krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/admin/admin_commands/kadmin_local.html
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/admin/admin_commands/kadmin_local.html')

-rw-r--r--

doc/html/admin/admin_commands/kadmin_local.html

790

1 files changed, 400 insertions, 390 deletions

diff --git a/doc/html/admin/admin_commands/kadmin_local.html b/doc/html/admin/admin_commands/kadmin_local.html
index 6c8e131ac9ca..1b6e42b31ac4 100644
--- a/doc/html/admin/admin_commands/kadmin_local.html
+++ b/doc/html/admin/admin_commands/kadmin_local.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>kadmin — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,9 +52,9 @@

- <div class="section" id="kadmin">

+ <section id="kadmin">

<h1>kadmin<a class="headerlink" href="#kadmin" title="Permalink to this headline">¶</a></h1>

-<div class="section" id="synopsis">

+<section id="synopsis">

<h2>SYNOPSIS<a class="headerlink" href="#synopsis" title="Permalink to this headline">¶</a></h2>

kadmin

[-O|-N]

@@ -83,8 +74,8 @@

[-m]

[-x db_args]

[command args…]

-</div>

-<div class="section" id="description">

+</section>

+<section id="description">

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

kadmin and kadmin.local are command-line interfaces to the Kerberos V5

administration system. They provide nearly identical functionalities;

@@ -95,7 +86,7 @@ to refer to both versions. kadmin provides for the maintenance of

Kerberos principals, password policies, and service key tables

(keytabs).

The remote kadmin client uses Kerberos to authenticate to kadmind

-using the service principal <code class="docutils literal">kadmin/admin</code> or <code class="docutils literal">kadmin/ADMINHOST</code>

+using the service principal <code class="docutils literal notranslate">kadmin/admin</code> or <code class="docutils literal notranslate">kadmin/ADMINHOST</code>

(where ADMINHOST is the fully-qualified hostname of the admin

server). If the credentials cache contains a ticket for one of these

principals, and the -c credentials_cache option is specified, that

@@ -108,250 +99,250 @@ ticket to authenticate to kadmind.

be run directly on the primary KDC with sufficient permissions to read

the KDC database. If the KDC database uses the LDAP database module,

kadmin.local can be run on any host which can access the LDAP server.

-</div>

-<div class="section" id="options">

+</section>

+<section id="options">

<h2>OPTIONS<a class="headerlink" href="#options" title="Permalink to this headline">¶</a></h2>

-<dl class="docutils" id="kadmin-options">

-<dt>-r realm</dt>

-<dd>Use realm as the default database realm.</dd>

-<dt>-p principal</dt>

-<dd>Use principal to authenticate. Otherwise, kadmin will append

-<code class="docutils literal">/admin</code> to the primary principal name of the default ccache,

+<dl class="simple" id="kadmin-options">

+<dt>-r realm</dt><dd>Use realm as the default database realm.

+</dd>

+<dt>-p principal</dt><dd>Use principal to authenticate. Otherwise, kadmin will append

+<code class="docutils literal notranslate">/admin</code> to the primary principal name of the default ccache,

the value of the USER environment variable, or the username as

-obtained with getpwuid, in order of preference.</dd>

-<dt>-k</dt>

-<dd>Use a keytab to decrypt the KDC response instead of prompting for

+obtained with getpwuid, in order of preference.

+</dd>

+<dt>-k</dt><dd>Use a keytab to decrypt the KDC response instead of prompting for

a password. In this case, the default principal will be

-<code class="docutils literal">host/hostname</code>. If there is no keytab specified with the

--t option, then the default keytab will be used.</dd>

-<dt>-t keytab</dt>

-<dd>Use keytab to decrypt the KDC response. This can only be used

-with the -k option.</dd>

-<dt>-n</dt>

-<dd>Requests anonymous processing. Two types of anonymous principals

+<code class="docutils literal notranslate">host/hostname</code>. If there is no keytab specified with the

+-t option, then the default keytab will be used.

+</dd>

+<dt>-t keytab</dt><dd>Use keytab to decrypt the KDC response. This can only be used

+with the -k option.

+</dd>

+<dt>-n</dt><dd>Requests anonymous processing. Two types of anonymous principals

are supported. For fully anonymous Kerberos, configure PKINIT on

the KDC and configure pkinit_anchors in the client’s

<a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5">krb5.conf</a>. Then use the -n option with a principal

-of the form <code class="docutils literal">@REALM</code> (an empty principal name followed by the

+of the form <code class="docutils literal notranslate">@REALM</code> (an empty principal name followed by the

at-sign and a realm name). If permitted by the KDC, an anonymous

ticket will be returned. A second form of anonymous tickets is

supported; these realm-exposed tickets hide the identity of the

-client but not the client’s realm. For this mode, use <code class="docutils literal">kinit

+client but not the client’s realm. For this mode, use <code class="docutils literal notranslate">kinit

-n</code> with a normal principal name. If supported by the KDC, the

principal (but not realm) will be replaced by the anonymous

principal. As of release 1.8, the MIT Kerberos KDC only supports

-fully anonymous operation.</dd>

-<dt>-c credentials_cache</dt>

-<dd>Use credentials_cache as the credentials cache. The cache

-should contain a service ticket for the <code class="docutils literal">kadmin/admin</code> or

-<code class="docutils literal">kadmin/ADMINHOST</code> (where ADMINHOST is the fully-qualified

+fully anonymous operation.

+</dd>

+<dt>-c credentials_cache</dt><dd>Use credentials_cache as the credentials cache. The cache

+should contain a service ticket for the <code class="docutils literal notranslate">kadmin/admin</code> or

+<code class="docutils literal notranslate">kadmin/ADMINHOST</code> (where ADMINHOST is the fully-qualified

hostname of the admin server) service; it can be acquired with the

<a class="reference internal" href="../../user/user_commands/kinit.html#kinit-1">kinit</a> program. If this option is not specified, kadmin

requests a new service ticket from the KDC, and stores it in its

-own temporary ccache.</dd>

-<dt>-w password</dt>

-<dd>Use password instead of prompting for one. Use this option with

+own temporary ccache.

