1KADMIN(1) MIT Kerberos KADMIN(1)
2
6 kadmin - Kerberos V5 database administration program
7
9 kadmin [-O|-N] [-r realm] [-p principal] [-q query] [[-c
10 cache_name]|[-k [-t keytab]]|-n] [-w password] [-s admin_server[:port]]
11 [command args...]
12 kadmin.local [-r realm] [-p principal] [-q query] [-d dbname] [-e
14 enc:salt ...] [-m] [-x db_args] [command args...]
15
17 kadmin and kadmin.local are command-line interfaces to the Kerberos V5
18 administration system. They provide nearly identical functionalities;
19 the difference is that kadmin.local directly accesses the KDC database,
20 while kadmin performs operations using kadmind(8). Except as explic‐
21 itly noted otherwise, this man page will use "kadmin" to refer to both
22 versions. kadmin provides for the maintenance of Kerberos principals,
23 password policies, and service key tables (keytabs).
24 The remote kadmin client uses Kerberos to authenticate to kadmind using
26 the service principal kadmin/ADMINHOST (where ADMINHOST is the
27 fully-qualified hostname of the admin server) or kadmin/admin. If the
28 credentials cache contains a ticket for one of these principals, and
29 the -c credentials_cache option is specified, that ticket is used to
30 authenticate to kadmind. Otherwise, the -p and -k options are used to
31 specify the client Kerberos principal name used to authenticate. Once
32 kadmin has determined the principal name, it requests a service ticket
33 from the KDC, and uses that service ticket to authenticate to kadmind.
34 Since kadmin.local directly accesses the KDC database, it usually must
36 be run directly on the master KDC with sufficient permissions to read
37 the KDC database. If the KDC database uses the LDAP database module,
38 kadmin.local can be run on any host which can access the LDAP server.
39
41 -r realm
42 Use realm as the default database realm.
43 -p principal
45 Use principal to authenticate. Otherwise, kadmin will append
46 /admin to the primary principal name of the default ccache, the
47 value of the USER environment variable, or the username as
48 obtained with getpwuid, in order of preference.
49 -k Use a keytab to decrypt the KDC response instead of prompting
51 for a password. In this case, the default principal will be
52 host/hostname. If there is no keytab specified with the -t
53 option, then the default keytab will be used.
54 -t keytab
56 Use keytab to decrypt the KDC response. This can only be used
57 with the -k option.
58 -n Requests anonymous processing. Two types of anonymous princi‐
60 pals are supported. For fully anonymous Kerberos, configure
61 PKINIT on the KDC and configure pkinit_anchors in the client's
62 krb5.conf(5). Then use the -n option with a principal of the
63 form @REALM (an empty principal name followed by the at-sign and
64 a realm name). If permitted by the KDC, an anonymous ticket
65 will be returned. A second form of anonymous tickets is sup‐
66 ported; these realm-exposed tickets hide the identity of the
67 client but not the client's realm. For this mode, use kinit -n
68 with a normal principal name. If supported by the KDC, the
69 principal (but not realm) will be replaced by the anonymous
70 principal. As of release 1.8, the MIT Kerberos KDC only sup‐
71 ports fully anonymous operation.
72 -c credentials_cache
74 Use credentials_cache as the credentials cache. The cache
75 should contain a service ticket for the kadmin/ADMINHOST (where
76 ADMINHOST is the fully-qualified hostname of the admin server)
77 or kadmin/admin service; it can be acquired with the kinit(1)
78 program. If this option is not specified, kadmin requests a new
79 service ticket from the KDC, and stores it in its own temporary
80 ccache.
81 -w password
83 Use password instead of prompting for one. Use this option with
84 care, as it may expose the password to other users on the system
85 via the process list.
86 -q query
88 Perform the specified query and then exit.
89 -d dbname
91 Specifies the name of the KDC database. This option does not
92 apply to the LDAP database module.
93 -s admin_server[:port]
95 Specifies the admin server which kadmin should contact.
96 -m If using kadmin.local, prompt for the database master password
98 instead of reading it from a stash file.
99 -e "enc:salt ..."
101 Sets the keysalt list to be used for any new keys created. See
102 Keysalt_lists in kdc.conf(5) for a list of possible values.
103 -O Force use of old AUTH_GSSAPI authentication flavor.
105 -N Prevent fallback to AUTH_GSSAPI authentication flavor.
