| blob | bb11298ce8778a6c6f9413221f891f6b55680713 |
1 '\" te
2 .\" Copyright 1989 by the Massachusetts Institute of Technology. Copyright (c) 2008, Sun Microsystems, Inc. All Rights Reserved
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH KADMIN 1M "Feb 29, 2008"
7 .SH NAME
8 kadmin, kadmin.local \- Kerberos database administration program
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/usr/sbin/kadmin\fR [\fB-r\fR \fIrealm\fR] [\fB-p\fR \fIprincipal\fR] [\fB-q\fR \fIquery\fR]
13 [\fB-s\fR \fIadmin_server\fR [\fI:port\fR]] [ [\fB-c\fR \fIcredential_cache\fR]
14 | [\fB-k\fR [\fB-t\fR \fIkeytab\fR]] | [\fB-w\fR \fIpassword\fR]] [\fB-x\fR \fIdb_args\fR]...
15 .fi
17 .LP
18 .nf
19 \fB/usr/sbin/kadmin.local\fR [\fB-r\fR \fIrealm\fR] [\fB-p\fR \fIprincipal\fR]
20 [\fB-q\fR \fIquery\fR] [\fB-d\fR \fIdbname\fR] [\fB-e\fR "\fIenc:salt...\fR"] [\fB-m\fR] [\fB-D\fR]
21 .fi
23 .SH DESCRIPTION
24 .sp
25 .LP
26 \fBkadmin\fR and \fBkadmin.local\fR are interactive command-line interfaces to
27 the Kerberos V5 administration system. They provide for the maintenance of
28 Kerberos principals, policies, and service key tables (keytabs). \fBkadmin\fR
29 and \fBkadmin.local\fR provide identical functionality; the difference is that
30 \fBkadmin.local\fR can run only on the master KDC and does not use Kerberos
31 authentication.
32 .sp
33 .LP
34 Except as explicitly noted otherwise, this man page uses \fBkadmin\fR to refer
35 to both versions.
36 .sp
37 .LP
38 By default, both versions of \fBkadmin\fR attempt to determine your user name
39 and perform operations on behalf of your "\fIusername\fR/\fIadmin\fR" instance.
40 Operations performed are subject to privileges granted or denied to this user
41 instance by the Kerberos ACL file (see \fBkadm5.acl\fR(4)). You may perform
42 administration as another user instance by using the \fB-p\fR option.
43 .sp
44 .LP
45 The remote version, \fBkadmin\fR, uses Kerberos authentication and an encrypted
46 RPC to operate securely from anywhere on the network. It normally prompts for a
47 password and authenticates the user to the Kerberos administration server,
48 \fBkadmind\fR, whose service principal is \fBkadmin/\fR\fIfqdn\fR. Some options
49 specific to the remote version permit the password prompt to be bypassed. The
50 \fB-c\fR option searches the named credentials cache for a valid ticket for the
51 \fBkadmin/\fR\fIfqdn\fR service and uses it to authenticate the user to the
52 Kerberos admin server without a password. The \fB-k\fR option searches a keytab
53 for a credential to authenticate to the \fBkadmin/\fR\fIfqdn\fR service, and
54 again no password is collected. If \fBkadmin\fR has collected a password, it
55 requests a \fBkadmin/\fR\fIfqdn\fR Kerberos service ticket from the KDC, and
56 uses that service ticket to interact with \fBkadmind\fR.
57 .sp
58 .LP
59 The local version, \fBkadmin.local\fR, must be run with an effective UID of
60 root, and normally uses a key from the \fB/var/krb5/.k5.\fR\fIrealm\fR stash
61 file (see \fBkdb5_util\fR(1M)) to decrypt information from the database rather
62 than prompting for a password. The \fB-m\fR option will bypass the
63 \fB\&.k5.\fR\fIrealm\fR stash file and prompt for the master password.
64 .SH OPTIONS
65 .sp
66 .LP
67 The following options are supported:
68 .sp
69 .ne 2
70 .na
71 \fB\fB-c\fR \fIcredentials_cache\fR\fR
72 .ad
73 .sp .6
74 .RS 4n
75 Search \fIcredentials_cache\fR for a service ticket for the
76 \fBkadmin/\fR\fIfqdn\fR service; it can be acquired with the \fBkinit\fR(1)
77 program. If this option is not specified, \fBkadmin\fR requests a new service
78 ticket from the KDC, and stores it in its own temporary credentials cache.
79 .RE
81 .sp
82 .ne 2
83 .na
84 \fB\fB-d\fR \fIdbname\fR\fR
85 .ad
86 .sp .6
87 .RS 4n
88 Specify a non-standard database name. [Local only]
89 .RE
91 .sp
92 .ne 2
93 .na
94 \fB\fB-D\fR\fR
95 .ad
96 .sp .6
97 .RS 4n
98 Turn on debug mode. [Local only]
99 .RE
101 .sp
102 .ne 2
103 .na
104 \fB\fB-e\fR \fI"enc:salt ..."\fR\fR
105 .ad
106 .sp .6
107 .RS 4n
108 Specify a different encryption type and/or key salt. [Local only]
109 .RE
111 .sp
112 .ne 2
113 .na
114 \fB\fB-k\fR [\fB-t\fR \fIkeytab\fR]\fR
115 .ad
116 .sp .6
117 .RS 4n
118 Use the default keytab (\fB-k\fR) or a specific keytab (\fB-t\fR \fIkeytab\fR)
119 to decrypt the KDC response instead of prompting for a password. In this case,
120 the default principal will be \fBhost\fR/\fBhostname\fR. This is primarily used
121 for keytab maintenance.
122 .RE
124 .sp
125 .ne 2
126 .na
127 \fB\fB-m\fR\fR
128 .ad
129 .sp .6
130 .RS 4n
131 Accept the database master password from the keyboard rather than using the
132 \fB/var/krb5/.k5.\fIrealm\fR\fR stash file. [Local only]
133 .RE
135 .sp
136 .ne 2
137 .na
138 \fB\fB-p\fR \fIprincipal\fR\fR
139 .ad
140 .sp .6
141 .RS 4n
142 Authenticate \fIprincipal\fR to the \fBkadmin/\fR\fIfqdn\fR service. Otherwise,
143 \fBkadmin\fR will append \fB/admin\fR to the primary principal name of the
144 default credentials cache, the value of the \fBUSER\fR environment variable, or
145 the username as obtained with \fBgetpwuid\fR, in that order of preference.