+</dd>

+<dt>-w password</dt><dd>Use password instead of prompting for one. Use this option with

care, as it may expose the password to other users on the system

-via the process list.</dd>

-<dt>-q query</dt>

-<dd>Perform the specified query and then exit.</dd>

-<dt>-d dbname</dt>

-<dd>Specifies the name of the KDC database. This option does not

-apply to the LDAP database module.</dd>

-<dt>-s admin_server[:port]</dt>

-<dd>Specifies the admin server which kadmin should contact.</dd>

-<dt>-m</dt>

-<dd>If using kadmin.local, prompt for the database master password

-instead of reading it from a stash file.</dd>

-<dt>-e “enc:salt …”</dt>

-<dd>Sets the keysalt list to be used for any new keys created. See

+via the process list.

+</dd>

+<dt>-q query</dt><dd>Perform the specified query and then exit.

+</dd>

+<dt>-d dbname</dt><dd>Specifies the name of the KDC database. This option does not

+apply to the LDAP database module.

+</dd>

+<dt>-s admin_server[:port]</dt><dd>Specifies the admin server which kadmin should contact.

+</dd>

+<dt>-m</dt><dd>If using kadmin.local, prompt for the database master password

+instead of reading it from a stash file.

+</dd>

+<dt>-e “enc:salt …”</dt><dd>Sets the keysalt list to be used for any new keys created. See

<a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists">Keysalt lists</a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a> for a list of possible

-values.</dd>

-<dt>-O</dt>

-<dd>Force use of old AUTH_GSSAPI authentication flavor.</dd>

-<dt>-N</dt>

-<dd>Prevent fallback to AUTH_GSSAPI authentication flavor.</dd>

-<dt>-x db_args</dt>

-<dd>Specifies the database specific arguments. See the next section

-for supported options.</dd>

+values.

+</dd>

+<dt>-O</dt><dd>Force use of old AUTH_GSSAPI authentication flavor.

+</dd>

+<dt>-N</dt><dd>Prevent fallback to AUTH_GSSAPI authentication flavor.

+</dd>

+<dt>-x db_args</dt><dd>Specifies the database specific arguments. See the next section

+for supported options.

+</dd>

</dl>

Starting with release 1.14, if any command-line arguments remain after

the options, they will be treated as a single query to be executed.

This mode of operation is intended for scripts and behaves differently

from the interactive mode in several respects:

-<li>Query arguments are split by the shell, not by kadmin.</li>

-<li>Informational and warning messages are suppressed. Error messages

+<li>Query arguments are split by the shell, not by kadmin.</li>

+<li>Informational and warning messages are suppressed. Error messages

and query output (e.g. for get_principal) will still be

-displayed.</li>

-<li>Confirmation prompts are disabled (as if -force was given).

-Password prompts will still be issued as required.</li>

-<li>The exit status will be non-zero if the query fails.</li>

+displayed.</li>

+<li>Confirmation prompts are disabled (as if -force was given).

+Password prompts will still be issued as required.</li>

+<li>The exit status will be non-zero if the query fails.</li>

</ul>

The -q option does not carry these behavior differences; the query

will be processed as if it was entered interactively. The -q

option cannot be used in combination with a query in the remaining

arguments.

-</div>

-<div class="section" id="database-options">

+</section>

+<section id="database-options">

<h2>DATABASE OPTIONS<a class="headerlink" href="#database-options" title="Permalink to this headline">¶</a></h2>

Database options can be used to override database-specific defaults.

Supported options for the DB2 module are:

-<div><dl class="docutils">

-<dt>-x dbname=*filename*</dt>

-<dd>Specifies the base filename of the DB2 database.</dd>

-<dt>-x lockiter</dt>

-<dd>Make iteration operations hold the lock for the duration of

+<div><dl class="simple">

+<dt>-x dbname=*filename*</dt><dd>Specifies the base filename of the DB2 database.

+</dd>

+<dt>-x lockiter</dt><dd>Make iteration operations hold the lock for the duration of

the entire operation, rather than temporarily releasing the

lock while handling each principal. This is the default

behavior, but this option exists to allow command line

override of a [dbmodules] setting. First introduced in

-release 1.13.</dd>

-<dt>-x unlockiter</dt>

-<dd>Make iteration operations unlock the database for each

+release 1.13.

+</dd>

+<dt>-x unlockiter</dt><dd>Make iteration operations unlock the database for each

principal, instead of holding the lock for the duration of the

-entire operation. First introduced in release 1.13.</dd>

+entire operation. First introduced in release 1.13.

+</dd>

</dl>

</div></blockquote>

Supported options for the LDAP module are:

-<div><dl class="docutils">

-<dt>-x host=ldapuri</dt>

-<dd>Specifies the LDAP server to connect to by a LDAP URI.</dd>

-<dt>-x binddn=bind_dn</dt>

-<dd>Specifies the DN used to bind to the LDAP server.</dd>

-<dt>-x bindpwd=password</dt>

-<dd>Specifies the password or SASL secret used to bind to the LDAP

+<div><dl class="simple">

+<dt>-x host=ldapuri</dt><dd>Specifies the LDAP server to connect to by a LDAP URI.

+</dd>

+<dt>-x binddn=bind_dn</dt><dd>Specifies the DN used to bind to the LDAP server.

+</dd>

+<dt>-x bindpwd=password</dt><dd>Specifies the password or SASL secret used to bind to the LDAP

server. Using this option may expose the password to other

users on the system via the process list; to avoid this,

instead stash the password using the stashsrvpw command of

-<a class="reference internal" href="kdb5_ldap_util.html#kdb5-ldap-util-8">kdb5_ldap_util</a>.</dd>

-<dt>-x sasl_mech=mechanism</dt>

-<dd>Specifies the SASL mechanism used to bind to the LDAP server.