107 -x db_args
109 Specifies the database specific arguments. See the next section
110 for supported options.
111 Starting with release 1.14, if any command-line arguments remain after
113 the options, they will be treated as a single query to be executed.
114 This mode of operation is intended for scripts and behaves differently
115 from the interactive mode in several respects:
116 · Query arguments are split by the shell, not by kadmin.
118 · Informational and warning messages are suppressed. Error messages
120 and query output (e.g. for get_principal) will still be displayed.
121 · Confirmation prompts are disabled (as if -force was given). Password
123 prompts will still be issued as required.
124 · The exit status will be non-zero if the query fails.
126 The -q option does not carry these behavior differences; the query will
128 be processed as if it was entered interactively. The -q option cannot
129 be used in combination with a query in the remaining arguments.
130
132 Database options can be used to override database-specific defaults.
133 Supported options for the DB2 module are:
134 -x dbname=*filename*
136 Specifies the base filename of the DB2 database.
137 -x lockiter
139 Make iteration operations hold the lock for the duration of
140 the entire operation, rather than temporarily releasing the
141 lock while handling each principal. This is the default
142 behavior, but this option exists to allow command line over‐
143 ride of a [dbmodules] setting. First introduced in release
144 1.13.
145 -x unlockiter
147 Make iteration operations unlock the database for each prin‐
148 cipal, instead of holding the lock for the duration of the
149 entire operation. First introduced in release 1.13.
150 Supported options for the LDAP module are:
152 -x host=ldapuri
154 Specifies the LDAP server to connect to by a LDAP URI.
155 -x binddn=bind_dn
157 Specifies the DN used to bind to the LDAP server.
158 -x bindpwd=password
160 Specifies the password or SASL secret used to bind to the
161 LDAP server. Using this option may expose the password to
162 other users on the system via the process list; to avoid
163 this, instead stash the password using the stashsrvpw command
164 of kdb5_ldap_util(8).
165 -x sasl_mech=mechanism
167 Specifies the SASL mechanism used to bind to the LDAP server.
168 The bind DN is ignored if a SASL mechanism is used. New in
169 release 1.13.
170 -x sasl_authcid=name
172 Specifies the authentication name used when binding to the
173 LDAP server with a SASL mechanism, if the mechanism requires
174 one. New in release 1.13.
175 -x sasl_authzid=name
177 Specifies the authorization name used when binding to the
178 LDAP server with a SASL mechanism. New in release 1.13.
179 -x sasl_realm=realm
181 Specifies the realm used when binding to the LDAP server with
182 a SASL mechanism, if the mechanism uses one. New in release
183 1.13.
184 -x debug=level
186 sets the OpenLDAP client library debug level. level is an
187 integer to be interpreted by the library. Debugging messages
188 are printed to standard error. New in release 1.12.
189
191 When using the remote client, available commands may be restricted
192 according to the privileges specified in the kadm5.acl(5) file on the
193 admin server.
194 add_principal
196 add_principal [options] newprinc
197 Creates the principal newprinc, prompting twice for a password. If no
199 password policy is specified with the -policy option, and the policy
200 named default is assigned to the principal if it exists. However, cre‐
201 ating a policy named default will not automatically assign this policy
202 to previously existing principals. This policy assignment can be sup‐
203 pressed with the -clearpolicy option.
204 This command requires the add privilege.
206 Aliases: addprinc, ank
208 Options:
210 -expire expdate
212 (getdate string) The expiration date of the principal.
213 -pwexpire pwexpdate
215 (getdate string) The password expiration date.
216 -maxlife maxlife
218 (duration or getdate string) The maximum ticket life for the
219 principal.
220 -maxrenewlife maxrenewlife
222 (duration or getdate string) The maximum renewable life of tick‐
223 ets for the principal.
224 -kvno kvno
226 The initial key version number.
227 -policy policy
229 The password policy used by this principal. If not specified,
230 the policy default is used if it exists (unless -clearpolicy is
231 specified).
232 -clearpolicy
234 Prevents any policy from being assigned when -policy is not
235 specified.
236 {-|+}allow_postdated
238 -allow_postdated prohibits this principal from obtaining post‐
239 dated tickets. +allow_postdated clears this flag.
240 {-|+}allow_forwardable
242 -allow_forwardable prohibits this principal from obtaining for‐
243 wardable tickets. +allow_forwardable clears this flag.
244 {-|+}allow_renewable
246 -allow_renewable prohibits this principal from obtaining renew‐
247 able tickets. +allow_renewable clears this flag.
248 {-|+}allow_proxiable
250 -allow_proxiable prohibits this principal from obtaining proxi‐
251 able tickets. +allow_proxiable clears this flag.
252 {-|+}allow_dup_skey
254 -allow_dup_skey disables user-to-user authentication for this
255 principal by prohibiting others from obtaining a service ticket
256 encrypted in this principal's TGT session key. +allow_dup_skey
257 clears this flag.
258 {-|+}requires_preauth
260 +requires_preauth requires this principal to preauthenticate
261 before being allowed to kinit. -requires_preauth clears this
262 flag. When +requires_preauth is set on a service principal, the
263 KDC will only issue service tickets for that service principal
264 if the client's initial authentication was performed using
265 preauthentication.
266 {-|+}requires_hwauth
268 +requires_hwauth requires this principal to preauthenticate
269 using a hardware device before being allowed to kinit.
270 -requires_hwauth clears this flag. When +requires_hwauth is set
271 on a service principal, the KDC will only issue service tickets
272 for that service principal if the client's initial authentica‐
273 tion was performed using a hardware device to preauthenticate.
274 {-|+}ok_as_delegate
276 +ok_as_delegate sets the okay as delegate flag on tickets issued
277 with this principal as the service. Clients may use this flag
278 as a hint that credentials should be delegated when authenticat‐
279 ing to the service. -ok_as_delegate clears this flag.
280 {-|+}allow_svr
282 -allow_svr prohibits the issuance of service tickets for this
283 principal. In release 1.17 and later, user-to-user service
284 tickets are still allowed unless the -allow_dup_skey flag is
285 also set. +allow_svr clears this flag.
286 {-|+}allow_tgs_req
288 -allow_tgs_req specifies that a Ticket-Granting Service (TGS)
289 request for a service ticket for this principal is not permit‐
290 ted. +allow_tgs_req clears this flag.
291 {-|+}allow_tix
293 -allow_tix forbids the issuance of any tickets for this princi‐
294 pal. +allow_tix clears this flag.
295 {-|+}needchange
297 +needchange forces a password change on the next initial authen‐
298 tication to this principal. -needchange clears this flag.
299 {-|+}password_changing_service
301 +password_changing_service marks this principal as a password
302 change service principal.
303 {-|+}ok_to_auth_as_delegate
305 +ok_to_auth_as_delegate allows this principal to acquire for‐
306 wardable tickets to itself from arbitrary users, for use with
307 constrained delegation.
308 {-|+}no_auth_data_required
310 +no_auth_data_required prevents PAC or AD-SIGNEDPATH data from
311 being added to service tickets for the principal.
312 {-|+}lockdown_keys
314 +lockdown_keys prevents keys for this principal from leaving the
315 KDC via kadmind. The chpass and extract operations are denied
316 for a principal with this attribute. The chrand operation is
317 allowed, but will not return the new keys. The delete and
318 rename operations are also denied if this attribute is set, in
319 order to prevent a malicious administrator from replacing prin‐
320 cipals like krbtgt/* or kadmin/* with new principals without the
321 attribute. This attribute can be set via the network protocol,
322 but can only be removed using kadmin.local.
323 -randkey
325 Sets the key of the principal to a random value.
326 -nokey Causes the principal to be created with no key. New in release
328 1.12.
329 -pw password
331 Sets the password of the principal to the specified string and
332 does not prompt for a password. Note: using this option in a
333 shell script may expose the password to other users on the sys‐
334 tem via the process list.
335 -e enc:salt,...
337 Uses the specified keysalt list for setting the keys of the
338 principal. See Keysalt_lists in kdc.conf(5) for a list of pos‐
339 sible values.
340 -x db_princ_args
342 Indicates database-specific options. The options for the LDAP
343 database module are:
344 -x dn=dn
346 Specifies the LDAP object that will contain the Kerberos
347 principal being created.
348 -x linkdn=dn
350 Specifies the LDAP object to which the newly created Ker‐
351 beros principal object will point.
352 -x containerdn=container_dn
354 Specifies the container object under which the Kerberos
355 principal is to be created.
356 -x tktpolicy=policy
358 Associates a ticket policy to the Kerberos principal.
359 NOTE:
361 · The containerdn and linkdn options cannot be specified with
363 the dn option.
