| blob | 5dc541721ebd47a1e6c8b3c1ab56ffd2f88690e3 |
1 '\" te
2 .\" This manual page is derived from documentation obtained from The Massachusetts Institute of Technology.
3 .\" Portions Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH KDB5_LDAP_UTIL 8 "Aug 28, 2007"
8 .SH NAME
9 kdb5_ldap_util \- Kerberos configuration utility
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fBkdb5_ldap_util\fR [\fB-D\fR \fIuser_dn\fR [\fB-w\fR \fIpasswd\fR]] [\fB-H\fR \fIldap_uri\fR] \fIcommand\fR
14 [\fIcommand_options\fR]
15 .fi
17 .SH DESCRIPTION
18 .sp
19 .LP
20 The \fBkdb5_ldap_util\fR utility allows an administrator to manage realms,
21 Kerberos services, and ticket policies. The utility offers a set of general
22 options, described under OPTIONS, and a set of commands, which, in turn, have
23 their own options. Commands and their options are described in their own
24 subsections, below.
25 .SH OPTIONS
26 .sp
27 .LP
28 \fBkdb5_ldap_util\fR has a small set of general options that apply to the
29 \fBkdb5_ldap_util\fR utility itself and a larger number of options that apply
30 to specific commands. A number of these command-specific options apply to
31 multiple commands and are described in their own section, below.
32 .SS "General Options"
33 .sp
34 .LP
35 The following general options are supported:
36 .sp
37 .ne 2
38 .na
39 \fB\fB-D\fR \fIuser_dn\fR\fR
40 .ad
41 .sp .6
42 .RS 4n
43 Specifies the distinguished name (DN) of a user who has sufficient rights to
44 perform the operation on the LDAP server.
45 .RE
47 .sp
48 .ne 2
49 .na
50 \fB\fB-H\fR \fIldap_uri\fR\fR
51 .ad
52 .sp .6
53 .RS 4n
54 Specifies the URI of the LDAP server.
55 .RE
57 .sp
58 .ne 2
59 .na
60 \fB\fB-w\fR \fIpasswd\fR\fR
61 .ad
62 .sp .6
63 .RS 4n
64 Specifies the password of \fIuser_dn\fR. This option is not recommended.
65 .RE
67 .SS "Common Command-specific Options"
68 .sp
69 .LP
70 The following options apply to a number of \fBkdb5_ldap_util\fR commands.
71 .sp
72 .ne 2
73 .na
74 \fB\fB-subtrees\fR \fIsubtree_dn_list\fR\fR
75 .ad
76 .sp .6
77 .RS 4n
78 Specifies the list of subtrees containing the principals of a realm. The list
79 contains the DNs of the subtree objects separated by a colon.
80 .RE
82 .sp
83 .ne 2
84 .na
85 \fB\fB-sscope\fR \fIsearch_scope\fR\fR
86 .ad
87 .sp .6
88 .RS 4n
89 Specifies the scope for searching the principals under a subtree. The possible
90 values are 1 or \fBone\fR (one level), 2 or \fBsub\fR (subtrees).
91 .RE
93 .sp
94 .ne 2
95 .na
96 \fB\fB-containerref\fR \fIcontainer_reference_dn\fR\fR
97 .ad
98 .sp .6
99 .RS 4n
100 Specifies the DN of the container object in which the principals of a realm
101 will be created. If the container reference is not configured for a realm, the
102 principals will be created in the realm container.
103 .RE
105 .sp
106 .ne 2
107 .na
108 \fB\fB-maxtktlife\fR \fImax_ticket_life\fR\fR
109 .ad
110 .sp .6
111 .RS 4n
112 Specifies maximum ticket life for principals in this realm.
113 .RE
115 .sp
116 .ne 2
117 .na
118 \fB\fB-maxrenewlife\fR \fImax_renewable_ticket_life\fR\fR
119 .ad
120 .sp .6
121 .RS 4n
122 Specifies maximum renewable life of tickets for principals in this realm.
123 .RE
125 .sp
126 .ne 2
127 .na
128 \fB\fB-r\fR \fIrealm\fR\fR
129 .ad
130 .sp .6
131 .RS 4n
132 Specifies the Kerberos realm of the database; by default the realm returned by
133 \fBkrb5_default_local_realm\fR(3LIB) is used.
134 .RE
136 .SH \fBkdb5_ldap_util\fR COMMANDS
137 .sp
138 .LP
139 The \fBkdb5_ldap_util\fR utility comprises a set of commands, each with its own
140 set of options. These commands are described in the following subsections.