+<a class="reference internal" href="kdb5_ldap_util.html#kdb5-ldap-util-8">kdb5_ldap_util</a>.

+</dd>

+<dt>-x sasl_mech=mechanism</dt><dd>Specifies the SASL mechanism used to bind to the LDAP server.

The bind DN is ignored if a SASL mechanism is used. New in

-release 1.13.</dd>

-<dt>-x sasl_authcid=name</dt>

-<dd>Specifies the authentication name used when binding to the

+release 1.13.

+</dd>

+<dt>-x sasl_authcid=name</dt><dd>Specifies the authentication name used when binding to the

LDAP server with a SASL mechanism, if the mechanism requires

-one. New in release 1.13.</dd>

-<dt>-x sasl_authzid=name</dt>

-<dd>Specifies the authorization name used when binding to the LDAP

-server with a SASL mechanism. New in release 1.13.</dd>

-<dt>-x sasl_realm=realm</dt>

-<dd>Specifies the realm used when binding to the LDAP server with

+one. New in release 1.13.

+</dd>

+<dt>-x sasl_authzid=name</dt><dd>Specifies the authorization name used when binding to the LDAP

+server with a SASL mechanism. New in release 1.13.

+</dd>

+<dt>-x sasl_realm=realm</dt><dd>Specifies the realm used when binding to the LDAP server with

a SASL mechanism, if the mechanism uses one. New in release

-1.13.</dd>

-<dt>-x debug=level</dt>

-<dd>sets the OpenLDAP client library debug level. level is an

+1.13.

+</dd>

+<dt>-x debug=level</dt><dd>sets the OpenLDAP client library debug level. level is an

integer to be interpreted by the library. Debugging messages

-are printed to standard error. New in release 1.12.</dd>

+are printed to standard error. New in release 1.12.

+</dd>

</dl>

</div></blockquote>

-</div>

-<div class="section" id="commands">

+</section>

+<section id="commands">

<h2>COMMANDS<a class="headerlink" href="#commands" title="Permalink to this headline">¶</a></h2>

When using the remote client, available commands may be restricted

according to the privileges specified in the <a class="reference internal" href="../conf_files/kadm5_acl.html#kadm5-acl-5">kadm5.acl</a> file

on the admin server.

-<div class="section" id="add-principal">

+<section id="add-principal">

<h3>add_principal<a class="headerlink" href="#add-principal" title="Permalink to this headline">¶</a></h3>

-<div>add_principal [options] newprinc</div></blockquote>

+<div>add_principal [options] newprinc

+</div></blockquote>

Creates the principal newprinc, prompting twice for a password. If

no password policy is specified with the -policy option, and the

-policy named <code class="docutils literal">default</code> is assigned to the principal if it exists.

-However, creating a policy named <code class="docutils literal">default</code> will not automatically

+policy named <code class="docutils literal notranslate">default</code> is assigned to the principal if it exists.

+However, creating a policy named <code class="docutils literal notranslate">default</code> will not automatically

assign this policy to previously existing principals. This policy

assignment can be suppressed with the -clearpolicy option.

This command requires the add privilege.

Aliases: addprinc, ank

Options:

-<dl class="docutils">

-<dt>-expire expdate</dt>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The expiration date of the principal.</dd>

-<dt>-pwexpire pwexpdate</dt>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The password expiration date.</dd>

-<dt>-maxlife maxlife</dt>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The maximum ticket life

-for the principal.</dd>

-<dt>-maxrenewlife maxrenewlife</dt>

-life of tickets for the principal.</dd>

-<dt>-kvno kvno</dt>

-<dd>The initial key version number.</dd>

-<dt>-policy policy</dt>

-<dd>The password policy used by this principal. If not specified, the

-policy <code class="docutils literal">default</code> is used if it exists (unless -clearpolicy

-is specified).</dd>

-<dt>-clearpolicy</dt>

-<dd>Prevents any policy from being assigned when -policy is not

-specified.</dd>

-<dt>{-|+}allow_postdated</dt>

-<dd>-allow_postdated prohibits this principal from obtaining

-postdated tickets. +allow_postdated clears this flag.</dd>

-<dt>{-|+}allow_forwardable</dt>

-<dd>-allow_forwardable prohibits this principal from obtaining

-forwardable tickets. +allow_forwardable clears this flag.</dd>

-<dt>{-|+}allow_renewable</dt>

-<dd>-allow_renewable prohibits this principal from obtaining

-renewable tickets. +allow_renewable clears this flag.</dd>

-<dt>{-|+}allow_proxiable</dt>

-<dd>-allow_proxiable prohibits this principal from obtaining

-proxiable tickets. +allow_proxiable clears this flag.</dd>

-<dt>{-|+}allow_dup_skey</dt>

-<dd>-allow_dup_skey disables user-to-user authentication for this

+<dl>

+<dt>-expire expdate</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The expiration date of the principal.

+</dd>

+<dt>-pwexpire pwexpdate</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The password expiration date.

+</dd>

+<dt>-maxlife maxlife</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The maximum ticket life

+for the principal.

+</dd>

+<dt>-maxrenewlife maxrenewlife</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) The maximum renewable

+life of tickets for the principal.

+</dd>

+<dt>-kvno kvno</dt><dd>The initial key version number.

+</dd>

+<dt>-policy policy</dt><dd>The password policy used by this principal. If not specified, the

+policy <code class="docutils literal notranslate">default</code> is used if it exists (unless -clearpolicy

+is specified).

+</dd>

+<dt>-clearpolicy</dt><dd>Prevents any policy from being assigned when -policy is not

+specified.

+</dd>

+<dt>{-|+}allow_postdated</dt><dd>-allow_postdated prohibits this principal from obtaining

+postdated tickets. +allow_postdated clears this flag.

+</dd>

+<dt>{-|+}allow_forwardable</dt><dd>-allow_forwardable prohibits this principal from obtaining

+forwardable tickets. +allow_forwardable clears this flag.

+</dd>

+<dt>{-|+}allow_renewable</dt><dd>-allow_renewable prohibits this principal from obtaining

+renewable tickets. +allow_renewable clears this flag.

+</dd>

+<dt>{-|+}allow_proxiable</dt><dd>-allow_proxiable prohibits this principal from obtaining

+proxiable tickets. +allow_proxiable clears this flag.

+</dd>

+<dt>{-|+}allow_dup_skey</dt><dd>-allow_dup_skey disables user-to-user authentication for this

principal by prohibiting others from obtaining a service ticket

encrypted in this principal’s TGT session key.

-+allow_dup_skey clears this flag.</dd>

-<dt>{-|+}requires_preauth</dt>

-<dd>+requires_preauth requires this principal to preauthenticate

++allow_dup_skey clears this flag.

+</dd>

+<dt>{-|+}requires_preauth</dt><dd>+requires_preauth requires this principal to preauthenticate

before being allowed to kinit. -requires_preauth clears this

flag. When +requires_preauth is set on a service principal,

the KDC will only issue service tickets for that service principal

if the client’s initial authentication was performed using

-preauthentication.</dd>

-<dt>{-|+}requires_hwauth</dt>

-<dd>+requires_hwauth requires this principal to preauthenticate

+preauthentication.

+</dd>

+<dt>{-|+}requires_hwauth</dt><dd>+requires_hwauth requires this principal to preauthenticate

using a hardware device before being allowed to kinit.

-requires_hwauth clears this flag. When +requires_hwauth is

set on a service principal, the KDC will only issue service tickets

for that service principal if the client’s initial authentication was

-performed using a hardware device to preauthenticate.</dd>

-<dt>{-|+}ok_as_delegate</dt>

-<dd>+ok_as_delegate sets the okay as delegate flag on tickets

+performed using a hardware device to preauthenticate.

+</dd>

+<dt>{-|+}ok_as_delegate</dt><dd>+ok_as_delegate sets the okay as delegate flag on tickets

issued with this principal as the service. Clients may use this

flag as a hint that credentials should be delegated when

authenticating to the service. -ok_as_delegate clears this

-flag.</dd>

-<dt>{-|+}allow_svr</dt>

-<dd>-allow_svr prohibits the issuance of service tickets for this

+flag.

+</dd>

+<dt>{-|+}allow_svr</dt><dd>-allow_svr prohibits the issuance of service tickets for this

principal. In release 1.17 and later, user-to-user service

tickets are still allowed unless the -allow_dup_skey flag is

-also set. +allow_svr clears this flag.</dd>

-<dt>{-|+}allow_tgs_req</dt>

-<dd>-allow_tgs_req specifies that a Ticket-Granting Service (TGS)

+also set. +allow_svr clears this flag.

+</dd>

+<dt>{-|+}allow_tgs_req</dt><dd>-allow_tgs_req specifies that a Ticket-Granting Service (TGS)

request for a service ticket for this principal is not permitted.

-+allow_tgs_req clears this flag.</dd>

-<dt>{-|+}allow_tix</dt>

-<dd>-allow_tix forbids the issuance of any tickets for this

-principal. +allow_tix clears this flag.</dd>

-<dt>{-|+}needchange</dt>

-<dd>+needchange forces a password change on the next initial

++allow_tgs_req clears this flag.

+</dd>

+<dt>{-|+}allow_tix</dt><dd>-allow_tix forbids the issuance of any tickets for this

+principal. +allow_tix clears this flag.

+</dd>

+<dt>{-|+}needchange</dt><dd>+needchange forces a password change on the next initial

authentication to this principal. -needchange clears this

-flag.</dd>

-<dt>{-|+}password_changing_service</dt>

-<dd>+password_changing_service marks this principal as a password

-change service principal.</dd>

-<dt>{-|+}ok_to_auth_as_delegate</dt>

-<dd>+ok_to_auth_as_delegate allows this principal to acquire

+flag.

+</dd>

+<dt>{-|+}password_changing_service</dt><dd>+password_changing_service marks this principal as a password

+change service principal.

+</dd>

+<dt>{-|+}ok_to_auth_as_delegate</dt><dd>+ok_to_auth_as_delegate allows this principal to acquire

forwardable tickets to itself from arbitrary users, for use with

-constrained delegation.</dd>

-<dt>{-|+}no_auth_data_required</dt>

-<dd>+no_auth_data_required prevents PAC or AD-SIGNEDPATH data from

-being added to service tickets for the principal.</dd>

-<dt>{-|+}lockdown_keys</dt>

-<dd>+lockdown_keys prevents keys for this principal from leaving

+constrained delegation.

+</dd>

+<dt>{-|+}no_auth_data_required</dt><dd>+no_auth_data_required prevents PAC or AD-SIGNEDPATH data from

+being added to service tickets for the principal.

+</dd>

+<dt>{-|+}lockdown_keys</dt><dd>+lockdown_keys prevents keys for this principal from leaving

the KDC via kadmind. The chpass and extract operations are denied

for a principal with this attribute. The chrand operation is

allowed, but will not return the new keys. The delete and rename

@@ -359,54 +350,54 @@ operations are also denied if this attribute is set, in order to

prevent a malicious administrator from replacing principals like

krbtgt/* or kadmin/* with new principals without the attribute.

This attribute can be set via the network protocol, but can only

-be removed using kadmin.local.</dd>

-<dt>-randkey</dt>

-<dd>Sets the key of the principal to a random value.</dd>

-<dt>-nokey</dt>

-<dd>Causes the principal to be created with no key. New in release

-1.12.</dd>

-<dt>-pw password</dt>

-<dd>Sets the password of the principal to the specified string and

+be removed using kadmin.local.

+</dd>

+<dt>-randkey</dt><dd>Sets the key of the principal to a random value.

+</dd>

+<dt>-nokey</dt><dd>Causes the principal to be created with no key. New in release

+1.12.

+</dd>

+<dt>-pw password</dt><dd>Sets the password of the principal to the specified string and

does not prompt for a password. Note: using this option in a

shell script may expose the password to other users on the system

-via the process list.</dd>

-<dt>-e enc:salt,…</dt>

-<dd>Uses the specified keysalt list for setting the keys of the

+via the process list.

+</dd>

+<dt>-e enc:salt,…</dt><dd>Uses the specified keysalt list for setting the keys of the

principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists">Keysalt lists</a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a> for a

-list of possible values.</dd>

-<dt>-x db_princ_args</dt>

-<dd>Indicates database-specific options. The options for the LDAP

+list of possible values.

+</dd>

+<dt>-x db_princ_args</dt><dd>Indicates database-specific options. The options for the LDAP

database module are:

-<dl class="docutils">

-<dt>-x dn=dn</dt>

-<dd>Specifies the LDAP object that will contain the Kerberos

-principal being created.</dd>

-<dt>-x linkdn=dn</dt>

-<dd>Specifies the LDAP object to which the newly created Kerberos

-principal object will point.</dd>

-<dt>-x containerdn=container_dn</dt>

-<dd>Specifies the container object under which the Kerberos

-principal is to be created.</dd>

-<dt>-x tktpolicy=policy</dt>

-<dd>Associates a ticket policy to the Kerberos principal.</dd>

+<dl class="simple">

+<dt>-x dn=dn</dt><dd>Specifies the LDAP object that will contain the Kerberos

+principal being created.

+</dd>

+<dt>-x linkdn=dn</dt><dd>Specifies the LDAP object to which the newly created Kerberos

+principal object will point.

+</dd>

+<dt>-x containerdn=container_dn</dt><dd>Specifies the container object under which the Kerberos

+principal is to be created.

+</dd>

+<dt>-x tktpolicy=policy</dt><dd>Associates a ticket policy to the Kerberos principal.

+</dd>

</dl>

-<div class="last admonition note">

-Note

-<ul class="last simple">

-<li>The containerdn and linkdn options cannot be

-specified with the dn option.</li>

-<li>If the dn or containerdn options are not specified while

+<div class="admonition note">

+Note

+<ul class="simple">

+<li>The containerdn and linkdn options cannot be

+specified with the dn option.</li>

+<li>If the dn or containerdn options are not specified while

adding the principal, the principals are created under the

principal container configured in the realm or the realm

-container.</li>

-<li>dn and containerdn should be within the subtrees or

-principal container configured in the realm.</li>

+container.</li>

+<li>dn and containerdn should be within the subtrees or

+principal container configured in the realm.</li>

</ul>

</div>

</dd>

</dl>

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: addprinc jennifer

No policy specified for "jennifer@ATHENA.MIT.EDU";

defaulting to no policy.

Enter password for principal jennifer@ATHENA.MIT.EDU:

@@ -415,11 +406,12 @@ principal container configured in the realm.</li>

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="modify-principal">

+</section>

+<section id="modify-principal">

<h3>modify_principal<a class="headerlink" href="#modify-principal" title="Permalink to this headline">¶</a></h3>

-<div>modify_principal [options] principal</div></blockquote>

+<div>modify_principal [options] principal

+</div></blockquote>

Modifies the specified principal, changing the fields as specified.

The options to add_principal also apply to this command, except

for the -randkey, -pw, and -e options. In addition, the

@@ -427,36 +419,39 @@ option -clearpolicy will clear the current policy of a principa

This command requires the modify privilege.

Alias: modprinc

Options (in addition to the addprinc options):

-<dl class="docutils">

-<dt>-unlock</dt>

-<dd>Unlocks a locked principal (one which has received too many failed

+<dl class="simple">

+<dt>-unlock</dt><dd>Unlocks a locked principal (one which has received too many failed

authentication attempts without enough time between them according

-to its password policy) so that it can successfully authenticate.</dd>

+to its password policy) so that it can successfully authenticate.

+</dd>

</dl>

-</div>

-<div class="section" id="rename-principal">

+</section>

+<section id="rename-principal">

<h3>rename_principal<a class="headerlink" href="#rename-principal" title="Permalink to this headline">¶</a></h3>

-<div>rename_principal [-force] old_principal new_principal</div></blockquote>

+<div>rename_principal [-force] old_principal new_principal

+</div></blockquote>

Renames the specified old_principal to new_principal. This

command prompts for confirmation, unless the -force option is

given.

This command requires the add and delete privileges.

Alias: renprinc

-</div>

-<div class="section" id="delete-principal">

+</section>

+<section id="delete-principal">

<h3>delete_principal<a class="headerlink" href="#delete-principal" title="Permalink to this headline">¶</a></h3>

-<div>delete_principal [-force] principal</div></blockquote>

+<div>delete_principal [-force] principal

+</div></blockquote>

Deletes the specified principal from the database. This command

prompts for deletion, unless the -force option is given.

This command requires the delete privilege.

Alias: delprinc

-</div>

-<div class="section" id="change-password">

+</section>

+<section id="change-password">

<h3>change_password<a class="headerlink" href="#change-password" title="Permalink to this headline">¶</a></h3>

-<div>change_password [options] principal</div></blockquote>

+<div>change_password [options] principal

+</div></blockquote>

Changes the password of principal. Prompts for a new password if

neither -randkey or -pw is specified.

This command requires the changepw privilege, or that the

@@ -464,52 +459,54 @@ principal running the program is the same as the principal being

changed.

Alias: cpw

The following options are available:

-<dl class="docutils">

-<dt>-randkey</dt>

-<dd>Sets the key of the principal to a random value.</dd>

-<dt>-pw password</dt>

-<dd>Set the password to the specified string. Using this option in a

+<dl class="simple">

+<dt>-randkey</dt><dd>Sets the key of the principal to a random value.