146 .RE
148 .sp
149 .ne 2
150 .na
151 \fB\fB-q\fR \fIquery\fR\fR
152 .ad
153 .sp .6
154 .RS 4n
155 Pass \fIquery\fR directly to \fBkadmin\fR, which will perform \fIquery\fR and
156 then exit. This can be useful for writing scripts.
157 .RE
159 .sp
160 .ne 2
161 .na
162 \fB\fB-r\fR \fIrealm\fR\fR
163 .ad
164 .sp .6
165 .RS 4n
166 Use \fIrealm\fR as the default database realm.
167 .RE
169 .sp
170 .ne 2
171 .na
172 \fB\fB-s\fR \fIadmin_server\fR[\fI:port\fR]\fR
173 .ad
174 .sp .6
175 .RS 4n
176 Administer the specified \fIadmin\fR server at the specified port number
177 (\fIport\fR). This can be useful in administering a realm not known to your
178 client.
179 .RE
181 .sp
182 .ne 2
183 .na
184 \fB\fB-w\fR \fIpassword\fR\fR
185 .ad
186 .sp .6
187 .RS 4n
188 Use \fIpassword\fR instead of prompting for one. Note that placing the password
189 for a Kerberos principal with administration access into a shell script can be
190 dangerous if unauthorized users gain read access to the script or can read
191 arguments of this command through \fBps\fR(1).
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fB-x\fR \fIdb_args\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 Pass database-specific arguments to \fBkadmin\fR. Supported arguments are for
202 LDAP and the \fBBerkeley-db2\fR plug-in. These arguments are:
203 .sp
204 .ne 2
205 .na
206 \fB\fBbinddn\fR=\fIbinddn\fR\fR
207 .ad
208 .sp .6
209 .RS 4n
210 LDAP simple bind DN for authorization on the directory server. Overrides the
211 \fBldap_kadmind_dn\fR parameter setting in \fBkrb5.conf\fR(4).
212 .RE
214 .sp
215 .ne 2
216 .na
217 \fB\fBbindpwd\fR=\fIbindpwd\fR\fR
218 .ad
219 .sp .6
220 .RS 4n
221 Bind password.
222 .RE
224 .sp
225 .ne 2
226 .na
227 \fB\fBdbname\fR=\fIname\fR\fR
228 .ad
229 .sp .6
230 .RS 4n
231 For the \fBBerkeley-db2\fR plug-in, specifies a name for the Kerberos database.
232 .RE
234 .sp
235 .ne 2
236 .na
237 \fB\fBnconns\fR=\fInum\fR\fR
238 .ad
239 .sp .6
240 .RS 4n
241 Maximum number of server connections.
242 .RE
244 .sp
245 .ne 2
246 .na
247 \fB\fBport\fR=\fInum\fR\fR
248 .ad
249 .sp .6
250 .RS 4n
251 Directory server connection port.
252 .RE
254 .RE
256 .SH COMMANDS
257 .sp
258 .ne 2
259 .na
260 \fB\fBlist_requests\fR\fR
261 .ad
262 .sp .6
263 .RS 4n
264 Lists all the commands available for \fBkadmin\fR. Aliased by \fBlr\fR and
265 \fB?\fR.
266 .RE
268 .sp
269 .ne 2
270 .na
271 \fB\fBget_privs\fR\fR
272 .ad
273 .sp .6
274 .RS 4n
275 Lists the current Kerberos administration privileges (ACLs) for the principal
276 that is currently running \fBkadmin\fR. The privileges are based on the
277 \fB/etc/krb5/kadm5.acl\fR file on the master KDC. Aliased by \fBgetprivs\fR.
278 .RE
280 .sp
281 .ne 2
282 .na
283 \fB\fB\fR\fBadd_principal\fR \fB[\fIoptions\fR]\fR \fB\fInewprinc\fR\fR\fR
284 .ad
285 .sp .6
286 .RS 4n
287 Creates a new principal, \fInewprinc\fR, prompting twice for a password. If the
288 \fB-policy\fR option is not specified and a policy named \fBdefault\fR exists,
289 then the \fBdefault\fR policy is assigned to the principal; note that the
290 assignment of the \fBdefault\fR policy occurs automatically only when a
291 principal is first created, so the \fBdefault\fR policy must already exist for
292 the assignment to occur. The automatic assignment of the \fBdefault\fR policy
293 can be suppressed with the \fB-clearpolicy\fR option. This command requires the
294 \fBadd\fR privilege. Aliased by \fBaddprinc\fR and \fBank\fR. The options are:
295 .sp
296 .ne 2
297 .na
298 \fB\fB-expire\fR \fIexpdate\fR\fR
299 .ad
300 .sp .6
301 .RS 4n
302 Expiration date of the principal. See the \fBTime\fR \fBFormats\fR section for
303 the valid absolute time formats that you can specify for \fIexpdate\fR.
304 .RE
306 .sp
307 .ne 2
308 .na
309 \fB\fB-pwexpire\fR \fIpwexpdate\fR\fR
310 .ad
311 .sp .6
312 .RS 4n
313 Password expiration date. See the \fBTime\fR \fBFormats\fR section for the
314 valid absolute time formats that you can specify for \fIpwexpdate\fR.
315 .RE
317 .sp
318 .ne 2
319 .na
320 \fB\fB-maxlife\fR \fImaxlife\fR\fR
321 .ad
322 .sp .6
323 .RS 4n
324 Maximum ticket life for the principal. See the \fBTime\fR \fBFormats\fR section
325 for the valid time duration formats that you can specify for \fImaxlife\fR.
326 .RE
328 .sp
329 .ne 2
330 .na
331 \fB\fB-maxrenewlife\fR \fImaxrenewlife\fR\fR
332 .ad
333 .sp .6
334 .RS 4n
335 Maximum renewable life of tickets for the principal. See the \fBTime\fR
336 \fBFormats\fR section for the valid time duration formats that you can specify
337 for \fImaxrenewlife\fR.
338 .RE
340 .sp
341 .ne 2
342 .na
343 \fB\fB-kvno\fR \fIkvno\fR\fR
344 .ad
345 .sp .6
346 .RS 4n
347 Explicitly set the key version number.
348 .RE
350 .sp
351 .ne 2
352 .na
353 \fB\fB-policy\fR \fIpolicy\fR\fR
354 .ad
355 .sp .6
356 .RS 4n
357 Policy used by the principal. If both the \fB-policy\fR and \fB-clearpolicy\fR
358 options are not specified, the \fBdefault\fR policy is used if it exists;
359 otherwise, the principal will have no policy. Also note that the password and
360 principal name must be different when you add a new principal with a specific
361 policy or the \fBdefault\fR policy.
