1 .\" Copyright (c) 2000 - 2007 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
39 .Nd Kerberos administration utility
43 .Op Fl p Ar string \*(Ba Fl Fl principal= Ns Ar string
44 .Op Fl K Ar string \*(Ba Fl Fl keytab= Ns Ar string
45 .Op Fl c Ar file \*(Ba Fl Fl config-file= Ns Ar file
46 .Op Fl k Ar file \*(Ba Fl Fl key-file= Ns Ar file
47 .Op Fl r Ar realm \*(Ba Fl Fl realm= Ns Ar realm
48 .Op Fl a Ar host \*(Ba Fl Fl admin-server= Ns Ar host
49 .Op Fl s Ar port number \*(Ba Fl Fl server-port= Ns Ar port number
50 .Op Fl l | Fl Fl local
52 .Op Fl v | Fl Fl version
58 program is used to make modifications to the Kerberos database, either remotely via the
60 daemon, or locally (with the
66 .It Fl p Ar string , Fl Fl principal= Ns Ar string
67 principal to authenticate as
68 .It Fl K Ar string , Fl Fl keytab= Ns Ar string
69 keytab for authentication principal
70 .It Fl c Ar file , Fl Fl config-file= Ns Ar file
71 location of config file
72 .It Fl H Ar HDB , Fl Fl hdb= Ns Ar HDB
74 .It Fl k Ar file , Fl Fl key-file= Ns Ar file
75 location of master key file
76 .It Fl r Ar realm , Fl Fl realm= Ns Ar realm
78 .It Fl a Ar host , Fl Fl admin-server= Ns Ar host
80 .It Fl s Ar port number , Fl Fl server-port= Ns Ar port number
82 .It Fl l , Fl Fl local
88 is given on the command line,
90 will prompt for commands to process. Some of the commands that take
91 one or more principals as argument
98 will accept a glob style wildcard, and perform the operation on all
102 .\" not using a list here, since groff apparently gets confused
103 .\" with nested Xo/Xc
106 .Op Fl r | Fl Fl random-key
107 .Op Fl Fl enctypes= Ns Ar string
108 .Op Fl Fl random-password
109 .Op Fl p Ar string \*(Ba Fl Fl password= Ns Ar string
110 .Op Fl Fl key= Ns Ar string
111 .Op Fl Fl max-ticket-life= Ns Ar lifetime
112 .Op Fl Fl max-renewable-life= Ns Ar lifetime
113 .Op Fl Fl attributes= Ns Ar attributes
114 .Op Fl Fl expiration-time= Ns Ar time
115 .Op Fl Fl pw-expiration-time= Ns Ar time
116 .Op Fl Fl policy= Ns Ar policy-name
118 .Bd -ragged -offset indent
119 Adds a new principal to the database. The options not passed on the
120 command line will be promped for.
121 If enctypes to use are not given, then the
122 .Ar [libdefaults] supported_enctypes
123 configuration parameter will be used on the client side to select
124 enctypes, defaulting to
125 .Ar aes128-cts-hmac-sha1-96.
126 For compatibility with MIT, the enctypes string is a space- or
127 comma-separated list of enctype:salttype.
130 is given, then old keys needed to decrypt extant tickets are
131 kept, and all other old keys are deleted.
134 is given then all old keys are kept. If
135 .Fl Fl pruneall is given then all old keys are removed.
138 behavior is the default if none of these are given.
139 The only policy supported by Heimdal servers is
144 .Ar Fl Fl key-rotation-epoch= Ns Ar time
145 .Ar Fl Fl key-rotation-period= Ns Ar time
146 .Op Fl Fl enctypes= Ns Ar string
147 .Op Fl Fl max-ticket-life= Ns Ar lifetime
148 .Op Fl Fl max-renewable-life= Ns Ar lifetime
149 .Op Fl Fl attributes= Ns Ar attributes
151 .Bd -ragged -offset indent
152 Adds a new namespace of virtual host-based or domain-based
153 principals to the database, whose keys will be automatically
154 derived from base keys stored in the namespace record, and which
155 keys will be rotated automatically.
156 The namespace names should look like
158 and these will match all host-based or domain-based service names
159 where hostname component of such a principal ends in the labels
160 of the hostname in the namespace name.
