1KADMIN(1)                        MIT Kerberos                        KADMIN(1)
2
3
4

NAME

6       kadmin - Kerberos V5 database administration program
7

SYNOPSIS

9       kadmin   [-O|-N]   [-r   realm]   [-p   principal]   [-q   query]  [[-c
10       cache_name]|[-k [-t keytab]]|-n] [-w password] [-s admin_server[:port]]
11       [command args...]
12
13       kadmin.local  [-r  realm]  [-p  principal]  [-q  query] [-d dbname] [-e
14       enc:salt ...]  [-m] [-x db_args] [command args...]
15

DESCRIPTION

17       kadmin and kadmin.local are command-line interfaces to the Kerberos  V5
18       administration  system.  They provide nearly identical functionalities;
19       the difference is that kadmin.local directly accesses the KDC database,
20       while  kadmin  performs operations using kadmind(8).  Except as explic‐
21       itly noted otherwise, this man page will use "kadmin" to refer to  both
22       versions.   kadmin provides for the maintenance of Kerberos principals,
23       password policies, and service key tables (keytabs).
24
25       The remote kadmin client uses Kerberos to authenticate to kadmind using
26       the   service   principal  kadmin/ADMINHOST  (where  ADMINHOST  is  the
27       fully-qualified hostname of the admin server) or kadmin/admin.  If  the
28       credentials  cache  contains  a ticket for one of these principals, and
29       the -c credentials_cache option is specified, that ticket  is  used  to
30       authenticate  to kadmind.  Otherwise, the -p and -k options are used to
31       specify the client Kerberos principal name used to authenticate.   Once
32       kadmin  has determined the principal name, it requests a service ticket
33       from the KDC, and uses that service ticket to authenticate to kadmind.
34
35       Since kadmin.local directly accesses the KDC database, it usually  must
36       be  run  directly on the master KDC with sufficient permissions to read
37       the KDC database.  If the KDC database uses the LDAP  database  module,
38       kadmin.local can be run on any host which can access the LDAP server.
39

OPTIONS

41       -r realm
42              Use realm as the default database realm.
43
44       -p principal
45              Use  principal  to  authenticate.  Otherwise, kadmin will append
46              /admin to the primary principal name of the default ccache,  the
47              value  of  the  USER  environment  variable,  or the username as
48              obtained with getpwuid, in order of preference.
49
50       -k     Use a keytab to decrypt the KDC response  instead  of  prompting
51              for  a  password.   In  this case, the default principal will be
52              host/hostname.  If there is no  keytab  specified  with  the  -t
53              option, then the default keytab will be used.
54
55       -t keytab
56              Use  keytab  to decrypt the KDC response.  This can only be used
57              with the -k option.
58
59       -n     Requests anonymous processing.  Two types of  anonymous  princi‐
60              pals  are  supported.   For  fully anonymous Kerberos, configure
61              PKINIT on the KDC and configure pkinit_anchors in  the  client's
62              krb5.conf(5).   Then  use  the -n option with a principal of the
63              form @REALM (an empty principal name followed by the at-sign and
64              a  realm  name).   If  permitted by the KDC, an anonymous ticket
65              will be returned.  A second form of anonymous  tickets  is  sup‐
66              ported;  these  realm-exposed  tickets  hide the identity of the
67              client but not the client's realm.  For this mode, use kinit  -n
68              with  a  normal  principal  name.   If supported by the KDC, the
69              principal (but not realm) will  be  replaced  by  the  anonymous
70              principal.   As  of  release 1.8, the MIT Kerberos KDC only sup‐
71              ports fully anonymous operation.
72
73       -c credentials_cache
74              Use credentials_cache  as  the  credentials  cache.   The  cache
75              should  contain a service ticket for the kadmin/ADMINHOST (where
76              ADMINHOST is the fully-qualified hostname of the  admin  server)
77              or  kadmin/admin  service;  it can be acquired with the kinit(1)
78              program.  If this option is not specified, kadmin requests a new
79              service  ticket from the KDC, and stores it in its own temporary
80              ccache.
81
82       -w password
83              Use password instead of prompting for one.  Use this option with
84              care, as it may expose the password to other users on the system
85              via the process list.
86
87       -q query
88              Perform the specified query and then exit.
89
90       -d dbname
91              Specifies the name of the KDC database.  This  option  does  not
92              apply to the LDAP database module.
93
94       -s admin_server[:port]
95              Specifies the admin server which kadmin should contact.
96
97       -m     If  using  kadmin.local, prompt for the database master password
98              instead of reading it from a stash file.
99
100       -e "enc:salt ..."
101              Sets the keysalt list to be used for any new keys created.   See
102              Keysalt_lists in kdc.conf(5) for a list of possible values.
103
104       -O     Force use of old AUTH_GSSAPI authentication flavor.
105
106       -N     Prevent fallback to AUTH_GSSAPI authentication flavor.
107
108       -x db_args
109              Specifies the database specific arguments.  See the next section
110              for supported options.
111
112       Starting with release 1.14, if any command-line arguments remain  after
113       the  options,  they  will  be treated as a single query to be executed.
114       This mode of operation is intended for scripts and behaves  differently
115       from the interactive mode in several respects:
116
117       · Query arguments are split by the shell, not by kadmin.
118
119       · Informational  and  warning  messages are suppressed.  Error messages
120         and query output (e.g. for get_principal) will still be displayed.
121
122       · Confirmation prompts are disabled (as if -force was given).  Password
123         prompts will still be issued as required.
124
125       · The exit status will be non-zero if the query fails.
126
127       The -q option does not carry these behavior differences; the query will
128       be processed as if it was entered interactively.  The -q option  cannot
129       be used in combination with a query in the remaining arguments.
130

