| blob | a5bdddd1d99eb63bff86e1fd5c332f519bf03aab |
1 '\" te
2 .\" Copyright 1987, 1989 by the Student Information Processing Board of the Massachusetts Institute of Technology. For copying and distribution information, please see the file kerberosv5/mit-sipb-copyright.h.
3 .\" Portions Copyright (c) 2007, Sun Microsystems, Inc. All Rights Reserved
4 .\" The contents of this file are subject to the terms of the Common Development and Distribution License (the "License"). You may not use this file except in compliance with the License.
5 .\" You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE or http://www.opensolaris.org/os/licensing. See the License for the specific language governing permissions and limitations under the License.
6 .\" When distributing Covered Code, include this CDDL HEADER in each file and include the License file at usr/src/OPENSOLARIS.LICENSE. If applicable, add the following below this CDDL HEADER, with the fields enclosed by brackets "[]" replaced with your own identifying information: Portions Copyright [yyyy] [name of copyright owner]
7 .TH KADMIND 8 "Oct 29, 2015"
8 .SH NAME
9 kadmind \- Kerberos administration daemon
10 .SH SYNOPSIS
11 .LP
12 .nf
13 \fB/usr/lib/krb5/kadmind\fR [\fB-d\fR] [\fB-m\fR] [\fB-p\fR \fIport-number\fR] [\fB-r\fR \fIrealm\fR]
14 \fB-x\fR \fIdb_args\fR]...
15 .fi
17 .SH DESCRIPTION
18 .sp
19 .LP
20 \fBkadmind\fR runs on the master key distribution center (\fBKDC\fR), which
21 stores the principal and policy databases. \fBkadmind\fR accepts remote
22 requests to administer the information in these databases. Remote requests are
23 sent, for example, by \fBkpasswd\fR(1) and \fBkadmin\fR(8) commands, both of
24 which are clients of \fBkadmind\fR. When you install a \fBKDC\fR,
25 \fBkadmind\fR is set up in the \fBinit\fR scripts to start automatically
26 when the \fBKDC\fR is rebooted.
27 .sp
28 .LP
29 \fBkadmind\fR requires a number of configuration files to be set up for it to
30 work:
31 .sp
32 .ne 2
33 .na
34 \fB\fB/etc/krb5/kdc.conf\fR\fR
35 .ad
36 .sp .6
37 .RS 4n
38 The \fBKDC\fR configuration file contains configuration information for the
39 \fBKDC\fR and the Kerberos administration system. \fBkadmind\fR understands a
40 number of configuration variables (called relations) in this file, some of
41 which are mandatory and some of which are optional. In particular,
42 \fBkadmind\fR uses the \fBacl_file\fR, \fBdict_file\fR, \fBadmin_keytab\fR, and
43 \fBkadmind_port\fR relations in the [\fIrealms\fR] section. Refer to the
44 \fBkdc.conf\fR(4) man page for information regarding the format of the
45 \fBKDC\fR configuration file.
46 .RE
48 .sp
49 .ne 2
50 .na
51 \fB\fB/etc/krb5/kadm5.keytab\fR\fR
52 .ad
53 .sp .6
54 .RS 4n
55 \fBkadmind\fR requires a \fBkeytab\fR (key table) containing correct entries
56 for the \fBkadmin\fR/\fIfqdn\fR, \fBkadmin\fR/\fBchangepw\fR and
57 \fBkadmin\fR/\fBchangepw\fR principals for every realm that \fBkadmind\fR
58 answers requests. The \fBkeytab\fR can be created with the
59 \fBkadmin.local\fR(8) or \fBkdb5_util\fR(8) command. The location of the
60 keytab is determined by the \fBadmin_keytab\fR relation in the
61 \fBkdc.conf\fR(4) file.
62 .RE
64 .sp
65 .ne 2
66 .na
67 \fB\fB/etc/krb5/kadm5.acl\fR\fR
68 .ad
69 .sp .6
70 .RS 4n
71 \fBkadmind\fR uses an \fBACL\fR (access control list) to determine which
72 principals are allowed to perform Kerberos administration actions. The path of
73 the \fBACL\fR file is determined by the \fBacl_file\fR relation in the
74 \fBkdc.conf\fR file. See \fBkdc.conf\fR(4). For information regarding the
75 format of the \fBACL\fR file, refer to \fBkadm5.acl\fR(4).
76 .sp
77 The \fBkadmind\fR daemon will need to be restarted to reread the
78 \fBkadm5.acl\fR file after it has been modified. You can do this, as root, with
79 the following command:
80 .sp
81 .in +2
82 .nf
83 # svcadm restart svc:/network/security/kadmin:default
84 .fi
85 .in -2
86 .sp
88 .RE
90 .sp
91 .LP
92 After \fBkadmind\fR begins running, it puts itself in the background and
93 disassociates itself from its controlling terminal.
94 .sp
95 .LP
96 \fBkadmind\fR can be configured for incremental database propagation.
