1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010
1011
1012
1013
1014
1015
1016
1017
1018
1019
1020
1021
1022
1023
1024
1025
1026
1027
1028
1029
1030
1031
1032
1033
1034
1035
1036
1037
1038
1039
1040
1041
1042
1043
1044
1045
1046
1047
1048
1049
1050
1051
1052
1053
1054
1055
1056
1057
1058
1059
1060
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
1071
1072
1073
1074
1075
1076
1077
1078
1079
1080
1081
1082
1083
1084
1085
1086
1087
1088
1089
1090
1091
1092
1093
1094
1095
1096
1097
1098
1099
|
.\" Man page generated from reStructuredText.
.
.TH "KADMIN" "1" " " "1.21.1" "MIT Kerberos"
.SH NAME
kadmin \- Kerberos V5 database administration program
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.SH SYNOPSIS
.sp
\fBkadmin\fP
[\fB\-O\fP|\fB\-N\fP]
[\fB\-r\fP \fIrealm\fP]
[\fB\-p\fP \fIprincipal\fP]
[\fB\-q\fP \fIquery\fP]
[[\fB\-c\fP \fIcache_name\fP]|[\fB\-k\fP [\fB\-t\fP \fIkeytab\fP]]|\fB\-n\fP]
[\fB\-w\fP \fIpassword\fP]
[\fB\-s\fP \fIadmin_server\fP[:\fIport\fP]]
[command args...]
.sp
\fBkadmin.local\fP
[\fB\-r\fP \fIrealm\fP]
[\fB\-p\fP \fIprincipal\fP]
[\fB\-q\fP \fIquery\fP]
[\fB\-d\fP \fIdbname\fP]
[\fB\-e\fP \fIenc\fP:\fIsalt\fP ...]
[\fB\-m\fP]
[\fB\-x\fP \fIdb_args\fP]
[command args...]
.SH DESCRIPTION
.sp
kadmin and kadmin.local are command\-line interfaces to the Kerberos V5
administration system. They provide nearly identical functionalities;
the difference is that kadmin.local directly accesses the KDC
database, while kadmin performs operations using kadmind(8)\&.
Except as explicitly noted otherwise, this man page will use "kadmin"
to refer to both versions. kadmin provides for the maintenance of
Kerberos principals, password policies, and service key tables
(keytabs).
.sp
The remote kadmin client uses Kerberos to authenticate to kadmind
using the service principal \fBkadmin/admin\fP or \fBkadmin/ADMINHOST\fP
(where \fIADMINHOST\fP is the fully\-qualified hostname of the admin
server). If the credentials cache contains a ticket for one of these
principals, and the \fB\-c\fP credentials_cache option is specified, that
ticket is used to authenticate to kadmind. Otherwise, the \fB\-p\fP and
\fB\-k\fP options are used to specify the client Kerberos principal name
used to authenticate. Once kadmin has determined the principal name,
it requests a service ticket from the KDC, and uses that service
ticket to authenticate to kadmind.
.sp
Since kadmin.local directly accesses the KDC database, it usually must
be run directly on the primary KDC with sufficient permissions to read
the KDC database. If the KDC database uses the LDAP database module,
kadmin.local can be run on any host which can access the LDAP server.
.SH OPTIONS
.INDENT 0.0
.TP
\fB\-r\fP \fIrealm\fP
Use \fIrealm\fP as the default database realm.
.TP
\fB\-p\fP \fIprincipal\fP
Use \fIprincipal\fP to authenticate. Otherwise, kadmin will append
\fB/admin\fP to the primary principal name of the default ccache,
the value of the \fBUSER\fP environment variable, or the username as
obtained with getpwuid, in order of preference.
.TP
\fB\-k\fP
Use a keytab to decrypt the KDC response instead of prompting for
a password. In this case, the default principal will be
\fBhost/hostname\fP\&. If there is no keytab specified with the
\fB\-t\fP option, then the default keytab will be used.
.TP
\fB\-t\fP \fIkeytab\fP
Use \fIkeytab\fP to decrypt the KDC response. This can only be used
with the \fB\-k\fP option.