362 .RE
364 .sp
365 .ne 2
366 .na
367 \fB\fB-clearpolicy\fR\fR
368 .ad
369 .sp .6
370 .RS 4n
371 \fB-clearpolicy\fR prevents the \fBdefault\fR policy from being assigned when
372 \fB-policy\fR is not specified. This option has no effect if the \fBdefault\fR
373 policy does not exist.
374 .RE
376 .sp
377 .ne 2
378 .na
379 \fB{\fB-\fR|\fB+\fR}\fBallow_postdated\fR\fR
380 .ad
381 .sp .6
382 .RS 4n
383 \fB-allow_postdated\fR prohibits the principal from obtaining postdated
384 tickets. (Sets the \fBKRB5_KDB_DISALLOW_POSTDATED\fR flag.)
385 \fB+allow_postdated\fR clears this flag.
386 .RE
388 .sp
389 .ne 2
390 .na
391 \fB{\fB-\fR|\fB+\fR}\fBallow_forwardable\fR\fR
392 .ad
393 .sp .6
394 .RS 4n
395 \fB-allow_forwardable\fR prohibits the principal from obtaining forwardable
396 tickets. (Sets the \fBKRB5_KDB_DISALLOW_FORWARDABLE\fR flag.)
397 \fB+allow_forwardable\fR clears this flag.
398 .RE
400 .sp
401 .ne 2
402 .na
403 \fB{\fB-\fR|\fB+\fR}\fBallow_renewable\fR\fR
404 .ad
405 .sp .6
406 .RS 4n
407 \fB-allow_renewable\fR prohibits the principal from obtaining renewable
408 tickets. (Sets the \fBKRB5_KDB_DISALLOW_RENEWABLE\fR flag.)
409 \fB+allow_renewable\fR clears this flag.
410 .RE
412 .sp
413 .ne 2
414 .na
415 \fB{\fB-\fR|\fB+\fR}\fBallow_proxiable\fR\fR
416 .ad
417 .sp .6
418 .RS 4n
419 \fB-allow_proxiable\fR prohibits the principal from obtaining proxiable
420 tickets. (Sets the \fBKRB5_KDB_DISALLOW_PROXIABLE\fR flag.)
421 \fB+allow_proxiable\fR clears this flag.
422 .RE
424 .sp
425 .ne 2
426 .na
427 \fB{\fB-\fR|\fB+\fR}\fBallow_dup_skey\fR\fR
428 .ad
429 .sp .6
430 .RS 4n
431 \fB-allow_dup_skey\fR disables user-to-user authentication for the principal by
432 prohibiting this principal from obtaining a session key for another user. (Sets
433 the \fBKRB5_KDB_DISALLOW_DUP_SKEY\fR flag.) \fB+allow_dup_skey\fR clears this
434 flag.
435 .RE
437 .sp
438 .ne 2
439 .na
440 \fB{\fB-\fR|\fB+\fR}\fBrequires_preauth\fR\fR
441 .ad
442 .sp .6
443 .RS 4n
444 \fB+requires_preauth\fR requires the principal to preauthenticate before being
445 allowed to \fBkinit\fR. (Sets the \fBKRB5_KDB_REQUIRES_PRE_AUTH\fR flag.)
446 \fB-requires_preauth\fR clears this flag.
447 .RE
449 .sp
450 .ne 2
451 .na
452 \fB{\fB-\fR|\fB+\fR}\fBrequires_hwauth\fR\fR
453 .ad
454 .sp .6
455 .RS 4n
456 \fB+requires_hwauth\fR requires the principal to preauthenticate using a
457 hardware device before being allowed to kinit. (Sets the
458 \fBKRB5_KDB_REQUIRES_HW_AUTH\fR flag.) \fB-requires_hwauth\fR clears this flag.
459 .RE
461 .sp
462 .ne 2
463 .na
464 \fB{\fB-\fR|\fB+\fR}\fBallow_svr\fR\fR
465 .ad
466 .sp .6
467 .RS 4n
468 \fB-allow_svr\fR prohibits the issuance of service tickets for the principal.
469 (Sets the \fBKRB5_KDB_DISALLOW_SVR\fR flag.) \fB+allow_svr\fR clears this flag.
470 .RE
472 .sp
473 .ne 2
474 .na
475 \fB{\fB-\fR|\fB+\fR}\fBallow_tgs_req\fR\fR
476 .ad
477 .sp .6
478 .RS 4n
479 \fB-allow_tgs_req\fR specifies that a Ticket-Granting Service (TGS) request for
480 a service ticket for the principal is not permitted. This option is useless for
481 most things. \fB+allow_tgs_req\fR clears this flag. The default is
482 \fB+allow_tgs_req\fR. In effect, \fB-allow_tgs_req\fR sets the
483 \fBKRB5_KDB_DISALLOW_TGT_BASED\fR flag on the principal in the database.
484 .RE
486 .sp
487 .ne 2
488 .na
489 \fB{\fB-\fR|\fB+\fR}\fBallow_tix\fR\fR
490 .ad
491 .sp .6
492 .RS 4n
493 \fB-allow_tix\fR forbids the issuance of any tickets for the principal.
494 \fB+allow_tix\fR clears this flag. The default is \fB+allow_tix\fR. In effect,
495 \fB-allow_tix\fR sets the \fBKRB5_KDB_DISALLOW_ALL_TIX\fR flag on the principal
496 in the database.
497 .RE
499 .sp
500 .ne 2
501 .na
502 \fB{\fB-\fR|\fB+\fR}\fBneedchange\fR\fR
503 .ad
504 .sp .6
505 .RS 4n
506 \fB+needchange\fR sets a flag in attributes field to force a password change;
507 \fB-needchange\fR clears it. The default is \fB-needchange\fR\&. In effect,
508 \fB+needchange\fR sets the \fBKRB5_KDB_REQUIRES_PWCHANGE\fR flag on the
509 principal in the database.
510 .RE
512 .sp
513 .ne 2
514 .na
515 \fB{\fB-\fR|\fB+\fR}\fBpassword_changing_service\fR\fR
516 .ad
517 .sp .6
518 .RS 4n
519 \fB+password_changing_service\fR sets a flag in the attributes field marking
520 this as a password change service principal (useless for most things).
521 \fB-password_changing_service\fR clears the flag. This flag intentionally has a
522 long name. The default is \fB-password_changing_service\fR\&. In effect,
523 \fB+password_changing_service\fR sets the \fBKRB5_KDB_PWCHANGE_SERVICE\fR flag
524 on the principal in the database.
