| blob | 27e6fa0fddafa0bb968a83ff1dec3f55f0bbc926 |
1 '\" te
2 .\" Copyright (c) 2001, Sun Microsystems, Inc. All Rights Reserved.
3 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
4 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
5 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
6 .TH KDB5_UTIL 1M "Feb 29, 2008"
7 .SH NAME
8 kdb5_util \- Kerberos Database maintenance utility
9 .SH SYNOPSIS
10 .LP
11 .nf
12 \fB/usr/sbin/kdb5_util\fR [\fB-d\fR \fIdbname\fR] [\fB-f\fR \fIstashfile_name\fR]
13 [\fB-k\fR \fImkeytype\fR] [\fB-m\fR ] [\fB-M\fR \fImkeyname\fR] [\fB-P\fR \fIpassword\fR] [\fB-r\fR \fIrealm\fR]
14 [\fB-x\fR \fIdb_args\fR]... \fIcmd\fR
15 .fi
17 .SH DESCRIPTION
18 .sp
19 .LP
20 The \fBkdb5_util\fR utility enables you to create, dump, load, and destroy the
21 Kerberos V5 database. You can also use \fBkdb5_util\fR to create a stash file
22 containing the Kerberos database master key.
23 .SH OPTIONS
24 .sp
25 .LP
26 The following options are supported:
27 .sp
28 .ne 2
29 .na
30 \fB\fB-d\fR \fIdbname\fR\fR
31 .ad
32 .sp .6
33 .RS 4n
34 Specify the database name. \fB\&.db\fR is appended to whatever name is
35 specified. You can specify an absolute path. If you do not specify the \fB-d\fR
36 option, the default database name is \fB/var/krb5/principal\fR.
37 .RE
39 .sp
40 .ne 2
41 .na
42 \fB\fB-f\fR \fIstashfile_name\fR\fR
43 .ad
44 .sp .6
45 .RS 4n
46 Specify the stash file name. You can specify an absolute path.
47 .RE
49 .sp
50 .ne 2
51 .na
52 \fB\fB-k\fR \fImkeytype\fR\fR
53 .ad
54 .sp .6
55 .RS 4n
56 Specify the master key type. Valid values are \fBdes3-cbc-sha1\fR,
57 \fBdes-cbc-crc\fR, \fBdes-cbc-md5\fR, \fBdes-cbc-raw\fR,
58 \fBarcfour-hmac-md5\fR, \fBarcfour-hmac-md5-exp\fR,
59 \fBaes128-cts-hmac-sha1-96\fR, and \fBaes256-cts-hmac-sha1-96\fR.
60 .RE
62 .sp
63 .ne 2
64 .na
65 \fB\fB-m\fR\fR
66 .ad
67 .sp .6
68 .RS 4n
69 Enter the master key manually.
70 .RE
72 .sp
73 .ne 2
74 .na
75 \fB\fB-M\fR \fImkeyname\fR\fR
76 .ad
77 .sp .6
78 .RS 4n
79 Specify the master key name.
80 .RE
82 .sp
83 .ne 2
84 .na
85 \fB\fB-P\fR \fIpassword\fR\fR
86 .ad
87 .sp .6
88 .RS 4n
89 Use the specified \fIpassword\fR instead of the stash file.
90 .RE
92 .sp
93 .ne 2
94 .na
95 \fB\fB-r\fR \fIrealm\fR\fR
96 .ad
97 .sp .6
98 .RS 4n
99 Use \fIrealm\fR as the default database realm.
100 .RE
102 .sp
103 .ne 2
104 .na
105 \fB\fB-x\fR \fIdb_args\fR\fR
106 .ad
107 .sp .6
108 .RS 4n
109 Pass database-specific arguments to \fBkadmin\fR. Supported arguments are for
110 LDAP and the \fBBerkeley-db2\fR plug-in. These arguments are:
111 .sp
112 .ne 2
113 .na
114 \fB\fBbinddn\fR=\fIbinddn\fR\fR
115 .ad
116 .sp .6
117 .RS 4n
118 LDAP simple bind DN for authorization on the directory server. Overrides the
119 \fBldap_kadmind_dn\fR parameter setting in \fBkrb5.conf\fR(4).