163 .Ar bar.baz.example@BAZ.EXAMPLE
165 .Ar host/foo.bar.baz.example@BAZ.EXAMPLE
167 .Ar host/foobar.baz.example@BAZ.EXAMPLE .
169 Note well that services are expected to
171 or otherwise re-fetch their keytabs at least as often as one
172 quarter of the key rotation period, otherwise they risk not
173 having keys they need to decrypt tickets with.
175 The epoch must be given as either an absolute time,
183 is one "s", "m", "h", "day", "week", "month", defaulting to
185 The default key rotation period is
187 The default enctypes is as for the
193 .Op Fl r | Fl Fl random-key
194 .Ar principal enctypes...
196 .Bd -ragged -offset indent
197 Adds a new encryption type to the principal, only random key are
203 .Bd -ragged -offset indent
208 .Ar principal enctypes...
209 .Bd -ragged -offset indent
210 Removes some enctypes from a principal; this can be useful if the
211 service belonging to the principal is known to not handle certain
217 .Bd -ragged -offset indent
218 Deletes the named principal's keys of the given kvno. If a kvno is
219 not given then this deletes all the named principals keys that are
220 too old to be needed for decrypting tickets issued using those keys
221 (i.e., any such tickets are necessarily expired). The determination
222 of "too old" is made using the max-ticket-life attribute of the
223 principal; though in practice that max ticket life is also constrained
224 by the max-ticket-life of the client principals and the krbtgt
225 principals, those are not consulted here.
229 .Oo Fl k Ar keytab \*(Ba Xo
230 .Op Fl Fl keepold | Fl Fl keepallold | Fl Fl pruneall
231 .Op Fl Fl enctypes= Ns Ar string
232 .Fl Fl keytab= Ns Ar string
236 .Bd -ragged -offset indent
237 Creates a keytab with the keys of the specified principals. Requires
238 get-keys rights, otherwise the principal's keys are changed and saved in
240 If enctypes to use are not given, then the
241 .Ar [libdefaults] supported_enctypes
242 configuration parameter will be used on the client side to select
243 enctypes, defaulting to
244 .Ar aes128-cts-hmac-sha1-96.
245 For compatibility with MIT, the enctypes string is a space- or
246 comma-separated list of enctype:salttype.
249 is given, then old keys needed to decrypt extant tickets are
250 kept, and all other old keys are deleted.
253 is given then all old keys are kept. If
254 .Fl Fl pruneall is given then all old keys are removed.
257 behavior is the default if none of these are given.
261 .Op Fl l | Fl Fl long
262 .Op Fl s | Fl Fl short
263 .Op Fl t | Fl Fl terse
264 .Op Fl o Ar string | Fl Fl column-info= Ns Ar string
265 .Op Fl C Ar path | Fl Fl krb5-config-file= Ns Ar path
267 .Bd -ragged -offset indent
268 Lists the matching principals, short prints the result as a table,
269 while long format produces a more verbose output. Which columns to
270 print can be selected with the
272 option. The argument is a comma separated list of column names
273 optionally appended with an equal sign
275 and a column header. Which columns are printed by default differ
276 slightly between short and long output.
278 The default terse output format is similar to
279 .Fl s o Ar principal= ,
280 just printing the names of matched principals.
285 .Fl Fl krb5-config-file
286 is given and the principal has krb5 config file contents saved
287 in its HDB entry, then that will be saved in the given file.
288 Note that if multiple principals are requested, then the second,
289 third, and so on will have -1, -2, and so on appended to the
290 given filename unless the given filename is a device name.
292 Possible column names include:
294 .Li princ_expire_time ,
296 .Li last_pwd_change ,
306 .Li fail_auth_count ,
313 .Oo Fl a Ar attributes \*(Ba Xo
314 .Fl Fl attributes= Ns Ar attributes
317 .Op Fl Fl max-ticket-life= Ns Ar lifetime
318 .Op Fl Fl max-renewable-life= Ns Ar lifetime
319 .Op Fl Fl expiration-time= Ns Ar time
320 .Op Fl Fl pw-expiration-time= Ns Ar time
321 .Op Fl Fl kvno= Ns Ar number
322 .Op Fl Fl policy= Ns Ar policy-name
323 .Op Fl C Ar path | Fl Fl krb5-config-file= Ns Ar path
325 .Bd -ragged -offset indent
326 Modifies certain attributes of a principal. If run without command
327 line options, you will be prompted. With command line options, it will
328 only change the ones specified.