525 .RE
527 .sp
528 .ne 2
529 .na
530 \fB\fB-randkey\fR\fR
531 .ad
532 .sp .6
533 .RS 4n
534 Sets the key of the principal to a random value.
535 .RE
537 .sp
538 .ne 2
539 .na
540 \fB\fB\fR\fB-pw\fR \fB\fIpassword\fR\fR\fR
541 .ad
542 .sp .6
543 .RS 4n
544 Sets the key of the principal to the specified string and does not prompt for a
545 password. Note that using this option in a shell script can be dangerous if
546 unauthorized users gain read access to the script.
547 .RE
549 .sp
550 .ne 2
551 .na
552 \fB\fB-e\fR "enc:salt ..."\fR
553 .ad
554 .sp .6
555 .RS 4n
556 Override the list of enctype:salttype pairs given in \fBkdc.conf\fR(4) for
557 setting the key of the principal. The quotes are necessary if there are
558 multiple enctype:salttype pairs. One key for each similar enctype and same
559 salttype will be created and the first one listed will be used. For example, in
560 a list of two similar enctypes with the same salt, "des-cbc-crc:normal
561 des-cbc-md5:normal", one key will be created and it will be of type
562 des-cbc-crc:normal.
563 .RE
565 .sp
566 .ne 2
567 .na
568 \fBExample:\fR
569 .ad
570 .sp .6
571 .RS 4n
572 .sp
573 .in +2
574 .nf
575 kadmin: \fBaddprinc tlyu/admin\fR
576 WARNING: no policy specified for "tlyu/admin@ACME.COM";
577 defaulting to no policy.
578 Enter password for principal tlyu/admin@ACME.COM:
579 Re-enter password for principal tlyu/admin@ACME.COM:
580 Principal "tlyu/admin@ACME.COM" created.
581 kadmin:
582 .fi
583 .in -2
584 .sp
586 .RE
588 .sp
589 .ne 2
590 .na
591 \fBErrors:\fR
592 .ad
593 .sp .6
594 .RS 4n
595 \fBKADM5_AUTH_ADD\fR (requires \fBadd\fR privilege)
596 .sp
597 \fBKADM5_BAD_MASK\fR (should not happen)
598 .sp
599 \fBKADM5_DUP\fR (principal exists already)
600 .sp
601 \fBKADM5_UNK_POLICY\fR (policy does not exist)
602 .sp
603 \fBKADM5_PASS_Q_*\fR (password quality violations)
604 .RE
606 .RE
608 .sp
609 .ne 2
610 .na
611 \fB\fBdelete_principal\fR [\fB-force\fR] \fIprincipal\fR\fR
612 .ad
613 .sp .6
614 .RS 4n
615 Deletes the specified principal from the database. This command prompts for
616 deletion, unless the \fB-force\fR option is given. This command requires the
617 \fBdelete\fR privilege. Aliased by \fBdelprinc\fR.
618 .sp
619 .ne 2
620 .na
621 \fBExample:\fR
622 .ad
623 .sp .6
624 .RS 4n
625 .sp
626 .in +2
627 .nf
628 kadmin: \fBdelprinc mwm_user\fR
629 Are you sure you want to delete the principal
630 "mwm_user@ACME.COM"? (yes/no): \fByes\fR
631 Principal "mwm_user@ACME.COM" deleted.
632 Make sure that you have removed this principal from
633 all kadmind ACLs before reusing.
634 kadmin:
635 .fi
636 .in -2
637 .sp
639 .RE
641 .sp
642 .ne 2
643 .na
644 \fBErrors:\fR
645 .ad
646 .sp .6
647 .RS 4n
648 \fBKADM5_AUTH_DELETE\fR (requires \fBdelete\fR privilege)
649 .sp
650 \fBKADM5_UNK_PRINC\fR (principal does not exist)
651 .RE
653 .RE
655 .sp
656 .ne 2
657 .na
658 \fB\fBmodify_principal\fR [\fIoptions\fR] \fIprincipal\fR\fR
659 .ad
660 .sp .6
661 .RS 4n
662 Modifies the specified principal, changing the fields as specified. The options
663 are as above for \fBadd_principal\fR, except that password changing is
664 forbidden by this command. In addition, the option \fB-clearpolicy\fR will
665 clear the current policy of a principal. This command requires the \fBmodify\fR
666 privilege. Aliased by \fBmodprinc\fR.
667 .sp
668 .ne 2
669 .na
670 \fBErrors:\fR
671 .ad
672 .sp .6
673 .RS 4n
674 \fBKADM5_AUTH_MODIFY\fR (requires \fBmodify\fR privilege)
675 .sp
676 \fBKADM5_UNK_PRINC\fR (principal does not exist)
677 .sp
678 \fBKADM5_UNK_POLICY\fR (policy does not exist)
679 .sp
680 \fBKADM5_BAD_MASK\fR (should not happen)
681 .RE
683 .RE
685 .sp
686 .ne 2
687 .na
688 \fB\fBchange_password\fR [\fIoptions\fR] \fIprincipal\fR\fR
689 .ad
690 .sp .6
691 .RS 4n
692 Changes the password of \fIprincipal\fR. Prompts for a new password if neither
693 \fB-randkey\fR or \fB-pw\fR is specified. Requires the \fBchangepw\fR
694 privilege, or that the principal that is running the program to be the same as
695 the one changed. Aliased by \fBcpw\fR. The following options are available:
696 .sp
697 .ne 2
698 .na
699 \fB\fB-randkey\fR\fR
700 .ad
701 .sp .6
702 .RS 4n
703 Sets the key of the principal to a random value.
704 .RE
706 .sp
707 .ne 2
708 .na
709 \fB\fB-pw\fR \fIpassword\fR\fR
710 .ad
711 .sp .6
712 .RS 4n
713 Sets the password to the specified string. Not recommended.
714 .RE
716 .sp
717 .ne 2
718 .na
719 \fB\fB-e\fR "enc:salt ..."\fR
720 .ad
721 .sp .6
722 .RS 4n
723 Override the list of enctype:salttype pairs given in \fBkdc.conf\fR(4) for
724 setting the key of the principal. The quotes are necessary if there are
725 multiple enctype:salttype pairs. For each key, the first matching similar
726 enctype and same salttype in the list will be used to set the new key(s).
727 .RE
729 .sp
730 .ne 2
731 .na
732 \fB\fB-keepold\fR\fR
733 .ad
734 .sp .6
735 .RS 4n
736 Keeps the previous kvno's keys around. There is no easy way to delete the old
737 keys, and this flag is usually not necessary except perhaps for TGS keys as it
738 will allow existing valid TGTs to continue to work.