120 .RE
122 .sp
123 .ne 2
124 .na
125 \fB\fBbindpwd\fR=\fIbindpwd\fR\fR
126 .ad
127 .sp .6
128 .RS 4n
129 Bind password.
130 .RE
132 .sp
133 .ne 2
134 .na
135 \fB\fBdbname\fR=\fIname\fR\fR
136 .ad
137 .sp .6
138 .RS 4n
139 For the \fBBerkeley-db2\fR plug-in, specifies a name for the Kerberos database.
140 .RE
142 .sp
143 .ne 2
144 .na
145 \fB\fBnconns\fR=\fInum\fR\fR
146 .ad
147 .sp .6
148 .RS 4n
149 Maximum number of server connections.
150 .RE
152 .sp
153 .ne 2
154 .na
155 \fB\fBport\fR=\fInum\fR\fR
156 .ad
157 .sp .6
158 .RS 4n
159 Directory server connection port.
160 .RE
162 .RE
164 .SH OPERANDS
165 .sp
166 .LP
167 The following operands are supported:
168 .sp
169 .ne 2
170 .na
171 \fB\fIcmd\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Specifies whether to create, destroy, dump, or load the database, or to create
176 a stash file.
177 .sp
178 You can specify the following commands:
179 .sp
180 .ne 2
181 .na
182 \fB\fBcreate\fR \fB-s\fR\fR
183 .ad
184 .sp .6
185 .RS 4n
186 Creates the database specified by the \fB-d\fR option. You will be prompted for
187 the database master password. If you specify \fB-s\fR, a stash file is created
188 as specified by the \fB-f\fR option. If you did not specify \fB-f\fR, the
189 default stash file name is \fB/var/krb5/.k5.realm\fR. If you use the \fB-f\fR,
190 \fB-k\fR, or \fB-M\fR options when you create a database, then you must use the
191 same options when modifying or destroying the database.
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fBdestroy\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 Destroys the database specified by the \fB-d\fR option.
202 .RE
204 .sp
205 .ne 2
206 .na
207 \fB\fBstash\fR\fR
208 .ad
209 .sp .6
210 .RS 4n
211 Creates a stash file. If \fB-f\fR was not specified, the default stash file
212 name is \fB/var/krb5/.k5.realm\fR. You will be prompted for the master database
213 password. This command is useful when you want to generate the stash file from
214 the password.
215 .RE
217 .sp
218 .ne 2
219 .na
220 \fB\fBdump\fR [\fB-old\fR] [\fB-b6\fR] [\fB-b7\fR] [\fB-ov\fR] [\fB-verbose\fR]
221 [\fB-mkey_convert\fR] [\fB-new_mkey_file\fR \fImkey_file\fR] [\fB-rev\fR]
222 [\fB-recurse\fR] [\fIfilename\fR [\fIprincipals\fR...]]\fR
223 .ad
224 .sp .6
225 .RS 4n
226 Dumps the current Kerberos and KADM5 database into an ASCII file. By default,
227 the database is dumped in current format, "\fBkdb5_util load_dumpversion 5\fR".
228 If \fIfilename\fR is not specified or is the string "-", the dump is sent to
229 standard output. Options are as follows:
230 .sp
231 .ne 2
232 .na
233 \fB\fB-old\fR\fR
234 .ad
235 .sp .6
236 .RS 4n
237 Causes the dump to be in the Kerberos 5 Beta 5 and earlier dump format
238 ("\fBkdb5_edit load_dump version 2.0\fR").
239 .RE
241 .sp
242 .ne 2
243 .na
244 \fB\fB-b6\fR\fR
245 .ad
246 .sp .6
247 .RS 4n
248 Causes the dump to be in the Kerberos 5 Beta 6 format ("\fBkdb5_edit load_dump
249 version 3.0\fR").