330 The only policy supported by Heimdal is
333 If a krb5 config file is given, it will be saved in the entry.
335 Possible attributes are:
338 .Li pwchange-service ,
339 .Li disallow-client ,
341 .Li requires-pw-change ,
342 .Li requires-hw-auth ,
343 .Li requires-pre-auth ,
345 .Li trusted-for-delegation ,
347 .Li disallow-all-tix ,
348 .Li disallow-dup-skey ,
349 .Li disallow-proxiable ,
350 .Li disallow-renewable ,
351 .Li disallow-tgt-based ,
352 .Li disallow-forwardable ,
353 .Li disallow-postdated
355 Attributes may be negated with a "-", e.g.,
357 kadmin -l modify -a -disallow-proxiable user
361 .Op Fl Fl keepold | Fl Fl keepallold | Fl Fl pruneall
362 .Op Fl Fl enctypes= Ns Ar string
363 .Op Fl r | Fl Fl random-key
364 .Op Fl Fl random-password
365 .Oo Fl p Ar string \*(Ba Xo
366 .Fl Fl password= Ns Ar string
369 .Op Fl Fl key= Ns Ar string
371 .Bd -ragged -offset indent
372 Changes the password of an existing principal.
373 If enctypes to use are not given, then the
374 .Ar [libdefaults] supported_enctypes
375 configuration parameter will be used on the client side to select
376 enctypes, defaulting to
377 .Ar aes128-cts-hmac-sha1-96.
378 For compatibility with MIT, the enctypes string is a space- or
379 comma-separated list of enctype:salttype.
382 is given, then old keys needed to decrypt extant tickets are
383 kept, and all other old keys are deleted.
386 is given then all old keys are kept. If
387 .Fl Fl pruneall is given then all old keys are removed.
390 behavior is the default if none of these are given.
393 .Nm verify-password-quality
396 .Bd -ragged -offset indent
397 Run the password quality check function locally.
398 You can run this on the host that is configured to run the kadmind
399 process to verify that your configuration file is correct.
400 The verification is done locally, if kadmin is run in remote mode,
401 no rpc call is done to the server. NOTE: if the environment has
402 verify-password-quality configured to use a back-end that stores
403 password history (such as heimdal-history), running
404 verify-quality-password will cause an update to the password
405 database meaning that merely verifying the quality of the password
406 using verify-quality-password invalidates the use of that
407 principal/password in the future.
411 .Bd -ragged -offset indent
412 Lists the operations you are allowed to perform. These include
415 .Li change-password ,
427 .Bd -ragged -offset indent
428 Renames a principal. This is normally transparent, but since keys are
429 salted with the principal name, they will have a non-standard salt,
430 and clients which are unable to cope with this will fail. Kerberos 4
437 .Bd -ragged -offset indent
438 Check database for strange configurations on important principals. If
439 no realm is given, the default realm is used.
442 When running in local mode, the following commands can also be used:
445 .Op Fl d | Fl Fl decrypt
446 .Op Fl f Ns Ar format | Fl Fl format= Ns Ar format
448 .Bd -ragged -offset indent
449 Writes the database in
450 .Dq machine readable text
451 form to the specified file, or standard out. If the database is
452 encrypted, the dump will also have encrypted keys, unless
456 is used then the dump will be in MIT format. Otherwise it will be in
461 .Op Fl Fl realm-max-ticket-life= Ns Ar string
462 .Op Fl Fl realm-max-renewable-life= Ns Ar string
464 .Bd -ragged -offset indent
465 Initializes the Kerberos database with entries for a new realm. It's
466 possible to have more than one realm served by one server.
471 .Bd -ragged -offset indent
472 Reads a previously dumped database, and re-creates that database from
478 .Bd -ragged -offset indent
481 but just modifies the database with the entries in the dump file.
485 .Oo Fl e Ar enctype \*(Ba Xo
486 .Fl Fl enctype= Ns Ar enctype
489 .Oo Fl k Ar keyfile \*(Ba Xo
490 .Fl Fl key-file= Ns Ar keyfile
493 .Op Fl Fl convert-file
494 .Op Fl Fl master-key-fd= Ns Ar fd
495 .Bd -ragged -offset indent
496 Writes the Kerberos master key to a file used by the KDC.