364 · If the dn or containerdn options are not specified while
366 adding the principal, the principals are created under the
367 principal container configured in the realm or the realm
368 container.
369 · dn and containerdn should be within the subtrees or princi‐
371 pal container configured in the realm.
372 Example:
374 kadmin: addprinc jennifer
376 No policy specified for "jennifer@ATHENA.MIT.EDU";
377 defaulting to no policy.
378 Enter password for principal jennifer@ATHENA.MIT.EDU:
379 Re-enter password for principal jennifer@ATHENA.MIT.EDU:
380 Principal "jennifer@ATHENA.MIT.EDU" created.
381 kadmin:
382 modify_principal
384 modify_principal [options] principal
385 Modifies the specified principal, changing the fields as specified.
387 The options to add_principal also apply to this command, except for the
388 -randkey, -pw, and -e options. In addition, the option -clearpolicy
389 will clear the current policy of a principal.
390 This command requires the modify privilege.
392 Alias: modprinc
394 Options (in addition to the addprinc options):
396 -unlock
398 Unlocks a locked principal (one which has received too many
399 failed authentication attempts without enough time between them
400 according to its password policy) so that it can successfully
401 authenticate.
402 rename_principal
404 rename_principal [-force] old_principal new_principal
405 Renames the specified old_principal to new_principal. This command
407 prompts for confirmation, unless the -force option is given.
408 This command requires the add and delete privileges.
410 Alias: renprinc
412 delete_principal
414 delete_principal [-force] principal
415 Deletes the specified principal from the database. This command
417 prompts for deletion, unless the -force option is given.
418 This command requires the delete privilege.
420 Alias: delprinc
422 change_password
424 change_password [options] principal
425 Changes the password of principal. Prompts for a new password if nei‐
427 ther -randkey or -pw is specified.
428 This command requires the changepw privilege, or that the principal
430 running the program is the same as the principal being changed.
431 Alias: cpw
433 The following options are available:
435 -randkey
437 Sets the key of the principal to a random value.
438 -pw password
440 Set the password to the specified string. Using this option in
441 a script may expose the password to other users on the system
442 via the process list.
443 -e enc:salt,...
445 Uses the specified keysalt list for setting the keys of the
446 principal. See Keysalt_lists in kdc.conf(5) for a list of pos‐
447 sible values.
448 -keepold
450 Keeps the existing keys in the database. This flag is usually
451 not necessary except perhaps for krbtgt principals.
452 Example:
454 kadmin: cpw systest
456 Enter password for principal systest@BLEEP.COM:
457 Re-enter password for principal systest@BLEEP.COM:
458 Password for systest@BLEEP.COM changed.
459 kadmin:
460 purgekeys
462 purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal
463 Purges previously retained old keys (e.g., from change_password -keep‐
465 old) from principal. If -keepkvno is specified, then only purges keys
466 with kvnos lower than oldest_kvno_to_keep. If -all is specified, then
467 all keys are purged. The -all option is new in release 1.12.
468 This command requires the modify privilege.
470 get_principal
472 get_principal [-terse] principal
473 Gets the attributes of principal. With the -terse option, outputs
475 fields as quoted tab-separated strings.
476 This command requires the inquire privilege, or that the principal run‐
478 ning the the program to be the same as the one being listed.
479 Alias: getprinc
481 Examples:
483 kadmin: getprinc tlyu/admin
485 Principal: tlyu/admin@BLEEP.COM
486 Expiration date: [never]
487 Last password change: Mon Aug 12 14:16:47 EDT 1996
488 Password expiration date: [never]
489 Maximum ticket life: 0 days 10:00:00
490 Maximum renewable life: 7 days 00:00:00
491 Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
492 Last successful authentication: [never]
493 Last failed authentication: [never]
494 Failed password attempts: 0
495 Number of keys: 1
496 Key: vno 1, aes256-cts-hmac-sha384-192
497 MKey: vno 1
498 Attributes:
499 Policy: [none]
500 kadmin: getprinc -terse systest
502 systest@BLEEP.COM 3 86400 604800 1
503 785926535 753241234 785900000
504 tlyu/admin@BLEEP.COM 786100034 0 0
505 kadmin:
506 list_principals
508 list_principals [expression]
509 Retrieves all or some principal names. expression is a shell-style
511 glob expression that can contain the wild-card characters ?, *, and [].