.TP
\fB\-n\fP
Requests anonymous processing. Two types of anonymous principals
are supported. For fully anonymous Kerberos, configure PKINIT on
the KDC and configure \fBpkinit_anchors\fP in the client\(aqs
krb5.conf(5)\&. Then use the \fB\-n\fP option with a principal
of the form \fB@REALM\fP (an empty principal name followed by the
at\-sign and a realm name). If permitted by the KDC, an anonymous
ticket will be returned. A second form of anonymous tickets is
supported; these realm\-exposed tickets hide the identity of the
client but not the client\(aqs realm. For this mode, use \fBkinit
\-n\fP with a normal principal name. If supported by the KDC, the
principal (but not realm) will be replaced by the anonymous
principal. As of release 1.8, the MIT Kerberos KDC only supports
fully anonymous operation.
.TP
\fB\-c\fP \fIcredentials_cache\fP
Use \fIcredentials_cache\fP as the credentials cache. The cache
should contain a service ticket for the \fBkadmin/admin\fP or
\fBkadmin/ADMINHOST\fP (where \fIADMINHOST\fP is the fully\-qualified
hostname of the admin server) service; it can be acquired with the
kinit(1) program. If this option is not specified, kadmin
requests a new service ticket from the KDC, and stores it in its
own temporary ccache.
.TP
\fB\-w\fP \fIpassword\fP
Use \fIpassword\fP instead of prompting for one. Use this option with
care, as it may expose the password to other users on the system
via the process list.
.TP
\fB\-q\fP \fIquery\fP
Perform the specified query and then exit.
.TP
\fB\-d\fP \fIdbname\fP
Specifies the name of the KDC database. This option does not
apply to the LDAP database module.
.TP
\fB\-s\fP \fIadmin_server\fP[:\fIport\fP]
Specifies the admin server which kadmin should contact.
.TP
\fB\-m\fP
If using kadmin.local, prompt for the database master password
instead of reading it from a stash file.
.TP
\fB\-e\fP "\fIenc\fP:\fIsalt\fP ..."
Sets the keysalt list to be used for any new keys created. See
Keysalt_lists in kdc.conf(5) for a list of possible
values.
.TP
\fB\-O\fP
Force use of old AUTH_GSSAPI authentication flavor.
.TP
\fB\-N\fP
Prevent fallback to AUTH_GSSAPI authentication flavor.
.TP
\fB\-x\fP \fIdb_args\fP
Specifies the database specific arguments. See the next section
for supported options.
.UNINDENT
.sp
Starting with release 1.14, if any command\-line arguments remain after
the options, they will be treated as a single query to be executed.
This mode of operation is intended for scripts and behaves differently
from the interactive mode in several respects:
.INDENT 0.0
.IP \(bu 2
Query arguments are split by the shell, not by kadmin.
.IP \(bu 2
Informational and warning messages are suppressed. Error messages
and query output (e.g. for \fBget_principal\fP) will still be
displayed.
.IP \(bu 2
Confirmation prompts are disabled (as if \fB\-force\fP was given).
Password prompts will still be issued as required.
.IP \(bu 2
The exit status will be non\-zero if the query fails.
.UNINDENT
.sp
The \fB\-q\fP option does not carry these behavior differences; the query
will be processed as if it was entered interactively. The \fB\-q\fP
option cannot be used in combination with a query in the remaining
arguments.
.SH DATABASE OPTIONS
.sp
Database options can be used to override database\-specific defaults.
Supported options for the DB2 module are:
.INDENT 0.0
.INDENT 3.5
.INDENT 0.0
.TP
\fB\-x dbname=\fP*filename*
Specifies the base filename of the DB2 database.
.TP
\fB\-x lockiter\fP
Make iteration operations hold the lock for the duration of
the entire operation, rather than temporarily releasing the
lock while handling each principal. This is the default
behavior, but this option exists to allow command line
override of a [dbmodules] setting. First introduced in
release 1.13.
.TP
\fB\-x unlockiter\fP
Make iteration operations unlock the database for each
principal, instead of holding the lock for the duration of the
entire operation. First introduced in release 1.13.
.UNINDENT
.UNINDENT
.UNINDENT
.sp
Supported options for the LDAP module are:
.INDENT 0.0
.INDENT 3.5
.INDENT 0.0
.TP
\fB\-x host=\fP\fIldapuri\fP
Specifies the LDAP server to connect to by a LDAP URI.
.TP
\fB\-x binddn=\fP\fIbind_dn\fP
Specifies the DN used to bind to the LDAP server.
.TP
\fB\-x bindpwd=\fP\fIpassword\fP
Specifies the password or SASL secret used to bind to the LDAP
server. Using this option may expose the password to other
users on the system via the process list; to avoid this,
instead stash the password using the \fBstashsrvpw\fP command of
kdb5_ldap_util(8)\&.