141 .SS "The \fBcreate\fR Command"
142 .sp
143 .LP
144 The \fBcreate\fR command creates a realm in a directory. The command has the
145 following syntax:
146 .sp
147 .in +2
148 .nf
149 create \e
150 [-subtrees \fIsubtree_dn_list\fR]
151 [-sscope \fIsearch_scope\fR]
152 [-containerref \fIcontainer_reference_dn\fR]
153 [-k \fImkeytype\fR]
154 [-m|-P \fIpassword\fR| -sf \fIstashfilename\fR]
155 [-s]
156 [-r \fIrealm\fR]
157 [-maxtktlife \fImax_ticket_life\fR]
158 [-kdcdn \fIkdc_service_list\fR]
159 [-admindn \fIadmin_service_list\fR]
160 [-maxrenewlife \fImax_renewable_ticket_life\fR]
161 [\fIticket_flags\fR]
162 .fi
163 .in -2
164 .sp
166 .sp
167 .LP
168 The \fBcreate\fR command has the following options:
169 .sp
170 .ne 2
171 .na
172 \fB\fB-subtree\fR \fIsubtree_dn_list\fR\fR
173 .ad
174 .sp .6
175 .RS 4n
176 See "Common Command-specific Options," above.
177 .RE
179 .sp
180 .ne 2
181 .na
182 \fB\fB-sscope\fR \fIsearch_scope\fR\fR
183 .ad
184 .sp .6
185 .RS 4n
186 See "Common Command-specific Options," above.
187 .RE
189 .sp
190 .ne 2
191 .na
192 \fB\fB-containerref\fR \fIcontainer_reference_dn\fR\fR
193 .ad
194 .sp .6
195 .RS 4n
196 See "Common Command-specific Options," above.
197 .RE
199 .sp
200 .ne 2
201 .na
202 \fB\fB-k\fR \fImkeytype\fR\fR
203 .ad
204 .sp .6
205 .RS 4n
206 Specifies the key type of the master key in the database; the default is that
207 given in \fBkdc.conf\fR(4).
208 .RE
210 .sp
211 .ne 2
212 .na
213 \fB\fB-m\fR\fR
214 .ad
215 .sp .6
216 .RS 4n
217 Specifies that the master database password should be read from the TTY rather
218 than fetched from a file on the disk.
219 .RE
221 .sp
222 .ne 2
223 .na
224 \fB\fB-P\fR \fIpassword\fR\fR
225 .ad
226 .sp .6
227 .RS 4n
228 Specifies the master database password. This option is not recommended.
229 .RE
231 .sp
232 .ne 2
233 .na
234 \fB\fB-sf\fR \fIstashfilename\fR\fR
235 .ad
236 .sp .6
237 .RS 4n
238 Specifies the stash file of the master database password.
239 .RE
241 .sp
242 .ne 2
243 .na
244 \fB\fB-s\fR\fR
245 .ad
246 .sp .6
247 .RS 4n
248 Specifies that the stash file is to be created.
249 .RE
251 .sp
252 .ne 2
253 .na
254 \fB\fB-maxtktlife\fR \fImax_ticket_life\fR\fR
255 .ad
256 .sp .6
257 .RS 4n
258 See "Common Command-specific Options," above.
259 .RE
261 .sp
262 .ne 2
263 .na
264 \fB\fB-maxrenewlife\fR \fImax_renewable_ticket_life\fR\fR
265 .ad
266 .sp .6
267 .RS 4n
268 See "Common Command-specific Options," above.
269 .RE
271 .sp
272 .ne 2
273 .na
274 \fB\fB-r\fR \fIrealm\fR\fR
275 .ad
276 .sp .6
277 .RS 4n
278 See "Common Command-specific Options," above.
279 .RE
281 .sp
282 .ne 2
283 .na
284 \fB\fIticket_flags\fR\fR
285 .ad
286 .sp .6
287 .RS 4n
288 Specifies the ticket flags. If this option is not specified, by default, none
289 of the flags are set. This means all the ticket options will be allowed and no
290 restriction will be set. See "Ticket Flags" for a list and descriptions of
291 these flags.
292 .RE
294 .SS "The \fBmodify\fR Command"
295 .sp
296 .LP
297 The \fBmodify\fR command modifies the attributes of a realm. The command has
298 the following syntax:
299 .sp
300 .in +2
301 .nf
302 modify \e
303 [-subtrees \fIsubtree_dn_list\fR]
304 [-sscope \fIsearch_scope\fR]
305 [-containerref \fIcontainer_reference_dn\fR]
306 [-r \fIrealm\fR]
307 [-maxtktlife \fImax_ticket_life\fR]
308 [-maxrenewlife \fImax_renewable_ticket_life\fR]
309 [\fIticket_flags\fR]