DATABASE OPTIONS

132       Database  options  can  be used to override database-specific defaults.
133       Supported options for the DB2 module are:
134
135          -x dbname=*filename*
136                 Specifies the base filename of the DB2 database.
137
138          -x lockiter
139                 Make iteration operations hold the lock for the  duration  of
140                 the  entire  operation, rather than temporarily releasing the
141                 lock while handling each  principal.   This  is  the  default
142                 behavior,  but this option exists to allow command line over‐
143                 ride of a [dbmodules] setting.  First introduced  in  release
144                 1.13.
145
146          -x unlockiter
147                 Make  iteration operations unlock the database for each prin‐
148                 cipal, instead of holding the lock for the  duration  of  the
149                 entire operation.  First introduced in release 1.13.
150
151       Supported options for the LDAP module are:
152
153          -x host=ldapuri
154                 Specifies the LDAP server to connect to by a LDAP URI.
155
156          -x binddn=bind_dn
157                 Specifies the DN used to bind to the LDAP server.
158
159          -x bindpwd=password
160                 Specifies  the  password  or  SASL secret used to bind to the
161                 LDAP server.  Using this option may expose  the  password  to
162                 other  users  on  the  system  via the process list; to avoid
163                 this, instead stash the password using the stashsrvpw command
164                 of kdb5_ldap_util(8).
165
166          -x sasl_mech=mechanism
167                 Specifies the SASL mechanism used to bind to the LDAP server.
168                 The bind DN is ignored if a SASL mechanism is used.   New  in
169                 release 1.13.
170
171          -x sasl_authcid=name
172                 Specifies  the  authentication  name used when binding to the
173                 LDAP server with a SASL mechanism, if the mechanism  requires
174                 one.  New in release 1.13.
175
176          -x sasl_authzid=name
177                 Specifies  the  authorization  name  used when binding to the
178                 LDAP server with a SASL mechanism.  New in release 1.13.
179
180          -x sasl_realm=realm
181                 Specifies the realm used when binding to the LDAP server with
182                 a  SASL mechanism, if the mechanism uses one.  New in release
183                 1.13.
184
185          -x debug=level
186                 sets the OpenLDAP client library debug level.   level  is  an
187                 integer to be interpreted by the library.  Debugging messages
188                 are printed to standard error.  New in release 1.12.
189