.TP
\fB\-x sasl_mech=\fP\fImechanism\fP
Specifies the SASL mechanism used to bind to the LDAP server.
The bind DN is ignored if a SASL mechanism is used. New in
release 1.13.
.TP
\fB\-x sasl_authcid=\fP\fIname\fP
Specifies the authentication name used when binding to the
LDAP server with a SASL mechanism, if the mechanism requires
one. New in release 1.13.
.TP
\fB\-x sasl_authzid=\fP\fIname\fP
Specifies the authorization name used when binding to the LDAP
server with a SASL mechanism. New in release 1.13.
.TP
\fB\-x sasl_realm=\fP\fIrealm\fP
Specifies the realm used when binding to the LDAP server with
a SASL mechanism, if the mechanism uses one. New in release
1.13.
.TP
\fB\-x debug=\fP\fIlevel\fP
sets the OpenLDAP client library debug level. \fIlevel\fP is an
integer to be interpreted by the library. Debugging messages
are printed to standard error. New in release 1.12.
.UNINDENT
.UNINDENT
.UNINDENT
.SH COMMANDS
.sp
When using the remote client, available commands may be restricted
according to the privileges specified in the kadm5.acl(5) file
on the admin server.
.SS add_principal
.INDENT 0.0
.INDENT 3.5
\fBadd_principal\fP [\fIoptions\fP] \fInewprinc\fP
.UNINDENT
.UNINDENT
.sp
Creates the principal \fInewprinc\fP, prompting twice for a password. If
no password policy is specified with the \fB\-policy\fP option, and the
policy named \fBdefault\fP is assigned to the principal if it exists.
However, creating a policy named \fBdefault\fP will not automatically
assign this policy to previously existing principals. This policy
assignment can be suppressed with the \fB\-clearpolicy\fP option.
.sp
This command requires the \fBadd\fP privilege.
.sp
Aliases: \fBaddprinc\fP, \fBank\fP
.sp
Options:
.INDENT 0.0
.TP
\fB\-expire\fP \fIexpdate\fP
(getdate string) The expiration date of the principal.
.TP
\fB\-pwexpire\fP \fIpwexpdate\fP
(getdate string) The password expiration date.
.TP
\fB\-maxlife\fP \fImaxlife\fP
(duration or getdate string) The maximum ticket life
for the principal.
.TP
\fB\-maxrenewlife\fP \fImaxrenewlife\fP
(duration or getdate string) The maximum renewable
life of tickets for the principal.
.TP
\fB\-kvno\fP \fIkvno\fP
The initial key version number.
.TP
\fB\-policy\fP \fIpolicy\fP
The password policy used by this principal. If not specified, the
policy \fBdefault\fP is used if it exists (unless \fB\-clearpolicy\fP
is specified).
.TP
\fB\-clearpolicy\fP
Prevents any policy from being assigned when \fB\-policy\fP is not
specified.
.TP
{\-|+}\fBallow_postdated\fP
\fB\-allow_postdated\fP prohibits this principal from obtaining
postdated tickets. \fB+allow_postdated\fP clears this flag.
.TP
{\-|+}\fBallow_forwardable\fP
\fB\-allow_forwardable\fP prohibits this principal from obtaining
forwardable tickets. \fB+allow_forwardable\fP clears this flag.
.TP
{\-|+}\fBallow_renewable\fP
\fB\-allow_renewable\fP prohibits this principal from obtaining
renewable tickets. \fB+allow_renewable\fP clears this flag.
.TP
{\-|+}\fBallow_proxiable\fP
\fB\-allow_proxiable\fP prohibits this principal from obtaining
proxiable tickets. \fB+allow_proxiable\fP clears this flag.
.TP
{\-|+}\fBallow_dup_skey\fP
\fB\-allow_dup_skey\fP disables user\-to\-user authentication for this
principal by prohibiting others from obtaining a service ticket
encrypted in this principal\(aqs TGT session key.
\fB+allow_dup_skey\fP clears this flag.
.TP
{\-|+}\fBrequires_preauth\fP
\fB+requires_preauth\fP requires this principal to preauthenticate
before being allowed to kinit. \fB\-requires_preauth\fP clears this
flag. When \fB+requires_preauth\fP is set on a service principal,
the KDC will only issue service tickets for that service principal
if the client\(aqs initial authentication was performed using
preauthentication.
.TP
{\-|+}\fBrequires_hwauth\fP
\fB+requires_hwauth\fP requires this principal to preauthenticate
using a hardware device before being allowed to kinit.