512 All principal names matching the expression are printed. If no expres‐
513 sion is provided, all principal names are printed. If the expression
514 does not contain an @ character, an @ character followed by the local
515 realm is appended to the expression.
516 This command requires the list privilege.
518 Alias: listprincs, get_principals, get_princs
520 Example:
522 kadmin: listprincs test*
524 test3@SECURE-TEST.OV.COM
525 test2@SECURE-TEST.OV.COM
526 test1@SECURE-TEST.OV.COM
527 testuser@SECURE-TEST.OV.COM
528 kadmin:
529 get_strings
531 get_strings principal
532 Displays string attributes on principal.
534 This command requires the inquire privilege.
536 Alias: getstr
538 set_string
540 set_string principal name value
541 Sets a string attribute on principal. String attributes are used to
543 supply per-principal configuration to the KDC and some KDC plugin mod‐
544 ules. The following string attribute names are recognized by the KDC:
545 require_auth
547 Specifies an authentication indicator which is required to
548 authenticate to the principal as a service. Multiple indicators
549 can be specified, separated by spaces; in this case any of the
550 specified indicators will be accepted. (New in release 1.14.)
551 session_enctypes
553 Specifies the encryption types supported for session keys when
554 the principal is authenticated to as a server. See Encryp‐
555 tion_types in kdc.conf(5) for a list of the accepted values.
556 otp Enables One Time Passwords (OTP) preauthentication for a client
558 principal. The value is a JSON string representing an array of
559 objects, each having optional type and username fields.
560 pkinit_cert_match
562 Specifies a matching expression that defines the certificate
563 attributes required for the client certificate used by the prin‐
564 cipal during PKINIT authentication. The matching expression is
565 in the same format as those used by the pkinit_cert_match option
566 in krb5.conf(5). (New in release 1.16.)
567 This command requires the modify privilege.
569 Alias: setstr
571 Example:
573 set_string host/foo.mit.edu session_enctypes aes128-cts
575 set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"
576 del_string
578 del_string principal key
579 Deletes a string attribute from principal.
581 This command requires the delete privilege.
583 Alias: delstr
585 add_policy
587 add_policy [options] policy
588 Adds a password policy named policy to the database.
590 This command requires the add privilege.
592 Alias: addpol
594 The following options are available:
596 -maxlife time
598 (duration or getdate string) Sets the maximum lifetime of a
599 password.
600 -minlife time
602 (duration or getdate string) Sets the minimum lifetime of a
603 password.
604 -minlength length
606 Sets the minimum length of a password.
607 -minclasses number
609 Sets the minimum number of character classes required in a pass‐
610 word. The five character classes are lower case, upper case,
611 numbers, punctuation, and whitespace/unprintable characters.
612 -history number
614 Sets the number of past keys kept for a principal. This option
615 is not supported with the LDAP KDC database module.
616 -maxfailure maxnumber
618 Sets the number of authentication failures before the principal
619 is locked. Authentication failures are only tracked for princi‐
620 pals which require preauthentication. The counter of failed
621 attempts resets to 0 after a successful attempt to authenticate.
622 A maxnumber value of 0 (the default) disables lockout.
623 -failurecountinterval failuretime
625 (duration or getdate string) Sets the allowable time between
626 authentication failures. If an authentication failure happens
627 after failuretime has elapsed since the previous failure, the
628 number of authentication failures is reset to 1. A failuretime
629 value of 0 (the default) means forever.
630 -lockoutduration lockouttime
632 (duration or getdate string) Sets the duration for which the
633 principal is locked from authenticating if too many authentica‐
634 tion failures occur without the specified failure count interval
635 elapsing. A duration of 0 (the default) means the principal
636 remains locked out until it is administratively unlocked with
637 modprinc -unlock.
638 -allowedkeysalts
640 Specifies the key/salt tuples supported for long-term keys when
641 setting or changing a principal's password/keys. See
642 Keysalt_lists in kdc.conf(5) for a list of the accepted values,
643 but note that key/salt tuples must be separated with commas
644 (',') only. To clear the allowed key/salt policy use a value of
645 '-'.
646 Example:
648 kadmin: add_policy -maxlife "2 days" -minlength 5 guests
650 kadmin:
651 modify_policy
653 modify_policy [options] policy
654 Modifies the password policy named policy. Options are as described
656 for add_policy.