739 .RE
741 .sp
742 .ne 2
743 .na
744 \fBExample:\fR
745 .ad
746 .sp .6
747 .RS 4n
748 .sp
749 .in +2
750 .nf
751 kadmin: \fBcpw systest\fR
752 Enter password for principal systest@ACME.COM:
753 Re-enter password for principal systest@ACME.COM:
754 Password for systest@ACME.COM changed.
755 kadmin:
756 .fi
757 .in -2
758 .sp
760 .RE
762 .sp
763 .ne 2
764 .na
765 \fBErrors:\fR
766 .ad
767 .sp .6
768 .RS 4n
769 \fBKADM5_AUTH_MODIFY\fR (requires the \fBmodify\fR privilege)
770 .sp
771 \fBKADM5_UNK_PRINC\fR (principal does not exist)
772 .sp
773 \fBKADM5_PASS_Q_*\fR (password policy violation errors)
774 .sp
775 \fBKADM5_PASS_REUSE\fR (password is in principal's password history)
776 .sp
777 \fBKADM5_PASS_TOOSOON\fR (current password minimum life not expired)
778 .RE
780 .RE
782 .sp
783 .ne 2
784 .na
785 \fB\fBget_principal\fR [\fB-terse\fR] \fIprincipal\fR\fR
786 .ad
787 .sp .6
788 .RS 4n
789 Gets the attributes of \fIprincipal\fR. Requires the \fBinquire\fR privilege,
790 or that the principal that is running the program to be the same as the one
791 being listed. With the \fB-terse\fR option, outputs fields as quoted
792 tab-separated strings. Aliased by \fBgetprinc\fR.
793 .sp
794 .ne 2
795 .na
796 \fBExamples:\fR
797 .ad
798 .sp .6
799 .RS 4n
800 .sp
801 .in +2
802 .nf
803 kadmin: \fBgetprinc tlyu/admin\fR
804 Principal: tlyu/admin@ACME.COM
805 Expiration date: [never]
806 Last password change: Thu Jan 03 12:17:46 CET 2008
807 Password expiration date: [none]
808 Maximum ticket life: 24855 days 03:14:07
809 Maximum renewable life: 24855 days 03:14:07
810 Last modified: Thu Jan 03 12:17:46 CET 2008 (root/admin@ACME.COM)
811 Last successful authentication: [never]
812 Last failed authentication: [never]
813 Failed password attempts: 0
814 Number of keys: 5
815 Key: vno 2, AES-256 CTS mode with 96-bit SHA-1 HMAC, no salt
816 Key: vno 2, AES-128 CTS mode with 96-bit SHA-1 HMAC, no salt
817 Key: vno 2, Triple DES cbc mode with HMAC/sha1, no salt
818 Key: vno 2, ArcFour with HMAC/md5, no salt
819 Key: vno 2, DES cbc mode with RSA-MD5, no salt
820 Attributes: REQUIRES_PRE_AUTH
821 Policy: [none]
822 kadmin: \fBgetprinc -terse tlyu/admin\fR
823 "tlyu/admin@ACME.COM" 0 1199359066 0 2147483647
824 "root/admin@ACME.COM" 1199359066 128 2 0 "[none]" 21474836
825 47 0 0 0 5 1 2 18 0 1 2
826 17 0 1 2 16 0 1 2 23 0 12
827 3 0
828 kadmin:
829 .fi
830 .in -2
831 .sp
833 .RE
835 .sp
836 .ne 2
837 .na
838 \fBErrors:\fR
839 .ad
840 .sp .6
841 .RS 4n
842 \fBKADM5_AUTH_GET\fR (requires the get [inquire] privilege)
843 .sp
844 \fBKADM5_UNK_PRINC\fR (principal does not exist)
845 .RE
847 .RE
849 .sp
850 .ne 2
851 .na
852 \fB\fBlist_principals\fR [\fIexpression\fR]\fR
853 .ad
854 .sp .6
855 .RS 4n
856 Retrieves all or some principal names. \fIexpression\fR is a shell-style glob
857 expression that can contain the wild-card characters ?, *, and []'s. All
858 principal names matching the expression are printed. If no expression is
859 provided, all principal names are printed. If the expression does not contain
860 an "@" character, an "@" character followed by the local realm is appended to
861 the expression. Requires the \fBlist\fR privilege. Aliased by \fBlistprincs\fR,
862 \fBget_principals\fR, and \fBgetprincs\fR.
863 .sp
864 .ne 2
865 .na
866 \fBExamples:\fR
867 .ad
868 .sp .6
869 .RS 4n
870 .sp
871 .in +2
872 .nf
873 kadmin: \fBlistprincs test*\fR
874 test3@ACME.COM
875 test2@ACME.COM
876 test1@ACME.COM
877 testuser@ACME.COM
878 kadmin:
879 .fi
880 .in -2
881 .sp
883 .RE
885 .RE
887 .sp
888 .ne 2
889 .na
890 \fB\fBadd_policy\fR [\fIoptions\fR] \fIpolicy\fR\fR
891 .ad
892 .sp .6
893 .RS 4n
894 Adds the named policy to the policy database. Requires the \fBadd\fR privilege.
895 Aliased by \fBaddpol\fR. The following options are available:
896 .sp
897 .ne 2
898 .na
899 \fB\fB-maxlife\fR \fImaxlife\fR\fR
900 .ad
901 .sp .6
902 .RS 4n
903 sets the maximum lifetime of a password. See the \fBTime\fR \fBFormats\fR
904 section for the valid time duration formats that you can specify for
905 \fImaxlife\fR.
906 .RE
908 .sp
909 .ne 2
910 .na
911 \fB\fB-minlife\fR \fIminlife\fR\fR
912 .ad
913 .sp .6
914 .RS 4n
915 sets the minimum lifetime of a password. See the \fBTime\fR \fBFormats\fR
916 section for the valid time duration formats that you can specify for
917 \fIminlife\fR.
918 .RE
920 .sp
921 .ne 2
922 .na
923 \fB\fB-minlength\fR \fIlength\fR\fR
924 .ad
925 .sp .6
926 .RS 4n
927 sets the minimum length of a password.
928 .RE
930 .sp
931 .ne 2
932 .na
933 \fB\fB-minclasses\fR \fInumber\fR\fR
934 .ad
935 .sp .6
936 .RS 4n
937 sets the minimum number of character classes allowed in a password. The valid
938 values are:
939 .RE
941 .sp
942 .ne 2
943 .na
944 \fB\fB1\fR\fR
945 .ad
946 .sp .6
947 .RS 4n
948 only letters (himom)
949 .RE
951 .sp
952 .ne 2
953 .na
954 \fB\fB2\fR\fR
955 .ad
956 .sp .6
957 .RS 4n
958 both letters and numbers (hi2mom)
959 .RE
961 .sp
962 .ne 2
963 .na
964 \fB\fB3\fR\fR
965 .ad
966 .sp .6
967 .RS 4n
968 letters, numbers, and punctuation (hi2mom!)