310 .fi
311 .in -2
312 .sp
314 .sp
315 .LP
316 The \fBmodify\fR command has the following options:
317 .sp
318 .ne 2
319 .na
320 \fB\fB-subtree\fR \fIsubtree_dn_list\fR\fR
321 .ad
322 .sp .6
323 .RS 4n
324 See "Common Command-specific Options," above.
325 .RE
327 .sp
328 .ne 2
329 .na
330 \fB\fB-sscope\fR \fIsearch_scope\fR\fR
331 .ad
332 .sp .6
333 .RS 4n
334 See "Common Command-specific Options," above.
335 .RE
337 .sp
338 .ne 2
339 .na
340 \fB\fB-containerref\fR \fIcontainer_reference_dn\fR\fR
341 .ad
342 .sp .6
343 .RS 4n
344 See "Common Command-specific Options," above.
345 .RE
347 .sp
348 .ne 2
349 .na
350 \fB\fB-maxtktlife\fR \fImax_ticket_life\fR\fR
351 .ad
352 .sp .6
353 .RS 4n
354 See "Common Command-specific Options," above.
355 .RE
357 .sp
358 .ne 2
359 .na
360 \fB\fB-maxrenewlife\fR \fImax_renewable_ticket_life\fR\fR
361 .ad
362 .sp .6
363 .RS 4n
364 See "Common Command-specific Options," above.
365 .RE
367 .sp
368 .ne 2
369 .na
370 \fB\fB-r\fR \fIrealm\fR\fR
371 .ad
372 .sp .6
373 .RS 4n
374 See "Common Command-specific Options," above.
375 .RE
377 .sp
378 .ne 2
379 .na
380 \fB\fIticket_flags\fR\fR
381 .ad
382 .sp .6
383 .RS 4n
384 Specifies the ticket flags. If this option is not specified, by default, none
385 of the flags are set. This means all the ticket options will be allowed and no
386 restriction will be set. See "Ticket Flags" for a list and descriptions of
387 these flags.
388 .RE
390 .SS "The \fBview\fR Command"
391 .sp
392 .LP
393 The \fBview\fR command displays the attributes of a realm. The command has the
394 following syntax:
395 .sp
396 .in +2
397 .nf
398 view [-r \fIrealm\fR]
399 .fi
400 .in -2
401 .sp
403 .sp
404 .LP
405 The \fBview\fR command has the following option:
406 .sp
407 .ne 2
408 .na
409 \fB\fB-r\fR \fIrealm\fR\fR
410 .ad
411 .sp .6
412 .RS 4n
413 See "Common Command-specific Options," above.
414 .RE
416 .SS "The \fBdestroy\fR Command"
417 .sp
418 .LP
419 The \fBdestroy\fR command destroys a realm, including the master key stash
420 file. The command has the following syntax:
421 .sp
422 .in +2
423 .nf
424 destroy [-f] [-r \fIrealm\fR]
425 .fi
426 .in -2
427 .sp
429 .sp
430 .LP
431 The \fBdestroy\fR command has the following options:
432 .sp
433 .ne 2
434 .na
435 \fB\fB-f\fR\fR
436 .ad
437 .sp .6
438 .RS 4n
439 If specified, \fBdestroy\fR does not prompt you for confirmation.
440 .RE
442 .sp
443 .ne 2
444 .na
445 \fB\fB-r\fR \fIrealm\fR\fR
446 .ad
447 .sp .6
448 .RS 4n
449 See "Common Command-specific Options," above.
450 .RE
452 .SS "The \fBlist\fR Command"
453 .sp
454 .LP
455 The \fBlist\fR command displays the names of realms. The command has the
456 following syntax:
457 .sp
458 .in +2
459 .nf
460 list
461 .fi
462 .in -2
463 .sp
465 .sp
466 .LP
467 The \fBlist\fR command has no options.
468 .SS "The \fBstashsrvpw\fR Command"
469 .sp
470 .LP
471 The \fBstashsrvpw\fR command enables you to store the password for service
472 object in a file so that a KDC and Administration server can use it to
473 authenticate to the LDAP server. The command has the following syntax:
474 .sp
475 .in +2
476 .nf
477 stashsrvpw [-f \fIfilename\fR] \fIservicedn\fR
478 .fi
479 .in -2
480 .sp
482 .sp
483 .LP
484 The \fBstashsrvpw\fR command has the following option and argument:
485 .sp
486 .ne 2
487 .na
488 \fB\fB-f\fR \fIfilename\fR\fR
489 .ad
490 .sp .6
491 .RS 4n
492 Specifies the complete path of the service password file. The default is:
493 .sp
494 .in +2
495 .nf
496 /var/krb5/service_passwd
497 .fi
498 .in -2
499 .sp
501 .RE
503 .sp
504 .ne 2
505 .na
506 \fB\fIservicedn\fR\fR
507 .ad
508 .sp .6
509 .RS 4n
510 Specifies the distinguished name (DN) of the service object whose password is
511 to be stored in file.
512 .RE
514 .SS "The \fBcreate_policy\fR Command"
515 .sp
516 .LP
517 The \fBcreate_policy\fR command creates a ticket policy in a directory. The
518 command has the following syntax:
519 .sp
520 .in +2
521 .nf
522 create_policy \e
523 [-r \fIrealm\fR]
524 [-maxtktlife \fImax_ticket_life\fR]
525 [-maxrenewlife \fImax_renewable_ticket_life\fR]
526 [\fIticket_flags\fR]
527 \fIpolicy_name\fR
528 .fi
529 .in -2
530 .sp
532 .sp
533 .LP
534 The \fBcreate_policy\fR command has the following options:
535 .sp
536 .ne 2
537 .na
538 \fB\fB-r\fR \fIrealm\fR\fR
539 .ad
540 .sp .6
541 .RS 4n
542 See "Common Command-specific Options," above.
543 .RE
545 .sp
546 .ne 2
547 .na
548 \fB\fB-maxtktlife\fR \fImax_ticket_life\fR\fR
549 .ad
550 .sp .6
551 .RS 4n
552 See "Common Command-specific Options," above.
553 .RE
555 .sp
556 .ne 2
557 .na
558 \fB\fB-maxrenewlife\fR \fImax_renewable_ticket_life\fR\fR
559 .ad
560 .sp .6
561 .RS 4n
562 See "Common Command-specific Options," above.
563 .RE
565 .sp
566 .ne 2
567 .na
568 \fB\fIticket_flags\fR\fR
569 .ad
570 .sp .6
571 .RS 4n
572 Specifies the ticket flags. If this option is not specified, by default, none
573 of the flags are set. This means all the ticket options will be allowed and no
574 restriction will be set. See "Ticket Flags" for a list and descriptions of
575 these flags.
576 .RE
578 .sp
579 .ne 2
580 .na
581 \fB\fIpolicy_name\fR\fR
582 .ad
583 .sp .6
584 .RS 4n
585 Specifies the name of the ticket policy.
586 .RE
588 .SS "The \fBmodify_policy\fR Command"
589 .sp
590 .LP
591 The \fBmodify_policy\fR command modifies the attributes of a ticket policy. The
592 command has the following syntax:
593 .sp
594 .in +2
595 .nf
596 modify_policy \e
597 [-r \fIrealm\fR]
598 [-maxtktlife \fImax_ticket_life\fR]
599 [-maxrenewlife \fImax_renewable_ticket_life\fR]
600 [\fIticket_flags\fR]
601 \fIpolicy_name\fR
602 .fi
603 .in -2
604 .sp
606 .sp
607 .LP
608 The \fBmodify_policy\fR command has the same options and argument as those for
609 the \fBcreate_policy\fR command.
610 .SS "The \fBview_policy\fR Command"
611 .sp
612 .LP
613 The \fBview_policy\fR command displays the attributes of a ticket policy. The
614 command has the following syntax:
615 .sp
616 .in +2
617 .nf
618 view_policy [-r \fIrealm\fR] \fIpolicy_name\fR
619 .fi
620 .in -2
621 .sp
623 .sp
624 .LP
625 The \fBview_policy\fR command has the following options:
626 .sp
627 .ne 2
628 .na
629 \fB\fB-r\fR \fIrealm\fR\fR
630 .ad
631 .sp .6
632 .RS 4n
633 See "Common Command-specific Options," above.
634 .RE
636 .sp
637 .ne 2
638 .na
639 \fB\fIpolicy_name\fR\fR
640 .ad
641 .sp .6
642 .RS 4n
643 Specifies the name of the ticket policy.
644 .RE
646 .SS "The \fBdestroy_policy\fR Command"
647 .sp
648 .LP
649 The \fBdestroy_policy\fR command destroys an existing ticket policy. The
650 command has the following syntax:
651 .sp
652 .in +2
653 .nf
654 destroy_policy [-r \fIrealm\fR] [-force] \fIpolicy_name\fR
655 .fi
656 .in -2
657 .sp
659 .sp
660 .LP
661 The \fBdestroy_policy\fR command has the following options:
662 .sp
663 .ne 2
664 .na
665 \fB\fB-r\fR \fIrealm\fR\fR
666 .ad
667 .sp .6
668 .RS 4n
669 See "Common Command-specific Options," above.
670 .RE
672 .sp
673 .ne 2
674 .na
675 \fB\fB-force\fR\fR
676 .ad
677 .sp .6
678 .RS 4n
679 Forces the deletion of the policy object. If not specified, you will be
680 prompted for confirmation before the policy is deleted. Enter \fByes\fR to
681 confirm the deletion.
682 .RE
684 .sp
685 .ne 2
686 .na
687 \fB\fIpolicy_name\fR\fR
688 .ad
689 .sp .6
690 .RS 4n
691 Specifies the name of the ticket policy.
692 .RE
694 .SS "The \fBlist_policy\fR Command"
695 .sp
696 .LP
697 The \fBlist_policy\fR command lists the ticket policies in the default or a
698 specified realm. The command has the following syntax:
699 .sp
700 .in +2
701 .nf
702 list_policy [-r \fIrealm\fR]
703 .fi
704 .in -2
705 .sp
707 .sp
708 .LP
709 The \fBlist_policy\fR command has the following option:
710 .sp
711 .ne 2
712 .na
713 \fB\fB-r\fR \fIrealm\fR\fR
714 .ad
715 .sp .6
716 .RS 4n
717 See "Common Command-specific Options," above.
718 .RE
720 .SH TICKET FLAGS
721 .sp
722 .LP
723 A number of \fBkdb5_ldap_util\fR commands have \fBticket_flag\fR options. These
724 flags are described as follows:
725 .sp
726 .ne 2
727 .na
728 \fB\fB{-|+}allow_dup_skey\fR\fR
729 .ad
730 .sp .6
731 .RS 4n
732 \fB-allow_dup_skey\fR disables user-to-user authentication for principals by
733 prohibiting principals from obtaining a session key for another user. This
734 setting sets the \fBKRB5_KDB_DISALLOW_DUP_SKEY\fR flag. \fB+allow_dup_skey\fR
735 clears this flag.
736 .RE
738 .sp
739 .ne 2
740 .na
741 \fB\fB{-|+}allow_forwardable\fR\fR
742 .ad
743 .sp .6
744 .RS 4n
745 \fB-allow_forwardable\fR prohibits principals from obtaining forwardable
746 tickets. This setting sets the \fBKRB5_KDB_DISALLOW_FORWARDABLE\fR flag.
747 \fB+allow_forwardable\fR clears this flag.
748 .RE
750 .sp
751 .ne 2
752 .na
753 \fB\fB{-|+}allow_postdated\fR\fR
754 .ad
755 .sp .6
756 .RS 4n
757 \fB-allow_postdated\fR prohibits principals from obtaining postdated tickets.
758 This setting sets the \fBKRB5_KDB_DISALLOW_POSTDATED\fR flag.
759 \fB+allow_postdated\fR clears this flag.
760 .RE
762 .sp
763 .ne 2
764 .na
765 \fB\fB{-|+}allow_proxiable\fR\fR
766 .ad
767 .sp .6
768 .RS 4n
769 \fB-allow_proxiable\fR prohibits principals from obtaining proxiable tickets.
770 This setting sets the \fBKRB5_KDB_DISALLOW_PROXIABLE\fR flag.
771 \fB+allow_proxiable\fR clears this flag.
772 .RE
774 .sp
775 .ne 2
776 .na
777 \fB\fB{-|+}allow_renewable\fR\fR
778 .ad
779 .sp .6
780 .RS 4n
781 \fB-allow_renewable\fR prohibits principals from obtaining renewable tickets.
782 This setting sets the \fBKRB5_KDB_DISALLOW_RENEWABLE\fR flag.
783 \fB+allow_renewable\fR clears this flag.
784 .RE
786 .sp
787 .ne 2
788 .na
789 \fB\fB{-|+}allow_svr\fR\fR
790 .ad
791 .sp .6
792 .RS 4n
793 \fB-allow_svr\fR prohibits the issuance of service tickets for principals. This
794 setting sets the \fBKRB5_KDB_DISALLOW_SVR\fR flag. \fB+allow_svr\fR clears
795 this flag.
796 .RE
798 .sp
799 .ne 2
800 .na
801 \fB\fB{-|+}allow_tgs_req\fR\fR
802 .ad
803 .sp .6
804 .RS 4n
805 \fB-allow_tgs_req\fR specifies that a Ticket-Granting Service (TGS) request for
806 a service ticket for principals is not permitted. This option is useless for
807 most purposes. \fB+allow_tgs_req\fR clears this flag. The default is
808 \fB+allow_tgs_req\fR. In effect, \fB-allow_tgs_req\fR sets the
809 \fBKRB5_KDB_DISALLOW_TGT_BASED\fR flag on principals in the database.
810 .RE
812 .sp
813 .ne 2
814 .na
815 \fB\fB{-|+}allow_tix\fR\fR
816 .ad
817 .sp .6
818 .RS 4n
819 \fB-allow_tix\fR forbids the issuance of any tickets for principals.
820 \fB+allow_tix\fR clears this flag. The default is \fB+allow_tix\fR. In effect,
821 \fB-allow_tix\fR sets the \fBKRB5_KDB_DISALLOW_ALL_TIX\fR flag on principals in
822 the database.
823 .RE
825 .sp
826 .ne 2
827 .na
828 \fB\fB{-|+}needchange\fR\fR
829 .ad
830 .sp .6
831 .RS 4n
832 \fB+needchange\fR sets a flag in the attributes field to force a password
833 change; \fB-needchange\fR clears that flag. The default is \fB-needchange\fR.
834 In effect, \fB+needchange\fR sets the \fBKRB5_KDB_REQUIRES_PWCHANGE\fR flag on
835 principals in the database.
836 .RE
838 .sp
839 .ne 2
840 .na
841 \fB\fB{-|+}password_changing_service\fR\fR
842 .ad
843 .sp .6
844 .RS 4n
845 \fB+password_changing_service\fR sets a flag in the attributes field marking a
846 principal as a password-change-service principal (a designation that is most
847 often not useful). \fB-password_changing_service\fR clears the flag. That this
848 flag has a long name is intentional. The default is
849 \fB-password_changing_service\fR. In effect, \fB+password_changing_service\fR
850 sets the \fBKRB5_KDB_PWCHANGE_SERVICE\fR flag on principals in the database.
851 .RE
853 .sp
854 .ne 2
855 .na
856 \fB\fB{-|+}requires_hwauth\fR\fR
857 .ad
858 .sp .6
859 .RS 4n
860 \fB+requires_hwauth\fR requires principals to preauthenticate using a hardware
861 device before being allowed to \fBkinit\fR(1). This setting sets the
862 \fBKRB5_KDB_REQUIRES_HW_AUTH\fR flag. \fB-requires_hwauth\fR clears this flag.
863 .RE
865 .sp
866 .ne 2
867 .na
868 \fB\fB{-|+}requires_preauth\fR\fR
869 .ad
870 .sp .6
871 .RS 4n
872 +\fBrequires_preauth\fR requires principals to preauthenticate before being
873 allowed to \fBkinit\fR(1). This setting sets the
874 \fBKRB5_KDB_REQUIRES_PRE_AUTH\fR flag. \fB-requires_preauth\fR clears this
875 flag.