COMMANDS

191       When using the remote client,  available  commands  may  be  restricted
192       according  to  the privileges specified in the kadm5.acl(5) file on the
193       admin server.
194
195   add_principal
196          add_principal [options] newprinc
197
198       Creates the principal newprinc, prompting twice for a password.  If  no
199       password  policy  is  specified with the -policy option, and the policy
200       named default is assigned to the principal if it exists.  However, cre‐
201       ating  a policy named default will not automatically assign this policy
202       to previously existing principals.  This policy assignment can be  sup‐
203       pressed with the -clearpolicy option.
204
205       This command requires the add privilege.
206
207       Aliases: addprinc, ank
208
209       Options:
210
211       -expire expdate
212              (getdate string) The expiration date of the principal.
213
214       -pwexpire pwexpdate
215              (getdate string) The password expiration date.
216
217       -maxlife maxlife
218              (duration  or  getdate  string)  The maximum ticket life for the
219              principal.
220
221       -maxrenewlife maxrenewlife
222              (duration or getdate string) The maximum renewable life of tick‐
223              ets for the principal.
224
225       -kvno kvno
226              The initial key version number.
227
228       -policy policy
229              The  password  policy used by this principal.  If not specified,
230              the policy default is used if it exists (unless -clearpolicy  is
231              specified).
232
233       -clearpolicy
234              Prevents  any  policy  from  being  assigned when -policy is not
235              specified.
236
237       {-|+}allow_postdated
238              -allow_postdated prohibits this principal from  obtaining  post‐
239              dated tickets.  +allow_postdated clears this flag.
240
241       {-|+}allow_forwardable
242              -allow_forwardable  prohibits this principal from obtaining for‐
243              wardable tickets.  +allow_forwardable clears this flag.
244
245       {-|+}allow_renewable
246              -allow_renewable prohibits this principal from obtaining  renew‐
247              able tickets.  +allow_renewable clears this flag.
248
249       {-|+}allow_proxiable
250              -allow_proxiable  prohibits this principal from obtaining proxi‐
251              able tickets.  +allow_proxiable clears this flag.
252
253       {-|+}allow_dup_skey
254              -allow_dup_skey disables user-to-user  authentication  for  this
255              principal  by prohibiting others from obtaining a service ticket
256              encrypted in this principal's TGT session key.   +allow_dup_skey
257              clears this flag.
258
259       {-|+}requires_preauth
260              +requires_preauth  requires  this  principal  to preauthenticate
261              before being allowed to kinit.   -requires_preauth  clears  this
262              flag.  When +requires_preauth is set on a service principal, the
263              KDC will only issue service tickets for that  service  principal
264              if  the  client's  initial  authentication  was  performed using
265              preauthentication.
266
267       {-|+}requires_hwauth
268              +requires_hwauth  requires  this  principal  to  preauthenticate
269              using   a   hardware  device  before  being  allowed  to  kinit.
270              -requires_hwauth clears this flag.  When +requires_hwauth is set
271              on  a service principal, the KDC will only issue service tickets
272              for that service principal if the client's  initial  authentica‐
273              tion was performed using a hardware device to preauthenticate.
274
275       {-|+}ok_as_delegate
276              +ok_as_delegate sets the okay as delegate flag on tickets issued
277              with this principal as the service.  Clients may use  this  flag
278              as a hint that credentials should be delegated when authenticat‐
279              ing to the service.  -ok_as_delegate clears this flag.
280
281       {-|+}allow_svr
282              -allow_svr prohibits the issuance of service  tickets  for  this
283              principal.   In  release  1.17  and  later, user-to-user service
284              tickets are still allowed unless  the  -allow_dup_skey  flag  is
285              also set.  +allow_svr clears this flag.
286
287       {-|+}allow_tgs_req
288              -allow_tgs_req  specifies  that  a Ticket-Granting Service (TGS)
289              request for a service ticket for this principal is  not  permit‐
290              ted.  +allow_tgs_req clears this flag.
291
292       {-|+}allow_tix
293              -allow_tix  forbids the issuance of any tickets for this princi‐
294              pal.  +allow_tix clears this flag.
295
296       {-|+}needchange
297              +needchange forces a password change on the next initial authen‐
298              tication to this principal.  -needchange clears this flag.
299
300       {-|+}password_changing_service
