-q] [-e keysaltlist]

[principal | -glob princ-exp] [...]


Adds a principal or all principals matching
princ-exp
to a keytab, randomizing each principal's key in the process.  Requires the
inquire
and
changepw
privileges.  An entry for each of the principal's unique encryption types
is added, ignoring multiple keys with the same encryption type but
different salt types.  If the
-k argument is not specified, the default keytab
/etc/krb5.keytab
is used.  If the
-q option is specified, less verbose status information is displayed.


The
-glob option requires the
list
privilege.
princ-exp
follows the same rules described for the
list_principals command.  

EXAMPLE:


kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu


Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with


 kvno 3, encryption type DES-CBC-CRC added to keytab


 WRFILE:/tmp/foo-new-keytab


kadmin:

ktremove [-k keytab] [-q] principal [kvno | all | old]

Removes entries for the specified principal from a keytab.  Requires no
permissions, since this does not require database access.  If the string
"all" is specified, all entries for that principal are removed; if the
string "old" is specified, all entries for that principal except those
with the highest kvno are removed.  Otherwise, the value specified is
parsed as an integer, and all entries whose kvno match that integer are
removed.  If the
-k argument is not specifeid, the default keytab
/etc/krb5.keytab
is used.  If the
-q option is specified, less verbose status information is displayed.

EXAMPLE:


kadmin: ktremove -k /usr/local/var/krb5kdc/kadmind.keytab kadmin/admin


Entry for principal kadmin/admin with kvno 3 removed


 from keytab WRFILE:/usr/local/var/krb5kdc/kadmind.keytab.


kadmin:

principal.db

default name for Kerberos principal database

<dbname>.kadm5

KADM5 administrative database.  (This would be "principal.kadm5", if you
use the default database name.)  Contains policy information.

<dbname>.kadm5.lock

lock file for the KADM5 administrative database.  This file works
backwards from most other lock files.  I.e.,
kadmin will exit with an error if this file does
not
exist.

kadm5.acl

file containing list of principals and their
kadmin administrative privileges.  See
kadmind(8)
for a description.

kadm5.keytab

keytab file for
kadmin/admin
principal.

kadm5.dict

file containing dictionary of strings explicitly disallowed as
passwords.