250 .RE
252 .sp
253 .ne 2
254 .na
255 \fB\fB-b7\fR\fR
256 .ad
257 .sp .6
258 .RS 4n
259 Causes the dump to be in the Kerberos 5 Beta 7 format ("\fBkdb5_util load_dump
260 version 4\fR"). This was the dump format produced on releases prior to 1.2.2.
261 .RE
263 .sp
264 .ne 2
265 .na
266 \fB\fB-ov\fR\fR
267 .ad
268 .sp .6
269 .RS 4n
270 Causes the dump to be in \fBovsec_adm_export\fR format.
271 .RE
273 .sp
274 .ne 2
275 .na
276 \fB\fB-verbose\fR\fR
277 .ad
278 .sp .6
279 .RS 4n
280 Causes the name of each principal and policy to be displayed as it is dumped.
281 .RE
283 .sp
284 .ne 2
285 .na
286 \fB\fB-mkey_convert\fR\fR
287 .ad
288 .sp .6
289 .RS 4n
290 Prompts for a new master key. This new master key will be used to re-encrypt
291 the key data in the dumpfile. The key data in the database will not be changed.
292 .RE
294 .sp
295 .ne 2
296 .na
297 \fB\fB-new_mkey_file\fR \fImkey_file\fR\fR
298 .ad
299 .sp .6
300 .RS 4n
301 The filename of a stash file. The master key in this stash file will be used to
302 re-encrypt the key data in the dumpfile. The key data in the database will not
303 be changed.
304 .RE
306 .sp
307 .ne 2
308 .na
309 \fB\fB-rev\fR\fR
310 .ad
311 .sp .6
312 .RS 4n
313 Dumps in reverse order. This might recover principals that do not dump
314 normally, in cases where database corruption has occured.
315 .RE
317 .sp
318 .ne 2
319 .na
320 \fB\fB-recurse\fR\fR
321 .ad
322 .sp .6
323 .RS 4n
324 Causes the dump to walk the database recursively (\fBbtree\fR only). This might
325 recover principals that do not dump normally, in cases where database
326 corruption has occurred. In cases of such corruption, this option will probably
327 retrieve more principals than will the \fB-rev\fR option.
328 .RE
330 .RE
332 .sp
333 .ne 2
334 .na
335 \fB\fBload\fR [\fB-old\fR] [\fB-b6\fR] [\fB-b7\fR] [\fB-ov\fR] [\fB-hash\fR]
336 [\fB-verbose\fR] [\fB-update\fR] \fIfilename\fR \fIdbname\fR
337 [\fIadmin_dbname\fR]\fR
338 .ad
339 .sp .6
340 .RS 4n
341 Loads a database dump from \fIfilename\fR into \fIdbname\fR. Unless the
342 \fB-old\fR or \fB-b6\fR option is specified, the format of the dump file is
343 detected automatically and handled appropriately. Unless the \fB-update\fR
344 option is specified, \fBload\fR creates a new database containing only the
345 principals in the dump file, overwriting the contents of any existing database.
346 The \fB-old\fR option requires the database to be in the Kerberos 5 Beta 5 or
347 earlier format ("\fBkdb5_edit load_dump version 2.0\fR").
348 .sp
349 .ne 2
350 .na
351 \fB\fB-b6\fR\fR
352 .ad
353 .sp .6
354 .RS 4n
355 Requires the database to be in the Kerberos 5 Beta 6 format ("\fBkdb5_edit
356 load_dump version 3.0\fR").
357 .RE
359 .sp
360 .ne 2
361 .na
362 \fB\fB-b7\fR\fR
363 .ad
364 .sp .6
365 .RS 4n
366 Requires the database to be in the Kerberos 5 Beta 7 format ("\fBkdb5_util
367 load_dump version 4\fR").
368 .RE
370 .sp
371 .ne 2
372 .na
373 \fB\fB-ov\fR\fR
374 .ad
375 .sp .6
376 .RS 4n
377 Requires the database to be in \fBovsec_adm_import\fR format. Must be used with
378 the \fB-update\fR option.