301              +password_changing_service  marks  this  principal as a password
302              change service principal.
303
304       {-|+}ok_to_auth_as_delegate
305              +ok_to_auth_as_delegate allows this principal  to  acquire  for‐
306              wardable  tickets  to  itself from arbitrary users, for use with
307              constrained delegation.
308
309       {-|+}no_auth_data_required
310              +no_auth_data_required prevents PAC or AD-SIGNEDPATH  data  from
311              being added to service tickets for the principal.
312
313       {-|+}lockdown_keys
314              +lockdown_keys prevents keys for this principal from leaving the
315              KDC via kadmind.  The chpass and extract operations  are  denied
316              for  a  principal  with this attribute.  The chrand operation is
317              allowed, but will not return  the  new  keys.   The  delete  and
318              rename  operations  are also denied if this attribute is set, in
319              order to prevent a malicious administrator from replacing  prin‐
320              cipals like krbtgt/* or kadmin/* with new principals without the
321              attribute.  This attribute can be set via the network  protocol,
322              but can only be removed using kadmin.local.
323
324       -randkey
325              Sets the key of the principal to a random value.
326
327       -nokey Causes  the principal to be created with no key.  New in release
328              1.12.
329
330       -pw password
331              Sets the password of the principal to the specified  string  and
332              does  not  prompt  for a password.  Note: using this option in a
333              shell script may expose the password to other users on the  sys‐
334              tem via the process list.
335
336       -e enc:salt,...
337              Uses  the  specified  keysalt  list  for setting the keys of the
338              principal.  See Keysalt_lists in kdc.conf(5) for a list of  pos‐
339              sible values.
340
341       -x db_princ_args
342              Indicates  database-specific  options.  The options for the LDAP
343              database module are:
344
345              -x dn=dn
346                     Specifies the LDAP object that will contain the  Kerberos
347                     principal being created.
348
349              -x linkdn=dn
350                     Specifies the LDAP object to which the newly created Ker‐
351                     beros principal object will point.
352
353              -x containerdn=container_dn
354                     Specifies the container object under which  the  Kerberos
355                     principal is to be created.
356
357              -x tktpolicy=policy
358                     Associates a ticket policy to the Kerberos principal.
359
360              NOTE:
361
362                 · The containerdn and linkdn options cannot be specified with
363                   the dn option.
364
365                 · If the dn or containerdn options are  not  specified  while
366                   adding  the principal, the principals are created under the
367                   principal container configured in the realm  or  the  realm
368                   container.
369
370                 · dn and containerdn should be within the subtrees or princi‐
371                   pal container configured in the realm.
372
373       Example:
374
375          kadmin: addprinc jennifer
376          WARNING: no policy specified for "jennifer@ATHENA.MIT.EDU";
377          defaulting to no policy.
378          Enter password for principal jennifer@ATHENA.MIT.EDU:
379          Re-enter password for principal jennifer@ATHENA.MIT.EDU:
380          Principal "jennifer@ATHENA.MIT.EDU" created.
381          kadmin:
382
383   modify_principal
384          modify_principal [options] principal
385
386       Modifies the specified principal, changing  the  fields  as  specified.
387       The options to add_principal also apply to this command, except for the
388       -randkey, -pw, and -e options.  In addition,  the  option  -clearpolicy
389       will clear the current policy of a principal.
390
391       This command requires the modify privilege.
392
393       Alias: modprinc
394
395       Options (in addition to the addprinc options):
396
397       -unlock
398              Unlocks  a  locked  principal  (one  which has received too many
399              failed authentication attempts without enough time between  them
400              according  to  its  password policy) so that it can successfully
401              authenticate.
402
403   rename_principal
404          rename_principal [-force] old_principal new_principal
405
406       Renames the specified old_principal  to  new_principal.   This  command
407       prompts for confirmation, unless the -force option is given.
408
409       This command requires the add and delete privileges.
410
411       Alias: renprinc
412
413   delete_principal
414          delete_principal [-force] principal
415
416       Deletes  the  specified  principal  from  the  database.   This command
417       prompts for deletion, unless the -force option is given.
418