\fB\-requires_hwauth\fP clears this flag. When \fB+requires_hwauth\fP is
set on a service principal, the KDC will only issue service tickets
for that service principal if the client\(aqs initial authentication was
performed using a hardware device to preauthenticate.
.TP
{\-|+}\fBok_as_delegate\fP
\fB+ok_as_delegate\fP sets the \fBokay as delegate\fP flag on tickets
issued with this principal as the service. Clients may use this
flag as a hint that credentials should be delegated when
authenticating to the service. \fB\-ok_as_delegate\fP clears this
flag.
.TP
{\-|+}\fBallow_svr\fP
\fB\-allow_svr\fP prohibits the issuance of service tickets for this
principal. In release 1.17 and later, user\-to\-user service
tickets are still allowed unless the \fB\-allow_dup_skey\fP flag is
also set. \fB+allow_svr\fP clears this flag.
.TP
{\-|+}\fBallow_tgs_req\fP
\fB\-allow_tgs_req\fP specifies that a Ticket\-Granting Service (TGS)
request for a service ticket for this principal is not permitted.
\fB+allow_tgs_req\fP clears this flag.
.TP
{\-|+}\fBallow_tix\fP
\fB\-allow_tix\fP forbids the issuance of any tickets for this
principal. \fB+allow_tix\fP clears this flag.
.TP
{\-|+}\fBneedchange\fP
\fB+needchange\fP forces a password change on the next initial
authentication to this principal. \fB\-needchange\fP clears this
flag.
.TP
{\-|+}\fBpassword_changing_service\fP
\fB+password_changing_service\fP marks this principal as a password
change service principal.
.TP
{\-|+}\fBok_to_auth_as_delegate\fP
\fB+ok_to_auth_as_delegate\fP allows this principal to acquire
forwardable tickets to itself from arbitrary users, for use with
constrained delegation.
.TP
{\-|+}\fBno_auth_data_required\fP
\fB+no_auth_data_required\fP prevents PAC or AD\-SIGNEDPATH data from
being added to service tickets for the principal.
.TP
{\-|+}\fBlockdown_keys\fP
\fB+lockdown_keys\fP prevents keys for this principal from leaving
the KDC via kadmind. The chpass and extract operations are denied
for a principal with this attribute. The chrand operation is
allowed, but will not return the new keys. The delete and rename
operations are also denied if this attribute is set, in order to
prevent a malicious administrator from replacing principals like
krbtgt/* or kadmin/* with new principals without the attribute.
This attribute can be set via the network protocol, but can only
be removed using kadmin.local.
.TP
\fB\-randkey\fP
Sets the key of the principal to a random value.
.TP
\fB\-nokey\fP
Causes the principal to be created with no key. New in release
1.12.
.TP
\fB\-pw\fP \fIpassword\fP
Sets the password of the principal to the specified string and
does not prompt for a password. Note: using this option in a
shell script may expose the password to other users on the system
via the process list.
.TP
\fB\-e\fP \fIenc\fP:\fIsalt\fP,...
Uses the specified keysalt list for setting the keys of the
principal. See Keysalt_lists in kdc.conf(5) for a
list of possible values.
.TP
\fB\-x\fP \fIdb_princ_args\fP
Indicates database\-specific options. The options for the LDAP
database module are:
.INDENT 7.0
.TP
\fB\-x dn=\fP\fIdn\fP
Specifies the LDAP object that will contain the Kerberos
principal being created.
.TP
\fB\-x linkdn=\fP\fIdn\fP
Specifies the LDAP object to which the newly created Kerberos
principal object will point.
.TP
\fB\-x containerdn=\fP\fIcontainer_dn\fP
Specifies the container object under which the Kerberos
principal is to be created.
.TP
\fB\-x tktpolicy=\fP\fIpolicy\fP
Associates a ticket policy to the Kerberos principal.
.UNINDENT
.sp
\fBNOTE:\fP
.INDENT 7.0
.INDENT 3.5
.INDENT 0.0
.IP \(bu 2
The \fBcontainerdn\fP and \fBlinkdn\fP options cannot be
specified with the \fBdn\fP option.
.IP \(bu 2
If the \fIdn\fP or \fIcontainerdn\fP options are not specified while
adding the principal, the principals are created under the
principal container configured in the realm or the realm
container.
.IP \(bu 2
\fIdn\fP and \fIcontainerdn\fP should be within the subtrees or
principal container configured in the realm.