969 .RE
971 .sp
972 .ne 2
973 .na
974 \fB\fB-history\fR \fInumber\fR\fR
975 .ad
976 .sp .6
977 .RS 4n
978 sets the number of past keys kept for a principal.
979 .RE
981 .sp
982 .ne 2
983 .na
984 \fBErrors:\fR
985 .ad
986 .sp .6
987 .RS 4n
988 \fBKADM5_AUTH_ADD\fR (requires the \fBadd\fR privilege)
989 .sp
990 \fBKADM5_DUP\fR (policy already exists)
991 .RE
993 .RE
995 .sp
996 .ne 2
997 .na
998 \fB\fBdelete_policy\fR \fB[-force]\fR \fIpolicy\fR\fR
999 .ad
1000 .sp .6
1001 .RS 4n
1002 Deletes the named policy. Unless the \fB-force\fR option is specified, prompts
1003 for confirmation before deletion. The command will fail if the policy is in use
1004 by any principals. Requires the \fBdelete\fR privilege. Aliased by
1005 \fBdelpol\fR.
1006 .sp
1007 .ne 2
1008 .na
1009 \fBExample:\fR
1010 .ad
1011 .sp .6
1012 .RS 4n
1013 .sp
1014 .in +2
1015 .nf
1016 kadmin: \fBdel_policy guests\fR
1017 Are you sure you want to delete the
1018 policy "guests"? (yes/no): \fByes\fR
1019 Policy "guests" deleted.
1020 kadmin:
1021 .fi
1022 .in -2
1023 .sp
1025 .RE
1027 .sp
1028 .ne 2
1029 .na
1030 \fBErrors:\fR
1031 .ad
1032 .sp .6
1033 .RS 4n
1034 \fBKADM5_AUTH_DELETE\fR (requires the delete privilege)
1035 .sp
1036 \fBKADM5_UNK_POLICY\fR (policy does not exist)
1037 .sp
1038 \fBKADM5_POLICY_REF\fR (reference count on policy is not zero)
1039 .RE
1041 .RE
1043 .sp
1044 .ne 2
1045 .na
1046 \fB\fB\fR\fBmodify_policy\fR \fB[\fIoptions\fR]\fR \fB\fIpolicy\fR\fR\fR
1047 .ad
1048 .sp .6
1049 .RS 4n
1050 Modifies the named policy. Options are as above for \fBadd_policy\fR. Requires
1051 the \fBmodify\fR privilege. Aliased by \fBmodpol\fR.
1052 .sp
1053 .ne 2
1054 .na
1055 \fBErrors:\fR
1056 .ad
1057 .sp .6
1058 .RS 4n
1059 \fBKADM5_AUTH_MODIFY\fR (requires the \fBmodify\fR privilege)
1060 .sp
1061 \fBKADM5_UNK_POLICY\fR (policy does not exist)
1062 .RE
1064 .RE
1066 .sp
1067 .ne 2
1068 .na
1069 \fB\fBget_policy\fR [\fB-terse\fR] \fIpolicy\fR\fR
1070 .ad
1071 .sp .6
1072 .RS 4n
1073 Displays the values of the named policy. Requires the \fBinquire\fR privilege.
1074 With the \fB-terse\fR flag, outputs the fields as quoted strings separated by
1075 tabs. Aliased by \fBgetpol\fR.
1076 .sp
1077 .ne 2
1078 .na
1079 \fBExamples:\fR
1080 .ad
1081 .sp .6
1082 .RS 4n
1083 .sp
1084 .in +2
1085 .nf
1086 kadmin: \fBget_policy admin\fR
1087 Policy: admin
1088 Maximum password life: 180 days 00:00:00
1089 Minimum password life: 00:00:00
1090 Minimum password length: 6
1091 Minimum number of password character classes: 2
1092 Number of old keys kept: 5
1093 Reference count: 17
1094 kadmin: \fBget_policy -terse\fR
1095 admin admin 15552000 0 6 2 5 17
1096 kadmin:
1097 .fi
1098 .in -2
1099 .sp
1101 .RE
1103 .sp
1104 .ne 2
1105 .na
1106 \fBErrors:\fR
1107 .ad
1108 .sp .6
1109 .RS 4n
1110 \fBKADM5_AUTH_GET\fR (requires the \fBget\fR privilege)
1111 .sp
1112 \fBKADM5_UNK_POLICY\fR (policy does not exist)
1113 .RE
1115 .RE
1117 .sp
1118 .ne 2
1119 .na
1120 \fB\fBlist_policies\fR [\fIexpression\fR]\fR
1121 .ad
1122 .sp .6
1123 .RS 4n
1124 Retrieves all or some policy names. \fIexpression\fR is a shell-style glob
1125 expression that can contain the wild-card characters ?, *, and []'s. All policy
1126 names matching the expression are printed. If no expression is provided, all
1127 existing policy names are printed. Requires the \fBlist\fR privilege. Aliased
1128 by \fBlistpols\fR, \fBget_policies\fR, and \fBgetpols\fR.
1129 .sp
1130 .ne 2
1131 .na
1132 \fBExamples:\fR
1133 .ad
1134 .sp .6
1135 .RS 4n
1136 .sp
1137 .in +2
1138 .nf
1139 kadmin: \fBlistpols\fR
1140 test-pol dict-only once-a-min test-pol-nopw
1141 kadmin: \fBlistpols t*\fR
1142 test-pol test-pol-nopw kadmin:
1143 .fi
1144 .in -2
1145 .sp
1147 .RE
1149 .RE
1151 .sp
1152 .ne 2
1153 .na
1154 \fB\fBktadd\fR [\fB-k\fR \fIkeytab\fR] [\fB-q\fR] [\fB-e\fR
1155 \fB\fIenctype\fR:salt\fR]\fR
1156 .ad
1157 .sp .6
1158 .RS 4n
1159 Adds a principal or all principals matching \fIprinc-exp\fR to a keytab,
1160 randomizing each principal's key in the process.
1161 .sp
1162 \fBktadd\fR requires the \fBinquire\fR and \fBchangepw\fR privileges. An entry
1163 for each of the principal's unique encryption types is added, ignoring multiple
1164 keys with the same encryption type but different \fBsalt\fR types. If the
1165 \fB-k\fR argument is not specified, the default keytab file,
1166 \fB/etc/krb5/krb5.keytab\fR, is used.