657 This command requires the modify privilege.
659 Alias: modpol
661 delete_policy
663 delete_policy [-force] policy
664 Deletes the password policy named policy. Prompts for confirmation
666 before deletion. The command will fail if the policy is in use by any
667 principals.
668 This command requires the delete privilege.
670 Alias: delpol
672 Example:
674 kadmin: del_policy guests
676 Are you sure you want to delete the policy "guests"?
677 (yes/no): yes
678 kadmin:
679 get_policy
681 get_policy [ -terse ] policy
682 Displays the values of the password policy named policy. With the
684 -terse flag, outputs the fields as quoted strings separated by tabs.
685 This command requires the inquire privilege.
687 Alias: getpol
689 Examples:
691 kadmin: get_policy admin
693 Policy: admin
694 Maximum password life: 180 days 00:00:00
695 Minimum password life: 00:00:00
696 Minimum password length: 6
697 Minimum number of password character classes: 2
698 Number of old keys kept: 5
699 Reference count: 17
700 kadmin: get_policy -terse admin
702 admin 15552000 0 6 2 5 17
703 kadmin:
704 The "Reference count" is the number of principals using that policy.
706 With the LDAP KDC database module, the reference count field is not
707 meaningful.
708 list_policies
710 list_policies [expression]
711 Retrieves all or some policy names. expression is a shell-style glob
713 expression that can contain the wild-card characters ?, *, and []. All
714 policy names matching the expression are printed. If no expression is
715 provided, all existing policy names are printed.
716 This command requires the list privilege.
718 Aliases: listpols, get_policies, getpols.
720 Examples:
722 kadmin: listpols
724 test-pol
725 dict-only
726 once-a-min
727 test-pol-nopw
728 kadmin: listpols t*
730 test-pol
731 test-pol-nopw
732 kadmin:
733 ktadd
735 ktadd [options] principal
736 ktadd [options] -glob princ-exp
737 Adds a principal, or all principals matching princ-exp, to a keytab
740 file. Each principal's keys are randomized in the process. The rules
741 for princ-exp are described in the list_principals command.
742 This command requires the inquire and changepw privileges. With the
744 -glob form, it also requires the list privilege.
745 The options are:
747 -k[eytab] keytab
749 Use keytab as the keytab file. Otherwise, the default keytab is
750 used.
751 -e enc:salt,...
753 Uses the specified keysalt list for setting the new keys of the
754 principal. See Keysalt_lists in kdc.conf(5) for a list of pos‐
755 sible values.
756 -q Display less verbose information.
758 -norandkey
760 Do not randomize the keys. The keys and their version numbers
761 stay unchanged. This option cannot be specified in combination
762 with the -e option.
763 An entry for each of the principal's unique encryption types is added,
765 ignoring multiple keys with the same encryption type but different salt
766 types.
767 Example:
769 kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu
771 Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
772 encryption type aes256-cts-hmac-sha1-96 added to keytab
773 FILE:/tmp/foo-new-keytab
774 kadmin:
775 ktremove
777 ktremove [options] principal [kvno | all | old]
778 Removes entries for the specified principal from a keytab. Requires no
780 permissions, since this does not require database access.
781 If the string "all" is specified, all entries for that principal are
783 removed; if the string "old" is specified, all entries for that princi‐
784 pal except those with the highest kvno are removed. Otherwise, the
785 value specified is parsed as an integer, and all entries whose kvno
786 match that integer are removed.
787 The options are:
789 -k[eytab] keytab
791 Use keytab as the keytab file. Otherwise, the default keytab is
792 used.
793 -q Display less verbose information.
795 Example:
797 kadmin: ktremove kadmin/admin all
799 Entry for principal kadmin/admin with kvno 3 removed from keytab
800 FILE:/etc/krb5.keytab
801 kadmin:
802 lock
804 Lock database exclusively. Use with extreme caution! This command
805 only works with the DB2 KDC database module.
806 unlock
808 Release the exclusive database lock.
809 list_requests
811 Lists available for kadmin requests.
812 Aliases: lr, ?
814 quit
816 Exit program. If the database was locked, the lock is released.
817 Aliases: exit, q
819
821 The kadmin program was originally written by Tom Yu at MIT, as an
822 interface to the OpenVision Kerberos administration program.
823
825 See kerberos(7) for a description of Kerberos environment variables.
826
828 kpasswd(1), kadmind(8), kerberos(7)
829
831 MIT
832
834 1985-2020, MIT
8351.18.2 KADMIN(1)