.UNINDENT
.UNINDENT
.UNINDENT
.UNINDENT
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: addprinc jennifer
No policy specified for "jennifer@ATHENA.MIT.EDU";
defaulting to no policy.
Enter password for principal jennifer@ATHENA.MIT.EDU:
Re\-enter password for principal jennifer@ATHENA.MIT.EDU:
Principal "jennifer@ATHENA.MIT.EDU" created.
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS modify_principal
.INDENT 0.0
.INDENT 3.5
\fBmodify_principal\fP [\fIoptions\fP] \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Modifies the specified principal, changing the fields as specified.
The options to \fBadd_principal\fP also apply to this command, except
for the \fB\-randkey\fP, \fB\-pw\fP, and \fB\-e\fP options. In addition, the
option \fB\-clearpolicy\fP will clear the current policy of a principal.
.sp
This command requires the \fImodify\fP privilege.
.sp
Alias: \fBmodprinc\fP
.sp
Options (in addition to the \fBaddprinc\fP options):
.INDENT 0.0
.TP
\fB\-unlock\fP
Unlocks a locked principal (one which has received too many failed
authentication attempts without enough time between them according
to its password policy) so that it can successfully authenticate.
.UNINDENT
.SS rename_principal
.INDENT 0.0
.INDENT 3.5
\fBrename_principal\fP [\fB\-force\fP] \fIold_principal\fP \fInew_principal\fP
.UNINDENT
.UNINDENT
.sp
Renames the specified \fIold_principal\fP to \fInew_principal\fP\&. This
command prompts for confirmation, unless the \fB\-force\fP option is
given.
.sp
This command requires the \fBadd\fP and \fBdelete\fP privileges.
.sp
Alias: \fBrenprinc\fP
.SS delete_principal
.INDENT 0.0
.INDENT 3.5
\fBdelete_principal\fP [\fB\-force\fP] \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Deletes the specified \fIprincipal\fP from the database. This command
prompts for deletion, unless the \fB\-force\fP option is given.
.sp
This command requires the \fBdelete\fP privilege.
.sp
Alias: \fBdelprinc\fP
.SS change_password
.INDENT 0.0
.INDENT 3.5
\fBchange_password\fP [\fIoptions\fP] \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Changes the password of \fIprincipal\fP\&. Prompts for a new password if
neither \fB\-randkey\fP or \fB\-pw\fP is specified.
.sp
This command requires the \fBchangepw\fP privilege, or that the
principal running the program is the same as the principal being
changed.
.sp
Alias: \fBcpw\fP
.sp
The following options are available:
.INDENT 0.0
.TP
\fB\-randkey\fP
Sets the key of the principal to a random value.
.TP
\fB\-pw\fP \fIpassword\fP
Set the password to the specified string. Using this option in a
script may expose the password to other users on the system via
the process list.
.TP
\fB\-e\fP \fIenc\fP:\fIsalt\fP,...
Uses the specified keysalt list for setting the keys of the
principal. See Keysalt_lists in kdc.conf(5) for a
list of possible values.
.TP
\fB\-keepold\fP
Keeps the existing keys in the database. This flag is usually not
necessary except perhaps for \fBkrbtgt\fP principals.
.UNINDENT
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: cpw systest
Enter password for principal systest@BLEEP.COM:
Re\-enter password for principal systest@BLEEP.COM:
Password for systest@BLEEP.COM changed.
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS purgekeys
.INDENT 0.0
.INDENT 3.5
\fBpurgekeys\fP [\fB\-all\fP|\fB\-keepkvno\fP \fIoldest_kvno_to_keep\fP] \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Purges previously retained old keys (e.g., from \fBchange_password
\-keepold\fP) from \fIprincipal\fP\&. If \fB\-keepkvno\fP is specified, then
only purges keys with kvnos lower than \fIoldest_kvno_to_keep\fP\&. If
\fB\-all\fP is specified, then all keys are purged. The \fB\-all\fP option
is new in release 1.12.
.sp
This command requires the \fBmodify\fP privilege.
.SS get_principal
.INDENT 0.0
.INDENT 3.5
\fBget_principal\fP [\fB\-terse\fP] \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Gets the attributes of principal. With the \fB\-terse\fP option, outputs
fields as quoted tab\-separated strings.
.sp
This command requires the \fBinquire\fP privilege, or that the principal
running the the program to be the same as the one being listed.