+</dd>

+<dt>-pw password</dt><dd>Set the password to the specified string. Using this option in a

script may expose the password to other users on the system via

-the process list.</dd>

-<dt>-e enc:salt,…</dt>

-<dd>Uses the specified keysalt list for setting the keys of the

+the process list.

+</dd>

+<dt>-e enc:salt,…</dt><dd>Uses the specified keysalt list for setting the keys of the

-list of possible values.</dd>

-<dt>-keepold</dt>

-<dd>Keeps the existing keys in the database. This flag is usually not

-necessary except perhaps for <code class="docutils literal">krbtgt</code> principals.</dd>

+list of possible values.

+</dd>

+<dt>-keepold</dt><dd>Keeps the existing keys in the database. This flag is usually not

+necessary except perhaps for <code class="docutils literal notranslate">krbtgt</code> principals.

+</dd>

</dl>

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: cpw systest

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: cpw systest

Enter password for principal systest@BLEEP.COM:

Re-enter password for principal systest@BLEEP.COM:

Password for systest@BLEEP.COM changed.

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="purgekeys">

+</section>

+<section id="purgekeys">

<h3>purgekeys<a class="headerlink" href="#purgekeys" title="Permalink to this headline">¶</a></h3>

-<div>purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal</div></blockquote>

+<div>purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal

+</div></blockquote>

Purges previously retained old keys (e.g., from change_password

-keepold) from principal. If -keepkvno is specified, then

only purges keys with kvnos lower than oldest_kvno_to_keep. If

-all is specified, then all keys are purged. The -all option

is new in release 1.12.

This command requires the modify privilege.

-</div>

-<div class="section" id="get-principal">

+</section>

+<section id="get-principal">

<h3>get_principal<a class="headerlink" href="#get-principal" title="Permalink to this headline">¶</a></h3>

-<div>get_principal [-terse] principal</div></blockquote>

+<div>get_principal [-terse] principal

+</div></blockquote>

Gets the attributes of principal. With the -terse option, outputs

fields as quoted tab-separated strings.

This command requires the inquire privilege, or that the principal

running the the program to be the same as the one being listed.

Alias: getprinc

Examples:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: getprinc tlyu/admin

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: getprinc tlyu/admin

Principal: tlyu/admin@BLEEP.COM

Expiration date: [never]

Last password change: Mon Aug 12 14:16:47 EDT 1996

@@ -533,22 +530,23 @@ running the the program to be the same as the one being listed.

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="list-principals">

+</section>

+<section id="list-principals">

<h3>list_principals<a class="headerlink" href="#list-principals" title="Permalink to this headline">¶</a></h3>

-<div>list_principals [expression]</div></blockquote>

+<div>list_principals [expression]

+</div></blockquote>

Retrieves all or some principal names. expression is a shell-style

-glob expression that can contain the wild-card characters <code class="docutils literal">?</code>,

-<code class="docutils literal">*</code>, and <code class="docutils literal">[]</code>. All principal names matching the expression are

+glob expression that can contain the wild-card characters <code class="docutils literal notranslate">?</code>,

+<code class="docutils literal notranslate">*</code>, and <code class="docutils literal notranslate">[]</code>. All principal names matching the expression are

printed. If no expression is provided, all principal names are

-printed. If the expression does not contain an <code class="docutils literal">@</code> character, an

-<code class="docutils literal">@</code> character followed by the local realm is appended to the

+printed. If the expression does not contain an <code class="docutils literal notranslate">@</code> character, an

+<code class="docutils literal notranslate">@</code> character followed by the local realm is appended to the

expression.

This command requires the list privilege.

Alias: listprincs, get_principals, getprincs

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: listprincs test*

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: listprincs test*

test3@SECURE-TEST.OV.COM

test2@SECURE-TEST.OV.COM

test1@SECURE-TEST.OV.COM

@@ -556,169 +554,176 @@ expression.

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="get-strings">

+</section>

+<section id="get-strings">

<h3>get_strings<a class="headerlink" href="#get-strings" title="Permalink to this headline">¶</a></h3>

-<div>get_strings principal</div></blockquote>

+<div>get_strings principal

+</div></blockquote>

Displays string attributes on principal.

This command requires the inquire privilege.

Alias: getstrs

-</div>

-<div class="section" id="set-string">

+</section>

+<section id="set-string">

<h3>set_string<a class="headerlink" href="#set-string" title="Permalink to this headline">¶</a></h3>

-<div>set_string principal name value</div></blockquote>

+<div>set_string principal name value

+</div></blockquote>

Sets a string attribute on principal. String attributes are used to

supply per-principal configuration to the KDC and some KDC plugin

modules. The following string attribute names are recognized by the

KDC:

-<dl class="docutils">

-<dt>require_auth</dt>

-<dd>Specifies an authentication indicator which is required to

+<dl class="simple">

+<dt>require_auth</dt><dd>Specifies an authentication indicator which is required to

authenticate to the principal as a service. Multiple indicators

can be specified, separated by spaces; in this case any of the

-specified indicators will be accepted. (New in release 1.14.)</dd>

-<dt>session_enctypes</dt>

-<dd>Specifies the encryption types supported for session keys when the

+specified indicators will be accepted. (New in release 1.14.)

+</dd>

+<dt>session_enctypes</dt><dd>Specifies the encryption types supported for session keys when the

principal is authenticated to as a server. See

<a class="reference internal" href="../conf_files/kdc_conf.html#encryption-types">Encryption types</a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5">kdc.conf</a> for a list of the

-accepted values.</dd>

-<dt>otp</dt>

-<dd>Enables One Time Passwords (OTP) preauthentication for a client

+accepted values.