1167 .sp
1168 The "\fB-e\fR \fB\fIenctype\fR:salt\fR" option overrides the list of
1169 \fIenctypes\fR given in \fBkrb5.conf\fR(4), in the \fBpermitted_enctypes\fR
1170 parameter. If "\fB-e\fR \fB\fIenctype\fR:salt\fR" is not used and
1171 \fBpermitted_enctypes\fR is not defined in \fBkrb5.conf\fR(4), a key for each
1172 \fIenctype\fR supported by the system on which \fBkadmin\fR is run will be
1173 created and added to the \fBkeytab\fR. Restricting the \fIenctypes\fR of keys
1174 in the \fBkeytab\fR is useful when the system for which keys are being created
1175 does not support the same set of \fIenctypes\fR as the KDC. Note that
1176 \fBktadd\fR modifies the \fIenctype\fR of the keys in the principal database as
1177 well.
1178 .sp
1179 If the \fB-q\fR option is specified, less status information is displayed.
1180 Aliased by \fBxst\fR. The \fB-glob\fR option requires the \fBlist\fR privilege.
1181 Also, note that if you use \fB-glob\fR to create a keytab, you need to remove
1182 \fB/etc/krb5/kadm5.keytab\fR and create it again if you want to use \fB-p\fR
1183 \fB*/admin\fR with \fBkadmin\fR.
1184 .RE
1186 .sp
1187 .ne 2
1188 .na
1189 \fB\fBprinc-exp\fR\fR
1190 .ad
1191 .sp .6
1192 .RS 4n
1193 \fIprinc-exp\fR follows the same rules described for the \fBlist_principals\fR
1194 command.
1195 .sp
1196 .ne 2
1197 .na
1198 \fBExample:\fR
1199 .ad
1200 .sp .6
1201 .RS 4n
1202 .sp
1203 .in +2
1204 .nf
1205 kadmin: \fBktadd -k /tmp/new-keytab nfs/chicago\fR
1206 Entry for principal nfs/chicago with kvno 2,
1207 encryption type DES-CBC-CRC added to keytab
1208 WRFILE:/tmp/new-keytab.
1209 kadmin:
1210 .fi
1211 .in -2
1212 .sp
1214 .RE
1216 .RE
1218 .sp
1219 .ne 2
1220 .na
1221 \fB\fBktremove\fR [\fB-k\fR \fIkeytab\fR] [\fB-q\fR] \fIprincipal\fR
1222 [\fIkvno\fR | \fBall\fR | \fBold\fR]\fR
1223 .ad
1224 .sp .6
1225 .RS 4n
1226 Removes entries for the specified principal from a keytab. Requires no
1227 privileges, since this does not require database access. If \fBall\fR is
1228 specified, all entries for that principal are removed; if \fBold\fR is
1229 specified, all entries for that principal except those with the highest kvno
1230 are removed. Otherwise, the value specified is parsed as an integer, and all
1231 entries whose \fBkvno\fR match that integer are removed. If the \fB-k\fR
1232 argument is not specified, the default keytab file,
1233 \fB/etc/krb5/krb5.keytab\fR, is used. If the \fB-q\fR option is specified, less
1234 status information is displayed. Aliased by \fBktrem\fR.
1235 .sp
1236 .ne 2
1237 .na
1238 \fBExample:\fR
1239 .ad
1240 .sp .6
1241 .RS 4n
1242 .sp
1243 .in +2
1244 .nf
1245 kadmin: \fBktremove -k /tmp/new-keytab nfs/chicago\fR
1246 Entry for principal nfs/chicago with kvno 2
1247 removed from keytab
1248 WRFILE:/tmp/new-keytab.
1249 kadmin:
1250 .fi
1251 .in -2
1252 .sp
1254 .RE
1256 .RE
1258 .sp
1259 .ne 2
1260 .na
1261 \fB\fBquit\fR\fR
1262 .ad
1263 .sp .6
1264 .RS 4n
1265 Quits \fBkadmin\fR. Aliased by \fBexit\fR and \fBq\fR.
1266 .RE
1268 .SS "Time Formats"
1269 .sp
1270 .LP
1271 Various commands in \fBkadmin\fR can take a variety of time formats, specifying
1272 time durations or absolute times. The \fBkadmin\fR option variables
1273 \fImaxrenewlife\fR, \fImaxlife\fR, and \fIminlife\fR are time durations,
1274 whereas \fIexpdate\fR and \fIpwexpdate\fR are absolute times.
1275 .sp
1276 .ne 2
1277 .na
1278 \fBExamples:\fR
1279 .ad
1280 .sp .6
1281 .RS 4n
1282 .sp
1283 .in +2
1284 .nf
1285 kadmin: \fBmodprinc -expire "12/31 7pm" jdb\fR
1286 kadmin: \fBmodprinc -maxrenewlife "2 fortnight" jdb\fR
1287 kadmin: \fBmodprinc -pwexpire "this sunday" jdb\fR
1288 kadmin: \fBmodprinc -expire never jdb\fR
1289 kadmin: \fBmodprinc -maxlife "7:00:00pm tomorrow" jdb\fR
1290 .fi
1291 .in -2
1292 .sp
1294 .RE
1296 .sp
1297 .LP
1298 Note that times which do not have the "ago" specifier default to being absolute
1299 times, unless they appear in a field where a duration is expected. In that
1300 case, the time specifier will be interpreted as relative. Specifying "ago" in a
1301 duration can result in unexpected behavior.
1302 .sp
1303 .LP
1304 The following time formats and units can be combined to specify a time. The
1305 time and date format examples are based on the date and time of July 2, 1999,
1306 1:35:30 p.m.
1307 .sp
1309 .sp
1310 .TS
1311 box;
1312 l l
1313 l l .
1314 \fBTime Format\fR \fBExamples\fR
1315 \fIhh\fR[:\fImm\fR][:\fIss\fR][am/pm/a.m./p.m.] 1p.m., 1:35, 1:35:30pm
1316 .TE
1318 .sp
1320 .sp
1321 .TS
1322 l l
1323 l l .
1324 \fBVariable\fR \fBDescription\fR
1325 \fIhh\fR T{
1326 hour (12-hour clock, leading zero permitted but not required)
1327 T}
1328 \fImm\fR minutes
1329 \fIss\fR seconds
1330 .TE
1332 .sp
1334 .sp
1335 .TS
1336 box;
1337 l l
1338 l l .