.sp
Alias: \fBgetprinc\fP
.sp
Examples:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: getprinc tlyu/admin
Principal: tlyu/admin@BLEEP.COM
Expiration date: [never]
Last password change: Mon Aug 12 14:16:47 EDT 1996
Password expiration date: [never]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 1, aes256\-cts\-hmac\-sha384\-192
MKey: vno 1
Attributes:
Policy: [none]
kadmin: getprinc \-terse systest
systest@BLEEP.COM 3 86400 604800 1
785926535 753241234 785900000
tlyu/admin@BLEEP.COM 786100034 0 0
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS list_principals
.INDENT 0.0
.INDENT 3.5
\fBlist_principals\fP [\fIexpression\fP]
.UNINDENT
.UNINDENT
.sp
Retrieves all or some principal names. \fIexpression\fP is a shell\-style
glob expression that can contain the wild\-card characters \fB?\fP,
\fB*\fP, and \fB[]\fP\&. All principal names matching the expression are
printed. If no expression is provided, all principal names are
printed. If the expression does not contain an \fB@\fP character, an
\fB@\fP character followed by the local realm is appended to the
expression.
.sp
This command requires the \fBlist\fP privilege.
.sp
Alias: \fBlistprincs\fP, \fBget_principals\fP, \fBgetprincs\fP
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: listprincs test*
test3@SECURE\-TEST.OV.COM
test2@SECURE\-TEST.OV.COM
test1@SECURE\-TEST.OV.COM
testuser@SECURE\-TEST.OV.COM
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS get_strings
.INDENT 0.0
.INDENT 3.5
\fBget_strings\fP \fIprincipal\fP
.UNINDENT
.UNINDENT
.sp
Displays string attributes on \fIprincipal\fP\&.
.sp
This command requires the \fBinquire\fP privilege.
.sp
Alias: \fBgetstrs\fP
.SS set_string
.INDENT 0.0
.INDENT 3.5
\fBset_string\fP \fIprincipal\fP \fIname\fP \fIvalue\fP
.UNINDENT
.UNINDENT
.sp
Sets a string attribute on \fIprincipal\fP\&. String attributes are used to
supply per\-principal configuration to the KDC and some KDC plugin
modules. The following string attribute names are recognized by the
KDC:
.INDENT 0.0
.TP
\fBrequire_auth\fP
Specifies an authentication indicator which is required to
authenticate to the principal as a service. Multiple indicators
can be specified, separated by spaces; in this case any of the
specified indicators will be accepted. (New in release 1.14.)
.TP
\fBsession_enctypes\fP
Specifies the encryption types supported for session keys when the
principal is authenticated to as a server. See
Encryption_types in kdc.conf(5) for a list of the
accepted values.
.TP
\fBotp\fP
Enables One Time Passwords (OTP) preauthentication for a client
\fIprincipal\fP\&. The \fIvalue\fP is a JSON string representing an array
of objects, each having optional \fBtype\fP and \fBusername\fP fields.
.TP
\fBpkinit_cert_match\fP
Specifies a matching expression that defines the certificate
attributes required for the client certificate used by the
principal during PKINIT authentication. The matching expression
is in the same format as those used by the \fBpkinit_cert_match\fP
option in krb5.conf(5)\&. (New in release 1.16.)
.TP
\fBpac_privsvr_enctype\fP
Forces the encryption type of the PAC KDC checksum buffers to the
specified encryption type for tickets issued to this server, by
deriving a key from the local krbtgt key if it is of a different
encryption type. It may be necessary to set this value to
"aes256\-sha1" on the cross\-realm krbtgt entry for an Active
Directory realm when using aes\-sha2 keys on the local krbtgt
entry.
.UNINDENT
.sp
This command requires the \fBmodify\fP privilege.
.sp
Alias: \fBsetstr\fP
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
set_string host/foo.mit.edu session_enctypes aes128\-cts
set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"
.ft P
.fi
.UNINDENT
.UNINDENT
.SS del_string
.INDENT 0.0
.INDENT 3.5
\fBdel_string\fP \fIprincipal\fP \fIkey\fP
.UNINDENT
.UNINDENT
.sp
Deletes a string attribute from \fIprincipal\fP\&.
.sp
This command requires the \fBdelete\fP privilege.
.sp
Alias: \fBdelstr\fP
.SS add_policy
.INDENT 0.0
.INDENT 3.5
\fBadd_policy\fP [\fIoptions\fP] \fIpolicy\fP
.UNINDENT
.UNINDENT
.sp
Adds a password policy named \fIpolicy\fP to the database.
.sp
This command requires the \fBadd\fP privilege.