379 .RE
381 .sp
382 .ne 2
383 .na
384 \fB\fB-hash\fR\fR
385 .ad
386 .sp .6
387 .RS 4n
388 Requires the database to be stored as a hash. If this option is not specified,
389 the database will be stored as a \fBbtree\fR. This option is not recommended,
390 as databases stored in hash format are known to corrupt data and lose
391 principals.
392 .RE
394 .sp
395 .ne 2
396 .na
397 \fB\fB-verbose\fR\fR
398 .ad
399 .sp .6
400 .RS 4n
401 Causes the name of each principal and policy to be displayed as it is dumped.
402 .RE
404 .sp
405 .ne 2
406 .na
407 \fB\fB-update\fR\fR
408 .ad
409 .sp .6
410 .RS 4n
411 Records from the dump file are added to or updated in the existing database.
412 Otherwise, a new database is created containing only what is in the dump file
413 and the old one is destroyed upon successful completion.
414 .RE
416 .sp
417 .ne 2
418 .na
419 \fB\fIfilename\fR\fR
420 .ad
421 .sp .6
422 .RS 4n
423 Required argument that specifies a path to a file containing database dump.
424 .RE
426 .sp
427 .ne 2
428 .na
429 \fB\fIdbname\fR\fR
430 .ad
431 .sp .6
432 .RS 4n
433 Required argument that overrides the value specified on the command line or
434 overrides the default.
435 .RE
437 .sp
438 .ne 2
439 .na
440 \fB\fIadmin_dbname\fR\fR
441 .ad
442 .sp .6
443 .RS 4n
444 Optional argument that is derived from \fIdbname\fR if not specified.
445 .RE
447 .RE
449 .RE
451 .SH EXAMPLES
452 .LP
453 \fBExample 1 \fRCreating File that Contains Information about Two Principals
454 .sp
455 .LP
456 The following example creates a file named \fBslavedata\fR that contains the
457 information about two principals, \fBjdb@ACME.COM\fR and \fBpak@ACME.COM\fR.
459 .sp
460 .in +2
461 .nf
462 # /usr/krb5/bin/kdb5_util dump -verbose slavedata
463 jdb@ACME.COM pak@ACME.COM
464 .fi
465 .in -2
466 .sp
468 .SH FILES
469 .sp
470 .ne 2
471 .na
472 \fB\fB/var/krb5/principal\fR\fR
473 .ad
474 .sp .6
475 .RS 4n
476 Kerberos principal database.
477 .RE
479 .sp
480 .ne 2
481 .na
482 \fB\fB/var/krb5/principal.kadm5\fR\fR
483 .ad
484 .sp .6
485 .RS 4n
486 Kerberos administrative database. Contains policy information.
487 .RE
489 .sp
490 .ne 2
491 .na
492 \fB\fB/var/krb5/principal.kadm5.lock\fR\fR
493 .ad
494 .sp .6
495 .RS 4n
496 Lock file for the Kerberos administrative database. This file works backwards
497 from most other lock files (that is, \fBkadmin\fR exits with an error if this
498 file does not exist).
499 .RE
501 .sp
502 .ne 2
503 .na
504 \fB\fB/var/krb5/principal.ulog\fR\fR
505 .ad
506 .sp .6
507 .RS 4n
508 The update log file for incremental propagation.
509 .RE
511 .SH ATTRIBUTES
512 .sp
513 .LP
514 See \fBattributes\fR(5) for descriptions of the following attributes:
515 .sp
517 .sp
518 .TS
519 box;
520 c | c
521 l | l .
522 ATTRIBUTE TYPE ATTRIBUTE VALUE
523 _
524 Interface Stability Evolving
525 .TE
527 .SH SEE ALSO
528 .sp
529 .LP
530 \fBkpasswd\fR(1), \fBgkadmin\fR(1M), \fBkadmin\fR(1M), \fBkadmind\fR(1M),
531 \fBkadmin.local\fR(1M), \fBkdb5_ldap_util\fR(1M), \fBkproplog\fR(1M),
532 \fBkadm5.acl\fR(4), \fBkdc.conf\fR(4), \fBattributes\fR(5), \fBkerberos\fR(5)