1 .\" Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 .Nd Kerberos administration utility
43 .Op Fl p Ar string \*(Ba Fl Fl principal= Ns Ar string
44 .Op Fl K Ar string \*(Ba Fl Fl keytab= Ns Ar string
45 .Op Fl c Ar file \*(Ba Fl Fl config-file= Ns Ar file
46 .Op Fl k Ar file \*(Ba Fl Fl key-file= Ns Ar file
47 .Op Fl r Ar realm \*(Ba Fl Fl realm= Ns Ar realm
48 .Op Fl a Ar host \*(Ba Fl Fl admin-server= Ns Ar host
49 .Op Fl s Ar port number \*(Ba Fl Fl server-port= Ns Ar port number
50 .Op Fl l | Fl Fl local
52 .Op Fl v | Fl Fl version
58 program is used to make modifications to the Kerberos database, either remotely via the
60 daemon, or locally (with the
66 .It Fl p Ar string , Fl Fl principal= Ns Ar string
67 principal to authenticate as
68 .It Fl K Ar string , Fl Fl keytab= Ns Ar string
69 keytab for authentication principal
70 .It Fl c Ar file , Fl Fl config-file= Ns Ar file
71 location of config file
72 .It Fl H Ar HDB , Fl Fl hdb= Ns Ar HDB
74 .It Fl k Ar file , Fl Fl key-file= Ns Ar file
75 location of master key file
76 .It Fl r Ar realm , Fl Fl realm= Ns Ar realm
78 .It Fl a Ar host , Fl Fl admin-server= Ns Ar host
80 .It Fl s Ar port number , Fl Fl server-port= Ns Ar port number
82 .It Fl l , Fl Fl local
88 is given on the command line,
90 will prompt for commands to process. Some of the commands that take
91 one or more principals as argument
98 will accept a glob style wildcard, and perform the operation on all
102 .\" not using a list here, since groff apparently gets confused
103 .\" with nested Xo/Xc
106 .Op Fl r | Fl Fl random-key
107 .Op Fl Fl enctypes= Ns Ar string
108 .Op Fl Fl random-password
109 .Op Fl p Ar string \*(Ba Fl Fl password= Ns Ar string
110 .Op Fl Fl key= Ns Ar string
111 .Op Fl Fl max-ticket-life= Ns Ar lifetime
112 .Op Fl Fl max-renewable-life= Ns Ar lifetime
113 .Op Fl Fl attributes= Ns Ar attributes
114 .Op Fl Fl expiration-time= Ns Ar time
115 .Op Fl Fl pw-expiration-time= Ns Ar time
116 .Op Fl Fl policy= Ns Ar policy-name
118 .Bd -ragged -offset indent
119 Adds a new principal to the database. The options not passed on the
120 command line will be promped for.
121 If enctypes to use are not given, then the
122 .Ar [libdefaults] supported_enctypes
123 configuration parameter will be used on the client side to select
124 enctypes, defaulting to
125 .Ar aes128-cts-hmac-sha1-96.
126 For compatibility with MIT, the enctypes string is a space- or
127 comma-separated list of enctype:salttype.
130 is given, then old keys needed to decrypt extant tickets are
131 kept, and all other old keys are deleted.
134 is given then all old keys are kept. If
135 .Fl Fl pruneall is given then all old keys are removed.
138 behavior is the default if none of these are given.
139 The only policy supported by Heimdal servers is
142 This command has the following aliases:
150 .Bd -ragged -offset indent
151 Adds one or more aliases to the given principal.
153 When a client requests a service ticket for a service principal
154 name that is an alias of a principal in a different realm, the
155 TGS will return a referral to that realm.
156 This compares favorably to using
160 but may be managed via the
166 sub-commands rather than having to edit the KDC's configuration
167 file and having to restart the KDC.
169 However, there is currently no way to alias namespaces via HDB
171 To issue referrals for entire namespaces use the
179 .Ar Fl Fl key-rotation-epoch= Ns Ar time
180 .Ar Fl Fl key-rotation-period= Ns Ar time
181 .Op Fl Fl enctypes= Ns Ar string
182 .Op Fl Fl max-ticket-life= Ns Ar lifetime
183 .Op Fl Fl max-renewable-life= Ns Ar lifetime
184 .Op Fl Fl attributes= Ns Ar attributes
186 .Bd -ragged -offset indent
187 Adds a new namespace of virtual host-based or domain-based
188 principals to the database, whose keys will be automatically
189 derived from base keys stored in the namespace record, and which
190 keys will be rotated automatically.
191 The namespace names should look like
193 and these will match all host-based or domain-based service names
194 where hostname component of such a principal ends in the labels
195 of the hostname in the namespace name.