.sp
Alias: \fBaddpol\fP
.sp
The following options are available:
.INDENT 0.0
.TP
\fB\-maxlife\fP \fItime\fP
(duration or getdate string) Sets the maximum
lifetime of a password.
.TP
\fB\-minlife\fP \fItime\fP
(duration or getdate string) Sets the minimum
lifetime of a password.
.TP
\fB\-minlength\fP \fIlength\fP
Sets the minimum length of a password.
.TP
\fB\-minclasses\fP \fInumber\fP
Sets the minimum number of character classes required in a
password. The five character classes are lower case, upper case,
numbers, punctuation, and whitespace/unprintable characters.
.TP
\fB\-history\fP \fInumber\fP
Sets the number of past keys kept for a principal. This option is
not supported with the LDAP KDC database module.
.UNINDENT
.INDENT 0.0
.TP
\fB\-maxfailure\fP \fImaxnumber\fP
Sets the number of authentication failures before the principal is
locked. Authentication failures are only tracked for principals
which require preauthentication. The counter of failed attempts
resets to 0 after a successful attempt to authenticate. A
\fImaxnumber\fP value of 0 (the default) disables lockout.
.UNINDENT
.INDENT 0.0
.TP
\fB\-failurecountinterval\fP \fIfailuretime\fP
(duration or getdate string) Sets the allowable time
between authentication failures. If an authentication failure
happens after \fIfailuretime\fP has elapsed since the previous
failure, the number of authentication failures is reset to 1. A
\fIfailuretime\fP value of 0 (the default) means forever.
.UNINDENT
.INDENT 0.0
.TP
\fB\-lockoutduration\fP \fIlockouttime\fP
(duration or getdate string) Sets the duration for
which the principal is locked from authenticating if too many
authentication failures occur without the specified failure count
interval elapsing. A duration of 0 (the default) means the
principal remains locked out until it is administratively unlocked
with \fBmodprinc \-unlock\fP\&.
.TP
\fB\-allowedkeysalts\fP
Specifies the key/salt tuples supported for long\-term keys when
setting or changing a principal\(aqs password/keys. See
Keysalt_lists in kdc.conf(5) for a list of the
accepted values, but note that key/salt tuples must be separated
with commas (\(aq,\(aq) only. To clear the allowed key/salt policy use
a value of \(aq\-\(aq.
.UNINDENT
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: add_policy \-maxlife "2 days" \-minlength 5 guests
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS modify_policy
.INDENT 0.0
.INDENT 3.5
\fBmodify_policy\fP [\fIoptions\fP] \fIpolicy\fP
.UNINDENT
.UNINDENT
.sp
Modifies the password policy named \fIpolicy\fP\&. Options are as described
for \fBadd_policy\fP\&.
.sp
This command requires the \fBmodify\fP privilege.
.sp
Alias: \fBmodpol\fP
.SS delete_policy
.INDENT 0.0
.INDENT 3.5
\fBdelete_policy\fP [\fB\-force\fP] \fIpolicy\fP
.UNINDENT
.UNINDENT
.sp
Deletes the password policy named \fIpolicy\fP\&. Prompts for confirmation
before deletion. The command will fail if the policy is in use by any
principals.
.sp
This command requires the \fBdelete\fP privilege.
.sp
Alias: \fBdelpol\fP
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: del_policy guests
Are you sure you want to delete the policy "guests"?
(yes/no): yes
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS get_policy
.INDENT 0.0
.INDENT 3.5
\fBget_policy\fP [ \fB\-terse\fP ] \fIpolicy\fP
.UNINDENT
.UNINDENT
.sp
Displays the values of the password policy named \fIpolicy\fP\&. With the
\fB\-terse\fP flag, outputs the fields as quoted strings separated by
tabs.
.sp
This command requires the \fBinquire\fP privilege.
.sp
Alias: \fBgetpol\fP
.sp
Examples:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: get_policy admin
Policy: admin
Maximum password life: 180 days 00:00:00
Minimum password life: 00:00:00
Minimum password length: 6
Minimum number of password character classes: 2
Number of old keys kept: 5
Reference count: 17
kadmin: get_policy \-terse admin
admin 15552000 0 6 2 5 17
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.sp
The "Reference count" is the number of principals using that policy.
With the LDAP KDC database module, the reference count field is not
meaningful.