+</dd>

+<dt>otp</dt><dd>Enables One Time Passwords (OTP) preauthentication for a client

principal. The value is a JSON string representing an array

-of objects, each having optional <code class="docutils literal">type</code> and <code class="docutils literal">username</code> fields.</dd>

-<dt>pkinit_cert_match</dt>

-<dd>Specifies a matching expression that defines the certificate

+of objects, each having optional <code class="docutils literal notranslate">type</code> and <code class="docutils literal notranslate">username</code> fields.

+</dd>

+<dt>pkinit_cert_match</dt><dd>Specifies a matching expression that defines the certificate

attributes required for the client certificate used by the

principal during PKINIT authentication. The matching expression

is in the same format as those used by the pkinit_cert_match

-option in <a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5">krb5.conf</a>. (New in release 1.16.)</dd>

-<dt>pac_privsvr_enctype</dt>

-<dd>Forces the encryption type of the PAC KDC checksum buffers to the

+option in <a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5">krb5.conf</a>. (New in release 1.16.)

+</dd>

+<dt>pac_privsvr_enctype</dt><dd>Forces the encryption type of the PAC KDC checksum buffers to the

specified encryption type for tickets issued to this server, by

deriving a key from the local krbtgt key if it is of a different

encryption type. It may be necessary to set this value to

“aes256-sha1” on the cross-realm krbtgt entry for an Active

Directory realm when using aes-sha2 keys on the local krbtgt

-entry.</dd>

+entry.

+</dd>

</dl>

This command requires the modify privilege.

Alias: setstr

Example:

-<div class="highlight-default"><div class="highlight"><pre>set_string host/foo.mit.edu session_enctypes aes128-cts

+<div class="highlight-default notranslate"><div class="highlight"><pre>set_string host/foo.mit.edu session_enctypes aes128-cts

set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"

</pre></div>

</div>

-</div>

-<div class="section" id="del-string">

+</section>

+<section id="del-string">

<h3>del_string<a class="headerlink" href="#del-string" title="Permalink to this headline">¶</a></h3>

-<div>del_string principal key</div></blockquote>

+<div>del_string principal key

+</div></blockquote>

Deletes a string attribute from principal.

This command requires the delete privilege.

Alias: delstr

-</div>

-<div class="section" id="add-policy">

+</section>

+<section id="add-policy">

<h3>add_policy<a class="headerlink" href="#add-policy" title="Permalink to this headline">¶</a></h3>

-<div>add_policy [options] policy</div></blockquote>

+<div>add_policy [options] policy

+</div></blockquote>

Adds a password policy named policy to the database.

This command requires the add privilege.

Alias: addpol

The following options are available:

-<dl class="docutils">

-<dt>-maxlife time</dt>

-lifetime of a password.</dd>

-<dt>-minlife time</dt>

-lifetime of a password.</dd>

-<dt>-minlength length</dt>

-<dd>Sets the minimum length of a password.</dd>

-<dt>-minclasses number</dt>

-<dd>Sets the minimum number of character classes required in a

+<dl class="simple">

+<dt>-maxlife time</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) Sets the maximum

+lifetime of a password.

+</dd>

+<dt>-minlife time</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) Sets the minimum

+lifetime of a password.

+</dd>

+<dt>-minlength length</dt><dd>Sets the minimum length of a password.

+</dd>

+<dt>-minclasses number</dt><dd>Sets the minimum number of character classes required in a

password. The five character classes are lower case, upper case,

-numbers, punctuation, and whitespace/unprintable characters.</dd>

-<dt>-history number</dt>

-<dd>Sets the number of past keys kept for a principal. This option is

-not supported with the LDAP KDC database module.</dd>

+numbers, punctuation, and whitespace/unprintable characters.

+</dd>

+<dt>-history number</dt><dd>Sets the number of past keys kept for a principal. This option is

+not supported with the LDAP KDC database module.

+</dd>

</dl>

-<dl class="docutils" id="policy-maxfailure">

-<dt>-maxfailure maxnumber</dt>

-<dd>Sets the number of authentication failures before the principal is

+<dl class="simple" id="policy-maxfailure">

+<dt>-maxfailure maxnumber</dt><dd>Sets the number of authentication failures before the principal is

locked. Authentication failures are only tracked for principals

which require preauthentication. The counter of failed attempts

resets to 0 after a successful attempt to authenticate. A

-maxnumber value of 0 (the default) disables lockout.</dd>

+maxnumber value of 0 (the default) disables lockout.

+</dd>

</dl>

-<dl class="docutils" id="policy-failurecountinterval">

-<dt>-failurecountinterval failuretime</dt>

+<dl class="simple" id="policy-failurecountinterval">

+<dt>-failurecountinterval failuretime</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) Sets the allowable time

between authentication failures. If an authentication failure

happens after failuretime has elapsed since the previous

failure, the number of authentication failures is reset to 1. A

-failuretime value of 0 (the default) means forever.</dd>

+failuretime value of 0 (the default) means forever.

+</dd>

</dl>

-<dl class="docutils" id="policy-lockoutduration">

-<dt>-lockoutduration lockouttime</dt>

+<dl class="simple" id="policy-lockoutduration">

+<dt>-lockoutduration lockouttime</dt><dd>(<a class="reference internal" href="../../basic/date_format.html#duration">Time duration</a> or <a class="reference internal" href="../../basic/date_format.html#getdate">getdate time</a> string) Sets the duration for

which the principal is locked from authenticating if too many

authentication failures occur without the specified failure count

interval elapsing. A duration of 0 (the default) means the

principal remains locked out until it is administratively unlocked

-with <code class="docutils literal">modprinc -unlock</code>.</dd>

-<dt>-allowedkeysalts</dt>

-<dd>Specifies the key/salt tuples supported for long-term keys when

+with <code class="docutils literal notranslate">modprinc -unlock</code>.