419       This command requires the delete privilege.
420
421       Alias: delprinc
422
423   change_password
424          change_password [options] principal
425
426       Changes the password of principal.  Prompts for a new password if  nei‐
427       ther -randkey or -pw is specified.
428
429       This  command  requires  the  changepw privilege, or that the principal
430       running the program is the same as the principal being changed.
431
432       Alias: cpw
433
434       The following options are available:
435
436       -randkey
437              Sets the key of the principal to a random value.
438
439       -pw password
440              Set the password to the specified string.  Using this option  in
441              a  script  may  expose the password to other users on the system
442              via the process list.
443
444       -e enc:salt,...
445              Uses the specified keysalt list for  setting  the  keys  of  the
446              principal.   See Keysalt_lists in kdc.conf(5) for a list of pos‐
447              sible values.
448
449       -keepold
450              Keeps the existing keys in the database.  This flag  is  usually
451              not necessary except perhaps for krbtgt principals.
452
453       Example:
454
455          kadmin: cpw systest
456          Enter password for principal systest@BLEEP.COM:
457          Re-enter password for principal systest@BLEEP.COM:
458          Password for systest@BLEEP.COM changed.
459          kadmin:
460
461   purgekeys
462          purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal
463
464       Purges  previously retained old keys (e.g., from change_password -keep‐
465       old) from principal.  If -keepkvno is specified, then only purges  keys
466       with  kvnos lower than oldest_kvno_to_keep.  If -all is specified, then
467       all keys are purged.  The -all option is new in release 1.12.
468
469       This command requires the modify privilege.
470
471   get_principal
472          get_principal [-terse] principal
473
474       Gets the attributes of principal.   With  the  -terse  option,  outputs
475       fields as quoted tab-separated strings.
476
477       This command requires the inquire privilege, or that the principal run‐
478       ning the the program to be the same as the one being listed.
479
480       Alias: getprinc
481
482       Examples:
483
484          kadmin: getprinc tlyu/admin
485          Principal: tlyu/admin@BLEEP.COM
486          Expiration date: [never]
487          Last password change: Mon Aug 12 14:16:47 EDT 1996
488          Password expiration date: [never]
489          Maximum ticket life: 0 days 10:00:00
490          Maximum renewable life: 7 days 00:00:00
491          Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
492          Last successful authentication: [never]
493          Last failed authentication: [never]
494          Failed password attempts: 0
495          Number of keys: 1
496          Key: vno 1, aes256-cts-hmac-sha384-192
497          MKey: vno 1
498          Attributes:
499          Policy: [none]
500
501          kadmin: getprinc -terse systest
502          systest@BLEEP.COM   3    86400     604800    1
503          785926535 753241234 785900000
504          tlyu/admin@BLEEP.COM     786100034 0    0
505          kadmin:
506
507   list_principals
508          list_principals [expression]
509
510       Retrieves all or some principal names.   expression  is  a  shell-style
511       glob expression that can contain the wild-card characters ?, *, and [].
512       All principal names matching the expression are printed.  If no expres‐
513       sion  is  provided, all principal names are printed.  If the expression
514       does not contain an @ character, an @ character followed by  the  local
515       realm is appended to the expression.
516
517       This command requires the list privilege.
518
519       Alias: listprincs, get_principals, get_princs
520
521       Example:
522
523          kadmin:  listprincs test*
524          test3@SECURE-TEST.OV.COM
525          test2@SECURE-TEST.OV.COM
526          test1@SECURE-TEST.OV.COM
527          testuser@SECURE-TEST.OV.COM
528          kadmin:
529
530   get_strings
531          get_strings principal
532
533       Displays string attributes on principal.
534
535       This command requires the inquire privilege.
536
537       Alias: getstr
538
539   set_string
540          set_string principal name value
541
542       Sets  a  string  attribute on principal.  String attributes are used to
543       supply per-principal configuration to the KDC and some KDC plugin  mod‐
544       ules.  The following string attribute names are recognized by the KDC:
545
546       require_auth
547              Specifies  an  authentication  indicator  which  is  required to
548              authenticate to the principal as a service.  Multiple indicators
549              can  be  specified, separated by spaces; in this case any of the
550              specified indicators will be accepted.  (New in release 1.14.)
551
552       session_enctypes
553              Specifies the encryption types supported for session  keys  when