97 Incremental propagation allows slave KDC servers to receive principal and
98 policy updates incrementally instead of receiving full dumps of the database.
99 These settings can be changed in the \fBkdc.conf\fR(4) file:
100 .sp
101 .ne 2
102 .na
103 \fB\fBsunw_dbprop_enable = [true | false]\fR\fR
104 .ad
105 .sp .6
106 .RS 4n
107 Enable or disable incremental database propagation. Default is \fBfalse\fR.
108 .RE
110 .sp
111 .ne 2
112 .na
113 \fB\fBsunw_dbprop_master_ulogsize = N\fR\fR
114 .ad
115 .sp .6
116 .RS 4n
117 Specifies the maximum amount of log entries available for incremental
118 propagation to the slave KDC servers. The maximum value that this can be is
119 2500 entries. Default value is 1000 entries.
120 .RE
122 .sp
123 .LP
124 The \fBkiprop/\fR\fI<hostname>\fR\fB@\fR\fI<REALM>\fR principal must exist in
125 the master's \fBkadm5.keytab\fR file to enable the slave to authenticate
126 incremental propagation from the master. In the principal syntax above,
127 \fI<hostname>\fR is the master KDC's host name and \fI<REALM>\fR is the realm
128 in which the master KDC resides.
129 .sp
130 .LP
131 Kerberos client machines can automatically migrate Unix users to the default
132 Kerberos realm specified in the local \fBkrb5.conf\fR(4), if the user does not
133 have a valid kerberos account already. You achieve this by using the
134 \fBpam_krb5_migrate\fR(5) service module for the service in question. The
135 Kerberos service principal used by the client machine attempting the migration
136 needs to be validated using the \fBu\fR privilege in \fBkadm5.acl\fR(4). When
137 using the \fBu\fR privilege, \fBkadmind\fR validates user passwords using PAM,
138 specifically using a \fBPAM_SERVICE\fR name of \fBk5migrate\fR by calling
139 \fBpam_authenticate\fR(3PAM) and \fBpam_acct_mgmt\fR(3PAM).
140 .sp
141 .LP
142 A suitable PAM stack configuration example for \fBk5migrate\fR would look like:
143 .sp
144 .in +2
145 .nf
146 k5migrate auth required pam_unix_auth.so.1
147 k5migrate account required pam_unix_account.so.1
148 .fi
149 .in -2
150 .sp
152 .SH OPTIONS
153 .sp
154 .LP
155 The following options are supported:
156 .sp
157 .ne 2
158 .na
159 \fB\fB-d\fR\fR
160 .ad
161 .sp .6
162 .RS 4n
163 Specifies that \fBkadmind\fR does not put itself in the background and does not
164 disassociate itself from the terminal. In normal operation, you should use the
165 default behavior, which is to allow the daemon to put itself in the background.
166 .RE
168 .sp
169 .ne 2
170 .na
171 \fB\fB-m\fR\fR
172 .ad
173 .sp .6
174 .RS 4n
175 Specifies that the master database password should be retrieved from the
176 keyboard rather than from the stash file. When using \fB-m\fR, the
177 \fBkadmind\fR daemon receives the password prior to putting itself in the
178 background. If used in combination with the \fB-d\fR option, you must
179 explicitly place the daemon in the background.
180 .RE
182 .sp
183 .ne 2
184 .na
185 \fB\fB-p\fR \fIport-number\fR\fR
186 .ad
187 .sp .6
188 .RS 4n
189 Specifies the port on which the \fBkadmind\fR daemon listens for connections.
190 The default is controlled by the \fBkadmind_port\fR relation in the
191 \fBkdc.conf\fR(4) file.
192 .RE
194 .sp
195 .ne 2
196 .na
197 \fB\fB-r\fR \fIrealm\fR\fR
198 .ad
199 .sp .6
200 .RS 4n
201 Specifies the default realm that \fBkadmind\fR serves. If \fIrealm\fR is not
202 specified, the default \fIrealm\fR of the host is used. \fBkadmind\fR answers
203 requests for any realm that exists in the local \fBKDC\fR database and for
204 which the appropriate principals are in its \fBkeytab\fR.
205 .RE
207 .sp
208 .ne 2
209 .na
210 \fB\fB-x\fR \fIdb_args\fR\fR
211 .ad
212 .sp .6
213 .RS 4n
214 Pass database-specific arguments to \fBkadmind\fR. Supported arguments are for
215 LDAP and the \fBBerkeley-db2\fR plug-in. These arguments are:
216 .sp
217 .ne 2
218 .na
219 \fB\fBbinddn\fR=\fIbinddn\fR\fR
220 .ad
221 .sp .6
222 .RS 4n
223 LDAP simple bind DN for authorization on the directory server. Overrides the
224 \fBldap_kadmind_dn\fR parameter setting in \fBkrb5.conf\fR(4).