.SS list_policies
.INDENT 0.0
.INDENT 3.5
\fBlist_policies\fP [\fIexpression\fP]
.UNINDENT
.UNINDENT
.sp
Retrieves all or some policy names. \fIexpression\fP is a shell\-style
glob expression that can contain the wild\-card characters \fB?\fP,
\fB*\fP, and \fB[]\fP\&. All policy names matching the expression are
printed. If no expression is provided, all existing policy names are
printed.
.sp
This command requires the \fBlist\fP privilege.
.sp
Aliases: \fBlistpols\fP, \fBget_policies\fP, \fBgetpols\fP\&.
.sp
Examples:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: listpols
test\-pol
dict\-only
once\-a\-min
test\-pol\-nopw
kadmin: listpols t*
test\-pol
test\-pol\-nopw
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS ktadd
.INDENT 0.0
.INDENT 3.5
.nf
\fBktadd\fP [options] \fIprincipal\fP
\fBktadd\fP [options] \fB\-glob\fP \fIprinc\-exp\fP
.fi
.sp
.UNINDENT
.UNINDENT
.sp
Adds a \fIprincipal\fP, or all principals matching \fIprinc\-exp\fP, to a
keytab file. Each principal\(aqs keys are randomized in the process.
The rules for \fIprinc\-exp\fP are described in the \fBlist_principals\fP
command.
.sp
This command requires the \fBinquire\fP and \fBchangepw\fP privileges.
With the \fB\-glob\fP form, it also requires the \fBlist\fP privilege.
.sp
The options are:
.INDENT 0.0
.TP
\fB\-k[eytab]\fP \fIkeytab\fP
Use \fIkeytab\fP as the keytab file. Otherwise, the default keytab is
used.
.TP
\fB\-e\fP \fIenc\fP:\fIsalt\fP,...
Uses the specified keysalt list for setting the new keys of the
principal. See Keysalt_lists in kdc.conf(5) for a
list of possible values.
.TP
\fB\-q\fP
Display less verbose information.
.TP
\fB\-norandkey\fP
Do not randomize the keys. The keys and their version numbers stay
unchanged. This option cannot be specified in combination with the
\fB\-e\fP option.
.UNINDENT
.sp
An entry for each of the principal\(aqs unique encryption types is added,
ignoring multiple keys with the same encryption type but different
salt types.
.sp
Alias: \fBxst\fP
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: ktadd \-k /tmp/foo\-new\-keytab host/foo.mit.edu
Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
encryption type aes256\-cts\-hmac\-sha1\-96 added to keytab
FILE:/tmp/foo\-new\-keytab
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS ktremove
.INDENT 0.0
.INDENT 3.5
\fBktremove\fP [options] \fIprincipal\fP [\fIkvno\fP | \fIall\fP | \fIold\fP]
.UNINDENT
.UNINDENT
.sp
Removes entries for the specified \fIprincipal\fP from a keytab. Requires
no permissions, since this does not require database access.
.sp
If the string "all" is specified, all entries for that principal are
removed; if the string "old" is specified, all entries for that
principal except those with the highest kvno are removed. Otherwise,
the value specified is parsed as an integer, and all entries whose
kvno match that integer are removed.
.sp
The options are:
.INDENT 0.0
.TP
\fB\-k[eytab]\fP \fIkeytab\fP
Use \fIkeytab\fP as the keytab file. Otherwise, the default keytab is
used.
.TP
\fB\-q\fP
Display less verbose information.
.UNINDENT
.sp
Alias: \fBktrem\fP
.sp
Example:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
kadmin: ktremove kadmin/admin all
Entry for principal kadmin/admin with kvno 3 removed from keytab
FILE:/etc/krb5.keytab
kadmin:
.ft P
.fi
.UNINDENT
.UNINDENT
.SS lock
.sp
Lock database exclusively. Use with extreme caution! This command
only works with the DB2 KDC database module.
.SS unlock
.sp
Release the exclusive database lock.
.SS list_requests
.sp
Lists available for kadmin requests.
.sp
Aliases: \fBlr\fP, \fB?\fP
.SS quit
.sp
Exit program. If the database was locked, the lock is released.
.sp
Aliases: \fBexit\fP, \fBq\fP
.SH HISTORY
.sp
The kadmin program was originally written by Tom Yu at MIT, as an
interface to the OpenVision Kerberos administration program.
.SH ENVIRONMENT
.sp
See kerberos(7) for a description of Kerberos environment
variables.
.SH SEE ALSO
.sp
kpasswd(1), kadmind(8), kerberos(7)
.SH AUTHOR
MIT
.SH COPYRIGHT
1985-2023, MIT
.\" Generated by docutils manpage writer.
.
|