1339 \fBDate Format\fR \fBExamples\fR
1340 \fImm\fR/\fBdd\fR[/\fIyy\fR] 07/02, 07/02/99
1341 \fIyyyy\fR-\fImm\fR-\fBdd\fR 1999-07-02
1342 \fBdd\fR-\fImonth\fR-\fIyyyy\fR 02-July-1999
1343 \fImonth\fR [,\fIyyyy\fR] Jul 02, July 02,1999
1344 \fBdd\fR \fImonth\fR[ \fIyyyy\fR] 02 JULY, 02 july 1999
1345 .TE
1347 .sp
1349 .sp
1350 .TS
1351 l l
1352 l l .
1353 \fBVariable Description\fR
1354 \fBdd\fR day
1355 \fImm\fR month
1356 \fIyy\fR T{
1357 year within century (00-38 is 2000 to 2038; 70-99 is 1970 to 1999)
1358 T}
1359 \fIyyyy\fR year including century
1360 \fImonth\fR locale's full or abbreviated month name
1361 .TE
1363 .sp
1365 .sp
1366 .TS
1367 box;
1368 l l
1369 l l .
1370 \fBTime Units\fR \fBExamples\fR
1371 [+|- \fI#\fR] year "-2 year"
1372 [+|- \fI#\fR] month "2 months"
1373 [+|- \fI#\fR] fortnight
1374 [+|- \fI#\fR] week
1375 [+|- \fI#\fR] day
1376 [+|- \fI#\fR] hour
1377 [+|- \fI#\fR] minute
1378 [+|- \fI#\fR] min
1379 [+|- \fI#\fR] second
1380 [+|- \fI#\fR] sec
1381 tomorrow
1382 yesterday
1383 today
1384 now
1385 this "this year"
1386 last "last saturday"
1387 next "next month"
1388 sunday
1389 monday
1390 tuesday
1391 wednesday
1392 thursday
1393 friday
1394 saturday
1395 never
1396 .TE
1398 .sp
1399 .LP
1400 You can also use the following time modifiers: \fBfirst\fR, \fBsecond\fR,
1401 \fBthird\fR, \fBfourth\fR, \fBfifth\fR, \fBsixth\fR, \fBseventh\fR,
1402 \fBeighth\fR, \fBninth\fR, \fBtenth\fR, \fBeleventh\fR, \fBtwelfth\fR, and
1403 \fBago\fR.
1404 .SH ENVIRONMENT VARIABLES
1405 .sp
1406 .LP
1407 See \fBenviron\fR(5) for descriptions of the following environment variables
1408 that affect the execution of \fBkadmin\fR:
1409 .sp
1410 .ne 2
1411 .na
1412 \fB\fBPAGER\fR\fR
1413 .ad
1414 .sp .6
1415 .RS 4n
1416 The command to use as a filter for paging output. This can also be used to
1417 specify options. The default is \fBmore\fR(1).
1418 .RE
1420 .SH FILES
1421 .sp
1422 .ne 2
1423 .na
1424 \fB\fB/var/krb5/principal\fR\fR
1425 .ad
1426 .sp .6
1427 .RS 4n
1428 Kerberos principal database.
1429 .RE
1431 .sp
1432 .ne 2
1433 .na
1434 \fB\fB/var/krb5/principal.ulog\fR\fR
1435 .ad
1436 .sp .6
1437 .RS 4n
1438 The update log file for incremental propagation.
1439 .RE
1441 .sp
1442 .ne 2
1443 .na
1444 \fB\fB/var/krb5/principal.kadm5\fR\fR
1445 .ad
1446 .sp .6
1447 .RS 4n
1448 Kerberos administrative database. Contains policy information.
1449 .RE
1451 .sp
1452 .ne 2
1453 .na
1454 \fB\fB/var/krb5/principal.kadm5.lock\fR\fR
1455 .ad
1456 .sp .6
1457 .RS 4n
1458 Lock file for the Kerberos administrative database. This file works backwards
1459 from most other lock files (that is, \fBkadmin\fR will exit with an error if
1460 this file does \fInot\fR exist).
1461 .RE
1463 .sp
1464 .ne 2
1465 .na
1466 \fB\fB/var/krb5/kadm5.dict\fR\fR
1467 .ad
1468 .sp .6
1469 .RS 4n
1470 Dictionary of strings explicitly disallowed as passwords.
1471 .RE
1473 .sp
1474 .ne 2
1475 .na
1476 \fB\fB/etc/krb5/kadm5.acl\fR\fR
1477 .ad
1478 .sp .6
1479 .RS 4n
1480 List of principals and their \fBkadmin\fR administrative privileges.
1481 .RE
1483 .sp
1484 .ne 2
1485 .na
1486 \fB\fB/etc/krb5/kadm5.keytab\fR\fR
1487 .ad
1488 .sp .6
1489 .RS 4n
1490 Keytab for \fBkadmind\fR principals: \fBkadmin\fR/\fIfqdn\fR,
1491 \fBchangepw\fR/\fIfqdn\fR, and \fBkadmin\fR/\fBchangepw\fR.
1492 .RE
1494 .SH ATTRIBUTES
1495 .sp
1496 .LP
1497 See \fBattributes\fR(5) for descriptions of the following attributes:
1498 .sp
1500 .sp
1501 .TS
1502 box;
1503 c | c
1504 l | l .
1505 ATTRIBUTE TYPE ATTRIBUTE VALUE
1506 _
1507 Interface Stability Committed
1508 .TE
1510 .SH SEE ALSO
1511 .sp
1512 .LP
1513 \fBkpasswd\fR(1), \fBmore\fR(1), \fBgkadmin\fR(1M), \fBkadmind\fR(1M),
1514 \fBkdb5_util\fR(1M), \fBkdb5_ldap_util\fR(1M), \fBkproplog\fR(1M),
1515 \fBkadm5.acl\fR(4), \fBkdc.conf\fR(4), \fBkrb5.conf\fR(4), \fBattributes\fR(5),
1516 \fBenviron\fR(5), \fBkerberos\fR(5), \fBkrb5envvar\fR(5)
1517 .SH HISTORY
1518 .sp
1519 .LP
1520 The \fBkadmin\fR program was originally written by Tom Yu at MIT, as an
1521 interface to the OpenVision Kerberos administration program.
1522 .SH DIAGNOSTICS
1523 .sp
1524 .LP
1525 The \fBkadmin\fR command is currently incompatible with the MIT \fBkadmind\fR
1526 daemon interface, so you cannot use this command to administer an MIT-based
1527 Kerberos database. However, clients running the Solaris implementation of
1528 Kerberos can still use an MIT-based KDC.