198 .Ar bar.baz.example@BAZ.EXAMPLE
200 .Ar host/foo.bar.baz.example@BAZ.EXAMPLE
202 .Ar host/foobar.baz.example@BAZ.EXAMPLE .
204 Note well that services are expected to
206 or otherwise re-fetch their keytabs at least as often as one
207 quarter of the key rotation period, otherwise they risk not
208 having keys they need to decrypt tickets with.
210 The epoch must be given as either an absolute time,
218 is one "s", "m", "h", "day", "week", "month", defaulting to
220 The default key rotation period is
222 The default enctypes is as for the
226 This command has the following alias:
231 .Op Fl r | Fl Fl random-key
232 .Ar principal enctypes...
234 .Bd -ragged -offset indent
235 Adds a new encryption type to the principal, only random key are
241 .Bd -ragged -offset indent
243 It is an error to delete an alias.
244 To remove a principal's alias or aliases, use the
247 To remove a principal given an alias, first
249 the principal to get its canonical name and then delete that.
254 .Bd -ragged -offset indent
255 Deletes the given aliases, but not their canonical principals.
257 This command has the following aliases:
263 .Ar principal enctypes...
264 .Bd -ragged -offset indent
265 Removes some enctypes from a principal; this can be useful if the
266 service belonging to the principal is known to not handle certain
272 .Bd -ragged -offset indent
273 Deletes the named principal's keys of the given kvno. If a kvno is
274 not given then this deletes all the named principals keys that are
275 too old to be needed for decrypting tickets issued using those keys
276 (i.e., any such tickets are necessarily expired). The determination
277 of "too old" is made using the max-ticket-life attribute of the
278 principal; though in practice that max ticket life is also constrained
279 by the max-ticket-life of the client principals and the krbtgt
280 principals, those are not consulted here.
284 .Oo Fl k Ar keytab \*(Ba Xo
285 .Op Fl Fl keepold | Fl Fl keepallold | Fl Fl pruneall
286 .Op Fl Fl enctypes= Ns Ar string
287 .Fl Fl keytab= Ns Ar string
291 .Bd -ragged -offset indent
292 Creates a keytab with the keys of the specified principals. Requires
293 get-keys rights, otherwise the principal's keys are changed and saved in
295 If enctypes to use are not given, then the
296 .Ar [libdefaults] supported_enctypes
297 configuration parameter will be used on the client side to select
298 enctypes, defaulting to
299 .Ar aes128-cts-hmac-sha1-96.
300 For compatibility with MIT, the enctypes string is a space- or
301 comma-separated list of enctype:salttype.
304 is given, then old keys needed to decrypt extant tickets are
305 kept, and all other old keys are deleted.
308 is given then all old keys are kept. If
309 .Fl Fl pruneall is given then all old keys are removed.
312 behavior is the default if none of these are given.
316 .Op Fl l | Fl Fl long
317 .Op Fl s | Fl Fl short
318 .Op Fl t | Fl Fl terse
319 .Op Fl o Ar string | Fl Fl column-info= Ns Ar string
320 .Op Fl C Ar path | Fl Fl krb5-config-file= Ns Ar path
322 .Bd -ragged -offset indent
323 Lists the matching principals, short prints the result as a table,
324 while long format produces a more verbose output. Which columns to
325 print can be selected with the
327 option. The argument is a comma separated list of column names
328 optionally appended with an equal sign
330 and a column header. Which columns are printed by default differ
331 slightly between short and long output.
333 The default terse output format is similar to
334 .Fl s o Ar principal= ,
335 just printing the names of matched principals.
340 .Fl Fl krb5-config-file
341 is given and the principal has krb5 config file contents saved
342 in its HDB entry, then that will be saved in the given file.
343 Note that if multiple principals are requested, then the second,
344 third, and so on will have -1, -2, and so on appended to the
345 given filename unless the given filename is a device name.
347 Possible column names include:
349 .Li princ_expire_time ,
351 .Li last_pwd_change ,
361 .Li fail_auth_count ,
368 .Oo Fl a Ar attributes \*(Ba Xo
369 .Fl Fl attributes= Ns Ar attributes
372 .Op Fl Fl max-ticket-life= Ns Ar lifetime
373 .Op Fl Fl max-renewable-life= Ns Ar lifetime
374 .Op Fl Fl expiration-time= Ns Ar time
375 .Op Fl Fl pw-expiration-time= Ns Ar time
376 .Op Fl Fl kvno= Ns Ar number
377 .Op Fl Fl policy= Ns Ar policy-name
378 .Op Fl Fl alias= Ns Ar alias-name
379 .Op Fl C Ar path | Fl Fl krb5-config-file= Ns Ar path
381 .Bd -ragged -offset indent
382 Modifies certain attributes of a principal. If run without command
383 line options, you will be prompted. With command line options, it will
384 only change the ones specified.