554              the  principal  is  authenticated  to  as a server.  See Encryp‐
555              tion_types in kdc.conf(5) for a list of the accepted values.
556
557       otp    Enables One Time Passwords (OTP) preauthentication for a  client
558              principal.   The value is a JSON string representing an array of
559              objects, each having optional type and username fields.
560
561       pkinit_cert_match
562              Specifies a matching expression  that  defines  the  certificate
563              attributes required for the client certificate used by the prin‐
564              cipal during PKINIT authentication.  The matching expression  is
565              in the same format as those used by the pkinit_cert_match option
566              in krb5.conf(5).  (New in release 1.16.)
567
568       This command requires the modify privilege.
569
570       Alias: setstr
571
572       Example:
573
574          set_string host/foo.mit.edu session_enctypes aes128-cts
575          set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"
576
577   del_string
578          del_string principal key
579
580       Deletes a string attribute from principal.
581
582       This command requires the delete privilege.
583
584       Alias: delstr
585
586   add_policy
587          add_policy [options] policy
588
589       Adds a password policy named policy to the database.
590
591       This command requires the add privilege.
592
593       Alias: addpol
594
595       The following options are available:
596
597       -maxlife time
598              (duration or getdate string) Sets  the  maximum  lifetime  of  a
599              password.
600
601       -minlife time
602              (duration  or  getdate  string)  Sets  the minimum lifetime of a
603              password.
604
605       -minlength length
606              Sets the minimum length of a password.
607
608       -minclasses number
609              Sets the minimum number of character classes required in a pass‐
610              word.   The  five  character classes are lower case, upper case,
611              numbers, punctuation, and whitespace/unprintable characters.
612
613       -history number
614              Sets the number of past keys kept for a principal.  This  option
615              is not supported with the LDAP KDC database module.
616
617       -maxfailure maxnumber
618              Sets  the number of authentication failures before the principal
619              is locked.  Authentication failures are only tracked for princi‐
620              pals  which  require  preauthentication.   The counter of failed
621              attempts resets to 0 after a successful attempt to authenticate.
622              A maxnumber value of 0 (the default) disables lockout.
623
624       -failurecountinterval failuretime
625              (duration  or  getdate  string)  Sets the allowable time between
626              authentication failures.  If an authentication  failure  happens
627              after  failuretime  has  elapsed since the previous failure, the
628              number of authentication failures is reset to 1.  A  failuretime
629              value of 0 (the default) means forever.
630
631       -lockoutduration lockouttime
632              (duration  or  getdate  string)  Sets the duration for which the
633              principal is locked from authenticating if too many  authentica‐
634              tion failures occur without the specified failure count interval
635              elapsing.  A duration of 0 (the  default)  means  the  principal
636              remains  locked  out  until it is administratively unlocked with
637              modprinc -unlock.
638
639       -allowedkeysalts
640              Specifies the key/salt tuples supported for long-term keys  when
641              setting   or   changing   a   principal's   password/keys.   See
642              Keysalt_lists in kdc.conf(5) for a list of the accepted  values,
643              but  note  that  key/salt  tuples  must be separated with commas
644              (',') only.  To clear the allowed key/salt policy use a value of
645              '-'.
646
647       Example:
648
649          kadmin: add_policy -maxlife "2 days" -minlength 5 guests
650          kadmin:
651
652   modify_policy
653          modify_policy [options] policy
654
655       Modifies  the  password  policy named policy.  Options are as described
656       for add_policy.
657
658       This command requires the modify privilege.
659
660       Alias: modpol
661
662   delete_policy
663          delete_policy [-force] policy
664
665       Deletes the password policy named  policy.   Prompts  for  confirmation
666       before  deletion.  The command will fail if the policy is in use by any
667       principals.
668
669       This command requires the delete privilege.
670
671       Alias: delpol
672
673       Example:
674
675          kadmin: del_policy guests
676          Are you sure you want to delete the policy "guests"?
677          (yes/no): yes
678          kadmin:
679
680   get_policy
681          get_policy [ -terse ] policy
682
683       Displays the values of the password  policy  named  policy.   With  the
684       -terse flag, outputs the fields as quoted strings separated by tabs.
685
686       This command requires the inquire privilege.
687
688       Alias: getpol
689
690       Examples:
691
692          kadmin: get_policy admin
693          Policy: admin
694          Maximum password life: 180 days 00:00:00
695          Minimum password life: 00:00:00
696          Minimum password length: 6
697          Minimum number of password character classes: 2
698          Number of old keys kept: 5
699          Reference count: 17
700
701          kadmin: get_policy -terse admin
702          admin     15552000  0    6    2    5    17
703          kadmin:
704
705       The  "Reference  count"  is the number of principals using that policy.
706       With the LDAP KDC database module, the reference  count  field  is  not
707       meaningful.
708
709   list_policies
710          list_policies [expression]
711
712       Retrieves  all  or some policy names.  expression is a shell-style glob
713       expression that can contain the wild-card characters ?, *, and [].  All
714       policy  names matching the expression are printed.  If no expression is
715       provided, all existing policy names are printed.
716
717       This command requires the list privilege.
718
719       Aliases: listpols, get_policies, getpols.
720
721       Examples:
722
723          kadmin:  listpols
724          test-pol
725          dict-only
726          once-a-min
727          test-pol-nopw
728
729          kadmin:  listpols t*
730          test-pol
731          test-pol-nopw
732          kadmin:
733
734   ktadd
735          ktadd [options] principal
736          ktadd [options] -glob princ-exp
737
738
739       Adds a principal, or all principals matching  princ-exp,  to  a  keytab
740       file.   Each principal's keys are randomized in the process.  The rules
741       for princ-exp are described in the list_principals command.
742
743       This command requires the inquire and changepw  privileges.   With  the
744       -glob form, it also requires the list privilege.
745
746       The options are:
747
748       -k[eytab] keytab
749              Use keytab as the keytab file.  Otherwise, the default keytab is
750              used.
751
752       -e enc:salt,...
753              Uses the specified keysalt list for setting the new keys of  the
754              principal.   See Keysalt_lists in kdc.conf(5) for a list of pos‐
755              sible values.
756
757       -q     Display less verbose information.
758
759       -norandkey
760              Do not randomize the keys. The keys and  their  version  numbers
761              stay  unchanged.  This option cannot be specified in combination
762              with the -e option.
763
764       An entry for each of the principal's unique encryption types is  added,
765       ignoring multiple keys with the same encryption type but different salt
766       types.
767
768       Example:
769
770          kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu
771          Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
772               encryption type aes256-cts-hmac-sha1-96 added to keytab
773               FILE:/tmp/foo-new-keytab
774          kadmin:
775
776   ktremove
777          ktremove [options] principal [kvno | all | old]
778
779       Removes entries for the specified principal from a keytab.  Requires no
780       permissions, since this does not require database access.
781
782       If  the  string  "all" is specified, all entries for that principal are
783       removed; if the string "old" is specified, all entries for that princi‐
784       pal  except  those  with  the highest kvno are removed.  Otherwise, the
785       value specified is parsed as an integer, and  all  entries  whose  kvno
786       match that integer are removed.
787
788       The options are:
789
790       -k[eytab] keytab
791              Use keytab as the keytab file.  Otherwise, the default keytab is
792              used.
793
794       -q     Display less verbose information.
795
796       Example:
797
798          kadmin: ktremove kadmin/admin all
799          Entry for principal kadmin/admin with kvno 3 removed from keytab
800               FILE:/etc/krb5.keytab
801          kadmin:
802
803   lock
804       Lock database exclusively.  Use with  extreme  caution!   This  command
805       only works with the DB2 KDC database module.
806
807   unlock
808       Release the exclusive database lock.
809
810   list_requests
811       Lists available for kadmin requests.
812
813       Aliases: lr, ?
814
815   quit
816       Exit program.  If the database was locked, the lock is released.
817
818       Aliases: exit, q
819

HISTORY

821       The  kadmin  program  was  originally  written  by Tom Yu at MIT, as an
822       interface to the OpenVision Kerberos administration program.
823

ENVIRONMENT

825       See kerberos(7) for a description of Kerberos environment variables.
826

SEE ALSO

828       kpasswd(1), kadmind(8), kerberos(7)
829

AUTHOR

831       MIT
832
834       1985-2019, MIT
835
836
837
838
8391.17                                                                 KADMIN(1)
Impressum