225 .RE
227 .sp
228 .ne 2
229 .na
230 \fB\fBbindpwd\fR=\fIbindpwd\fR\fR
231 .ad
232 .sp .6
233 .RS 4n
234 Bind password.
235 .RE
237 .sp
238 .ne 2
239 .na
240 \fB\fBdbname\fR=\fIname\fR\fR
241 .ad
242 .sp .6
243 .RS 4n
244 For the \fBBerkeley-db2\fR plug-in, specifies a name for the Kerberos database.
245 .RE
247 .sp
248 .ne 2
249 .na
250 \fB\fBnconns\fR=\fInum\fR\fR
251 .ad
252 .sp .6
253 .RS 4n
254 Maximum number of server connections.
255 .RE
257 .sp
258 .ne 2
259 .na
260 \fB\fBport\fR=\fInum\fR\fR
261 .ad
262 .sp .6
263 .RS 4n
264 Directory server connection port.
265 .RE
267 .RE
269 .SH FILES
270 .sp
271 .ne 2
272 .na
273 \fB\fB/var/krb5/principal\fR\fR
274 .ad
275 .sp .6
276 .RS 4n
277 Kerberos principal database.
278 .RE
280 .sp
281 .ne 2
282 .na
283 \fB\fB/var/krb5/principal.ulog\fR\fR
284 .ad
285 .sp .6
286 .RS 4n
287 The update log file for incremental propagation.
288 .RE
290 .sp
291 .ne 2
292 .na
293 \fB\fB/var/krb5/principal.kadm5\fR\fR
294 .ad
295 .sp .6
296 .RS 4n
297 Kerberos administrative database containing policy information.
298 .RE
300 .sp
301 .ne 2
302 .na
303 \fB\fB/var/krb5/principal.kadm5.lock\fR\fR
304 .ad
305 .sp .6
306 .RS 4n
307 Kerberos administrative database lock file. This file works backwards from most
308 other lock files (that is, \fBkadmin\fR exits with an error if this file does
309 not exist).
310 .RE
312 .sp
313 .ne 2
314 .na
315 \fB\fB/var/krb5/kadm5.dict\fR\fR
316 .ad
317 .sp .6
318 .RS 4n
319 Dictionary of strings explicitly disallowed as passwords.
320 .RE
322 .sp
323 .ne 2
324 .na
325 \fB\fB/etc/krb5/kadm5.acl\fR\fR
326 .ad
327 .sp .6
328 .RS 4n
329 List of principals and their \fBkadmin\fR administrative privileges.
330 .RE
332 .sp
333 .ne 2
334 .na
335 \fB\fB/etc/krb5/kadm5.keytab\fR\fR
336 .ad
337 .sp .6
338 .RS 4n
339 Keytab for \fBkadmin\fR principals: \fBkadmin\fR/\fIfqdn\fR,
340 \fBchangepw\fR/\fIfqdn\fR, and \fBkadmin\fR/\fBchangepw\fR.
341 .RE
343 .sp
344 .ne 2
345 .na
346 \fB\fB/etc/krb5/kdc.conf\fR\fR
347 .ad
348 .sp .6
349 .RS 4n
350 \fBKDC\fR configuration information.
351 .RE
353 .SH ATTRIBUTES
354 .sp
355 .LP
356 See \fBattributes\fR(5) for descriptions of the following attributes:
357 .sp
359 .sp
360 .TS
361 box;
362 c | c
363 l | l .
364 ATTRIBUTE TYPE ATTRIBUTE VALUE
365 _
366 Interface Stability Evolving
367 .TE
369 .SH SEE ALSO
370 .sp
371 .LP
372 \fBkpasswd\fR(1), \fBsvcs\fR(1), \fBkadmin\fR(8),
373 \fBkadmin.local\fR(8), \fBkdb5_util\fR(8), \fBkdb5_ldap_util\fR(8),
374 \fBkproplog\fR(8), \fBsvcadm\fR(8), \fBpam_acct_mgmt\fR(3PAM),
375 \fBpam_authenticate\fR(3PAM), \fBkadm5.acl\fR(4), \fBkdc.conf\fR(4),
376 \fBkrb5.conf\fR(4), \fBattributes\fR(5), \fBkerberos\fR(5),
377 \fBkrb5envvar\fR(5), \fBpam_krb5_migrate\fR(5), \fBsmf\fR(5)
378 .SH NOTES
379 .sp
380 .LP
381 The Kerberos administration daemon (\fBkadmind\fR) is now compliant with the
382 change-password standard mentioned in RFC 3244, which means it can now handle
383 change-password requests from non-Solaris Kerberos clients.
384 .sp
385 .LP
386 The \fBkadmind\fR service is managed by the service management facility,
387 \fBsmf\fR(5), under the service identifier:
388 .sp
389 .in +2
390 .nf
391 svc:/network/security/kadmin
392 .fi
393 .in -2
394 .sp
396 .sp
397 .LP
398 Administrative actions on this service, such as enabling, disabling, or
399 requesting restart, can be performed using \fBsvcadm\fR(8). The service's
400 status can be queried using the \fBsvcs\fR(1) command.