387 .Fl Fl alias= Ns Ar alias-name
388 option may be given multiple times, which will set the complete
389 list of aliases for the principal.
392 command instead to add an alias without having to list all
393 existing aliases to keep.
397 option without a value allows the user to set an empty list of
401 command to delete one or more aliases.
403 The only policy supported by Heimdal is
406 If a krb5 config file is given, it will be saved in the entry.
408 Possible attributes are:
411 .Li pwchange-service ,
412 .Li disallow-client ,
414 .Li requires-pw-change ,
415 .Li requires-hw-auth ,
416 .Li requires-pre-auth ,
418 .Li trusted-for-delegation ,
420 .Li disallow-all-tix ,
421 .Li disallow-dup-skey ,
422 .Li disallow-proxiable ,
423 .Li disallow-renewable ,
424 .Li disallow-tgt-based ,
425 .Li disallow-forwardable ,
426 .Li disallow-postdated
428 Attributes may be negated with a "-", e.g.,
430 kadmin -l modify -a -disallow-proxiable user
432 This command has the following alias:
437 .Op Fl Fl keepold | Fl Fl keepallold | Fl Fl pruneall
438 .Op Fl Fl enctypes= Ns Ar string
439 .Op Fl r | Fl Fl random-key
440 .Op Fl Fl random-password
441 .Oo Fl p Ar string \*(Ba Xo
442 .Fl Fl password= Ns Ar string
445 .Op Fl Fl key= Ns Ar string
447 .Bd -ragged -offset indent
448 Changes the password of an existing principal.
449 If enctypes to use are not given, then the
450 .Ar [libdefaults] supported_enctypes
451 configuration parameter will be used on the client side to select
452 enctypes, defaulting to
453 .Ar aes128-cts-hmac-sha1-96.
454 For compatibility with MIT, the enctypes string is a space- or
455 comma-separated list of enctype:salttype.
458 is given, then old keys needed to decrypt extant tickets are
459 kept, and all other old keys are deleted.
462 is given then all old keys are kept. If
463 .Fl Fl pruneall is given then all old keys are removed.
466 behavior is the default if none of these are given.
468 This command has the following aliases:
470 .Nm change_password .
473 .Nm verify-password-quality
476 .Bd -ragged -offset indent
477 Run the password quality check function locally.
478 You can run this on the host that is configured to run the kadmind
479 process to verify that your configuration file is correct.
480 The verification is done locally, if kadmin is run in remote mode,
481 no rpc call is done to the server. NOTE: if the environment has
482 verify-password-quality configured to use a back-end that stores
483 password history (such as heimdal-history), running
484 verify-quality-password will cause an update to the password
485 database meaning that merely verifying the quality of the password
486 using verify-quality-password invalidates the use of that
487 principal/password in the future.
489 This command has the following alias:
494 .Bd -ragged -offset indent
495 Lists the operations you are allowed to perform. These include
498 .Li change-password ,
507 This command has the following alias:
513 .Bd -ragged -offset indent
514 Renames a principal. This is normally transparent, but since keys are
515 salted with the principal name, they will have a non-standard salt,
516 and clients which are unable to cope with this will fail. Kerberos 4
523 .Bd -ragged -offset indent
524 Check database for strange configurations on important principals. If
525 no realm is given, the default realm is used.
528 When running in local mode, the following commands can also be used:
531 .Op Fl d | Fl Fl decrypt
532 .Op Fl f Ns Ar format | Fl Fl format= Ns Ar format
534 .Bd -ragged -offset indent
535 Writes the database in
536 .Dq machine readable text
537 form to the specified file, or standard out. If the database is
538 encrypted, the dump will also have encrypted keys, unless
542 is used then the dump will be in MIT format. Otherwise it will be in
547 .Op Fl Fl realm-max-ticket-life= Ns Ar string
548 .Op Fl Fl realm-max-renewable-life= Ns Ar string
550 .Bd -ragged -offset indent
551 Initializes the Kerberos database with entries for a new realm. It's
552 possible to have more than one realm served by one server.
557 .Bd -ragged -offset indent
558 Reads a previously dumped database, and re-creates that database from
564 .Bd -ragged -offset indent
567 but just modifies the database with the entries in the dump file.
571 .Oo Fl e Ar enctype \*(Ba Xo
572 .Fl Fl enctype= Ns Ar enctype
575 .Oo Fl k Ar keyfile \*(Ba Xo
576 .Fl Fl key-file= Ns Ar keyfile
579 .Op Fl Fl convert-file
580 .Op Fl Fl master-key-fd= Ns Ar fd
581 .Bd -ragged -offset indent
582 Writes the Kerberos master key to a file used by the KDC.
584 This command has the following alias:
589 .Bd -ragged -offset indent
593 This command has the following alias: