| blob | f5e3879cf2c7490ea5ee4131a2bd6854f5107ad9 |
1 .\" Copyright (c) 2000 - 2003 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id: hprop.8,v 1.18 2003/02/16 21:10:19 lha Exp $
33 .\"
34 .Dd June 19, 2000
35 .Dt HPROP 8
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm hprop
39 .Nd propagate the KDC database
40 .Sh SYNOPSIS
41 .Nm
42 .Oo Fl m Ar file \*(Ba Xo
43 .Fl -master-key= Ns Pa file
44 .Xc
45 .Oc
46 .Oo Fl d Ar file \*(Ba Xo
47 .Fl -database= Ns Pa file
48 .Xc
49 .Oc
50 .Op Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|krb4-db|kaserver
51 .Oo Fl r Ar string \*(Ba Xo
52 .Fl -v4-realm= Ns Ar string
53 .Xc
54 .Oc
55 .Oo Fl c Ar cell \*(Ba Xo
56 .Fl -cell= Ns Ar cell
57 .Xc
58 .Oc
59 .Op Fl S | Fl -kaspecials
60 .Oo Fl k Ar keytab \*(Ba Xo
61 .Fl -keytab= Ns Ar keytab
62 .Xc
63 .Oc
64 .Oo Fl R Ar string \*(Ba Xo
65 .Fl -v5-realm= Ns Ar string
66 .Xc
67 .Oc
68 .Op Fl D | Fl -decrypt
69 .Op Fl E | Fl -encrypt
70 .Op Fl n | Fl -stdout
71 .Op Fl v | Fl -verbose
72 .Op Fl -version
73 .Op Fl h | Fl -help
74 .Op Ar host Ns Op : Ns Ar port
75 .Ar ...
76 .Sh DESCRIPTION
77 .Nm
78 takes a principal database in a specified format and converts it into
79 a stream of Heimdal database records. This stream can either be
80 written to standard out, or (more commonly) be propagated to a
81 .Xr hpropd 8
82 server running on a different machine.
83 .Pp
84 If propagating, it connects to all
85 .Ar hosts
86 specified on the command by opening a TCP connection to port 754
87 (service hprop) and sends the database in encrypted form.
88 .Pp
89 Supported options:
90 .Bl -tag -width Ds
91 .It Xo
92 .Fl m Ar file ,
93 .Fl -master-key= Ns Pa file
94 .Xc
95 Where to find the master key to encrypt or decrypt keys with.
96 .It Xo
97 .Fl d Ar file ,
98 .Fl -database= Ns Pa file
99 .Xc
100 The database to be propagated.
101 .It Xo
102 .Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|krb4-db|kaserver
103 .Xc
104 Specifies the type of the source database. Alternatives include:
105 .Pp
106 .Bl -tag -width krb4-dump -compact -offset indent
107 .It heimdal
108 a Heimdal database
109 .It mit-dump
110 a MIT Kerberos 5 dump file
111 .It krb4-db
112 a Kerberos 4 database
113 .It krb4-dump
114 a Kerberos 4 dump file
115 .It kaserver
116 an AFS kaserver database
117 .El
118 .It Xo
119 .Fl k Ar keytab ,
120 .Fl -keytab= Ns Ar keytab
121 .Xc
122 The keytab to use for fetching the key to be used for authenticating
123 to the propagation daemon(s). The key
124 .Pa kadmin/hprop
125 is used from this keytab. The default is to fetch the key from the
126 KDC database.
127 .It Xo
128 .Fl R Ar string ,
129 .Fl -v5-realm= Ns Ar string
130 .Xc
131 Local realm override.
132 .It Xo
133 .Fl D ,
134 .Fl -decrypt
135 .Xc
136 The encryption keys in the database can either be in clear, or
137 encrypted with a master key. This option transmits the database with
138 unencrypted keys.
139 .It Xo
140 .Fl E ,
141 .Fl -encrypt
142 .Xc
143 This option transmits the database with encrypted keys.
144 .It Xo
145 .Fl n ,
146 .Fl -stdout
147 .Xc
148 Dump the database on stdout, in a format that can be fed to hpropd.
149 .El
150 .Pp
151 The following options are only valid if
152 .Nm hprop
153 is compiled with support for Kerberos 4 (kaserver).
154 .Bl -tag -width Ds
155 .It Xo
156 .Fl r Ar string ,
157 .Fl -v4-realm= Ns Ar string
158 .Xc
159 v4 realm to use.
160 .It Xo
161 .Fl c Ar cell ,
162 .Fl -cell= Ns Ar cell
163 .Xc
164 The AFS cell name, used if reading a kaserver database.
165 .It Xo
166 .Fl S ,
167 .Fl -kaspecials
168 .Xc
169 Also dump the principals marked as special in the kaserver database.
170 .It Xo
171 .Fl 4 ,
172 .Fl -v4-db
173 .Xc
174 Deprecated, identical to
175 .Sq --source=krb4-db .
176 .It Xo
177 .Fl K ,
178 .Fl -ka-db
179 .Xc
180 Deprecated, identical to
181 .Sq --source=kaserver .
182 .El
183 .Sh EXAMPLES
184 The following will propagate a database to another machine (which
185 should run
186 .Xr hpropd 8):
187 .Bd -literal -offset indent
188 $ hprop slave-1 slave-2
189 .Ed
190 .Pp
191 Copy a Kerberos 4 database to a Kerberos 5 slave:
192 .Bd -literal -offset indent
193 $ hprop --source=krb4-db -E krb5-slave
194 .Ed
195 .Pp
196 Convert a Kerberos 4 dump-file for use with a Heimdal KDC:
197 .Bd -literal -offset indent
198 $ hprop -n --source=krb4-dump -d /var/kerberos/principal.dump --master-key=/.k | hpropd -n
199 .Ed
200 .Sh SEE ALSO
201 .Xr hpropd 8