876 .RE
878 .SH EXAMPLES
879 .LP
880 \fBExample 1 \fRUsing \fBcreate\fR
881 .sp
882 .LP
883 The following is an example of the use of the \fBcreate\fR command.
885 .sp
886 .in +2
887 .nf
888 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
889 create -subtrees o=org -sscope SUB -r ATHENA.MIT.EDU\fR
890 Password for "cn=admin,o=org": \fIpassword entered\fR
891 Initializing database for realm 'ATHENA.MIT.EDU'
892 You will be prompted for the database Master Password.
893 It is important that you NOT FORGET this password.
894 Enter KDC database master key: \fImaster key entered\fR
895 Re-enter KDC database master key to verify: \fImaster key re-entered\fRjjjjjj
896 .fi
897 .in -2
898 .sp
900 .LP
901 \fBExample 2 \fRUsing \fBmodify\fR
902 .sp
903 .LP
904 The following is an example of the use of the \fBmodify\fR command.
906 .sp
907 .in +2
908 .nf
909 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
910 modify +requires_preauth -r ATHENA.MIT.EDU\fR
911 Password for "cn=admin,o=org": \fIpassword entered\fR
912 Password for "cn=admin,o=org": \fIpassword entered\fR
913 .fi
914 .in -2
915 .sp
917 .LP
918 \fBExample 3 \fRUsing \fBview\fR
919 .sp
920 .LP
921 The following is an example of the use of the \fBview\fR command.
923 .sp
924 .in +2
925 .nf
926 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
927 view -r ATHENA.MIT.EDU\fR
928 Password for "cn=admin,o=org":
929 Realm Name: ATHENA.MIT.EDU
930 Subtree: ou=users,o=org
931 Subtree: ou=servers,o=org
932 SearchScope: ONE
933 Maximum ticket life: 0 days 01:00:00
934 Maximum renewable life: 0 days 10:00:00
935 Ticket flags: DISALLOW_FORWARDABLE REQUIRES_PWCHANGE
936 .fi
937 .in -2
938 .sp
940 .LP
941 \fBExample 4 \fRUsing \fBdestroy\fR
942 .sp
943 .LP
944 The following is an example of the use of the \fBdestroy\fR command.
946 .sp
947 .in +2
948 .nf
949 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
950 destroy -r ATHENA.MIT.EDU\fR
951 Password for "cn=admin,o=org": \fIpassword entered\fR
952 Deleting KDC database of 'ATHENA.MIT.EDU', are you sure?
953 (type 'yes' to confirm)? \fByes\fR
954 OK, deleting database of 'ATHENA.MIT.EDU'...
955 .fi
956 .in -2
957 .sp
959 .LP
960 \fBExample 5 \fRUsing \fBlist\fR
961 .sp
962 .LP
963 The following is an example of the use of the \fBlist\fR command.
965 .sp
966 .in +2
967 .nf
968 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu list\fR
969 Password for "cn=admin,o=org": \fIpassword entered\fR
970 Re-enter Password for "cn=admin,o=org": \fIpassword re-entered\fR
971 ATHENA.MIT.EDU
972 OPENLDAP.MIT.EDU
973 MEDIA-LAB.MIT.EDU
974 .fi
975 .in -2
976 .sp
978 .LP
979 \fBExample 6 \fRUsing \fBstashsrvpw\fR
980 .sp
981 .LP
982 The following is an example of the use of the \fBstashsrvpw\fR command.
984 .sp
985 .in +2
986 .nf
987 # \fBkdb5_ldap_util stashsrvpw -f \e
988 /home/andrew/conf_keyfile cn=service-kdc,o=org\fR
989 Password for "cn=service-kdc,o=org": \fIpassword entered\fR
990 Re-enter password for "cn=service-kdc,o=org": \fIpassword re-entered\fR
991 .fi
992 .in -2
993 .sp
995 .LP
996 \fBExample 7 \fRUsing \fBcreate_policy\fR
997 .sp
998 .LP
999 The following is an example of the use of the \fBcreate_policy\fR command.
1001 .sp
1002 .in +2
1003 .nf
1004 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
1005 create_policy -r ATHENA.MIT.EDU \e
1006 -maxtktlife "1 day" -maxrenewlife "1 week" \e
1007 -allow_postdated +needchange -allow_forwardable \fItktpolicy\fR\fR
1008 Password for "cn=admin,o=org": \fIpassword entered\fR
1009 .fi
1010 .in -2
1011 .sp
1013 .LP
1014 \fBExample 8 \fRUsing \fBmodify_policy\fR
1015 .sp
1016 .LP
1017 The following is an example of the use of the \fBmodify_policy\fR command.
1019 .sp
1020 .in +2
1021 .nf
1022 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
1023 modify_policy -r ATHENA.MIT.EDU \e
1024 -maxtktlife "60 minutes" -maxrenewlife "10 hours" \e
1025 +allow_postdated -requires_preauth \fItktpolicy\fR\fR
1026 Password for "cn=admin,o=org": \fIpassword entered\fR
1027 .fi
1028 .in -2
1029 .sp
1031 .LP
1032 \fBExample 9 \fRUsing \fBview_policy\fR
1033 .sp
1034 .LP
1035 The following is an example of the use of the \fBview_policy\fR command.
1037 .sp
1038 .in +2
1039 .nf
1040 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
1041 view_policy -r ATHENA.MIT.EDU \fItktpolicy\fR\fR
1042 Password for "cn=admin,o=org": \fIpassword entered\fR
1043 Ticket policy: tktpolicy
1044 Maximum ticket life: 0 days 01:00:00
1045 Maximum renewable life: 0 days 10:00:00
1046 Ticket flags: DISALLOW_FORWARDABLE REQUIRES_PWCHANGE
1047 .fi
1048 .in -2
1049 .sp
1051 .LP
1052 \fBExample 10 \fRUsing \fBdestroy_policy\fR
1053 .sp
1054 .LP
1055 The following is an example of the use of the \fBdestroy_policy\fR command.
1057 .sp
1058 .in +2
1059 .nf
1060 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
1061 destroy_policy -r ATHENA.MIT.EDU \fItktpolicy\fR\fR
1062 Password for "cn=admin,o=org": \fIpassword entered\fR
1063 This will delete the policy object 'tktpolicy', are you sure?
1064 (type 'yes' to confirm)? \fByes\fR
1065 ** policy object '\fItktpolicy\fR' deleted.
1066 .fi
1067 .in -2
1068 .sp
1070 .LP
1071 \fBExample 11 \fRUsing \fBlist_policy\fR
1072 .sp
1073 .LP
1074 The following is an example of the use of the \fBlist_policy\fR command.
1076 .sp
1077 .in +2
1078 .nf
1079 # \fBkdb5_ldap_util -D cn=admin,o=org -H ldaps://ldap-server1.mit.edu \e
1080 list_policy -r ATHENA.MIT.EDU\fR
1081 Password for "cn=admin,o=org": \fIpassword entered\fR
1082 tktpolicy
1083 tmppolicy
1084 userpolicy
1085 .fi
1086 .in -2
1087 .sp
1089 .LP
1090 \fBExample 12 \fRUsing \fBsetsrvpw\fR
1091 .sp
1092 .LP
1093 The following is an example of the use of the \fBsetsrvpw\fR command.
1095 .sp
1096 .in +2
1097 .nf
1098 # \fBkdb5_ldap_util setsrvpw -D cn=admin,o=org setsrvpw \e
1099 -fileonly -f /home/andrew/conf_keyfile cn=service-kdc,o=org\fR
1100 Password for "cn=admin,o=org": \fIpassword entered\fR
1101 Password for "cn=service-kdc,o=org": \fIpassword entered\fR
1102 Re-enter password for "cn=service-kdc,o=org": \fIpassword re-entered\fR
1103 .fi
1104 .in -2
1105 .sp
1107 .LP
1108 \fBExample 13 \fRUsing \fBcreate_service\fR
1109 .sp
1110 .LP
1111 The following is an example of the use of the \fBcreate_service\fR command.
1113 .sp
1114 .in +2
1115 .nf
1116 # \fBkdb5_ldap_util -D cn=admin,o=org create_service \e
1117 -kdc -randpw -f /home/andrew/conf_keyfile cn=service-kdc,o=org\fR
1118 Password for "cn=admin,o=org": \fIpassword entered\fR
1119 File does not exist. Creating the file /home/andrew/conf_keyfile...
1120 .fi
1121 .in -2
1122 .sp
1124 .LP
1125 \fBExample 14 \fRUsing \fBmodify_service\fR
1126 .sp
1127 .LP
1128 The following is an example of the use of the \fBmodify_service\fR command.
1130 .sp
1131 .in +2
1132 .nf
1133 # \fBkdb5_ldap_util -D cn=admin,o=org modify_service \e
1134 -realm ATHENA.MIT.EDU cn=service-kdc,o=org\fR
1135 Password for "cn=admin,o=org": \fIpassword entered\fR
1136 Changing rights for the service object. Please wait ... done
1137 .fi
1138 .in -2
1139 .sp
1141 .LP
1142 \fBExample 15 \fRUsing \fBview_service\fR
1143 .sp
1144 .LP
1145 The following is an example of the use of the \fBview_service\fR command.
1147 .sp
1148 .in +2
1149 .nf
1150 # \fBkdb5_ldap_util -D cn=admin,o=org view_service \e
1151 cn=service-kdc,o=org\fR
1152 Password for "cn=admin,o=org": \fIpassword entered\fR
1153 Service dn: cn=service-kdc,o=org
1154 Service type: kdc
1155 Service host list:
1156 Realm DN list: cn=ATHENA.MIT.EDU,cn=Kerberos,cn=Security
1157 .fi
1158 .in -2
1159 .sp
1161 .LP
1162 \fBExample 16 \fRUsing \fBdestroy_service\fR
1163 .sp
1164 .LP
1165 The following is an example of the use of the \fBdestroy_service\fR command.
1167 .sp
1168 .in +2
1169 .nf
1170 # \fBkdb5_ldap_util -D cn=admin,o=org destroy_service \e
1171 cn=service-kdc,o=org\fR
1172 Password for "cn=admin,o=org": \fIpassword entered\fR
1173 This will delete the service object 'cn=service-kdc,o=org', are you sure?
1174 (type 'yes' to confirm)? \fByes\fR
1175 ** service object 'cn=service-kdc,o=org' deleted.
1176 .fi
1177 .in -2
1178 .sp
1180 .LP
1181 \fBExample 17 \fRUsing \fBlist_service\fR
1182 .sp
1183 .LP
1184 The following is an example of the use of the \fBlist_service\fR command.
1186 .sp
1187 .in +2
1188 .nf
1189 # \fBkdb5_ldap_util -D cn=admin,o=org list_service\fR
1190 Password for "cn=admin,o=org": \fIpassword entered\fR
1191 cn=service-kdc,o=org
1192 cn=service-adm,o=org
1193 cn=service-pwd,o=org
1194 .fi
1195 .in -2
1196 .sp
1198 .SH ATTRIBUTES
1199 .sp
1200 .LP
1201 See \fBattributes\fR(5) for descriptions of the following attributes:
1202 .sp
1204 .sp
1205 .TS
1206 box;
1207 c | c
1208 l | l .
1209 ATTRIBUTE TYPE ATTRIBUTE VALUE
1210 _
1211 Interface Stability Volatile
1212 .TE
1214 .SH SEE ALSO
1215 .sp
1216 .LP
1217 \fBkinit\fR(1), \fBkadmin\fR(8), \fBkdc.conf\fR(4), \fBattributes\fR(5)