+</dd>

+<dt>-allowedkeysalts</dt><dd>Specifies the key/salt tuples supported for long-term keys when

setting or changing a principal’s password/keys. See

accepted values, but note that key/salt tuples must be separated

with commas (‘,’) only. To clear the allowed key/salt policy use

-a value of ‘-‘.</dd>

+a value of ‘-‘.

+</dd>

</dl>

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: add_policy -maxlife "2 days" -minlength 5 guests

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: add_policy -maxlife "2 days" -minlength 5 guests

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="modify-policy">

+</section>

+<section id="modify-policy">

<h3>modify_policy<a class="headerlink" href="#modify-policy" title="Permalink to this headline">¶</a></h3>

-<div>modify_policy [options] policy</div></blockquote>

+<div>modify_policy [options] policy

+</div></blockquote>

Modifies the password policy named policy. Options are as described

for add_policy.

This command requires the modify privilege.

Alias: modpol

-</div>

-<div class="section" id="delete-policy">

+</section>

+<section id="delete-policy">

<h3>delete_policy<a class="headerlink" href="#delete-policy" title="Permalink to this headline">¶</a></h3>

-<div>delete_policy [-force] policy</div></blockquote>

+<div>delete_policy [-force] policy

+</div></blockquote>

Deletes the password policy named policy. Prompts for confirmation

before deletion. The command will fail if the policy is in use by any

principals.

This command requires the delete privilege.

Alias: delpol

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: del_policy guests

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: del_policy guests

Are you sure you want to delete the policy "guests"?

(yes/no): yes

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="get-policy">

+</section>

+<section id="get-policy">

<h3>get_policy<a class="headerlink" href="#get-policy" title="Permalink to this headline">¶</a></h3>

-<div>get_policy [ -terse ] policy</div></blockquote>

+<div>get_policy [ -terse ] policy

+</div></blockquote>

Displays the values of the password policy named policy. With the

-terse flag, outputs the fields as quoted strings separated by

tabs.

This command requires the inquire privilege.

Alias: getpol

Examples:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: get_policy admin

Policy: admin

Maximum password life: 180 days 00:00:00

Minimum password life: 00:00:00

@@ -735,20 +740,21 @@ tabs.

The “Reference count” is the number of principals using that policy.

With the LDAP KDC database module, the reference count field is not

meaningful.

-</div>

-<div class="section" id="list-policies">

+</section>

+<section id="list-policies">

<h3>list_policies<a class="headerlink" href="#list-policies" title="Permalink to this headline">¶</a></h3>

-<div>list_policies [expression]</div></blockquote>

+<div>list_policies [expression]

+</div></blockquote>

Retrieves all or some policy names. expression is a shell-style

-glob expression that can contain the wild-card characters <code class="docutils literal">?</code>,

-<code class="docutils literal">*</code>, and <code class="docutils literal">[]</code>. All policy names matching the expression are

+glob expression that can contain the wild-card characters <code class="docutils literal notranslate">?</code>,

printed. If no expression is provided, all existing policy names are

printed.

This command requires the list privilege.

Aliases: listpols, get_policies, getpols.

Examples:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: listpols

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: listpols

test-pol

dict-only

once-a-min

@@ -760,8 +766,8 @@ printed.

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="ktadd">

+</section>

+<section id="ktadd">

<h3>ktadd<a class="headerlink" href="#ktadd" title="Permalink to this headline">¶</a></h3>

@@ -776,38 +782,39 @@ command.

This command requires the inquire and changepw privileges.

With the -glob form, it also requires the list privilege.

The options are:

-<dl class="docutils">

-<dt>-k[eytab] keytab</dt>

-<dd>Use keytab as the keytab file. Otherwise, the default keytab is

-used.</dd>

-<dt>-e enc:salt,…</dt>

-<dd>Uses the specified keysalt list for setting the new keys of the

+<dl class="simple">

+<dt>-k[eytab] keytab</dt><dd>Use keytab as the keytab file. Otherwise, the default keytab is

+used.

+</dd>

+<dt>-e enc:salt,…</dt><dd>Uses the specified keysalt list for setting the new keys of the

-list of possible values.</dd>

-<dt>-q</dt>

-<dd>Display less verbose information.</dd>

-<dt>-norandkey</dt>

-<dd>Do not randomize the keys. The keys and their version numbers stay

+list of possible values.

+</dd>

+<dt>-q</dt><dd>Display less verbose information.

+</dd>

+<dt>-norandkey</dt><dd>Do not randomize the keys. The keys and their version numbers stay

unchanged. This option cannot be specified in combination with the

--e option.</dd>

+-e option.

+</dd>

</dl>

An entry for each of the principal’s unique encryption types is added,

ignoring multiple keys with the same encryption type but different

salt types.

Alias: xst

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu

+<div class="highlight-default notranslate"><div class="highlight"><pre>kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu

Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,

encryption type aes256-cts-hmac-sha1-96 added to keytab

FILE:/tmp/foo-new-keytab

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="ktremove">

+</section>

+<section id="ktremove">

<h3>ktremove<a class="headerlink" href="#ktremove" title="Permalink to this headline">¶</a></h3>

-<div>ktremove [options] principal [kvno | all | old]</div></blockquote>

+<div>ktremove [options] principal [kvno | all | old]

+</div></blockquote>

Removes entries for the specified principal from a keytab. Requires

no permissions, since this does not require database access.

If the string “all” is specified, all entries for that principal are

@@ -816,64 +823,66 @@ principal except those with the highest kvno are removed. Otherwise,

the value specified is parsed as an integer, and all entries whose

kvno match that integer are removed.

The options are:

-<dl class="docutils">

-<dt>-k[eytab] keytab</dt>

-<dd>Use keytab as the keytab file. Otherwise, the default keytab is

-used.</dd>

-<dt>-q</dt>

-<dd>Display less verbose information.</dd>

+<dl class="simple">

+<dt>-k[eytab] keytab</dt><dd>Use keytab as the keytab file. Otherwise, the default keytab is

+used.

+</dd>

+<dt>-q</dt><dd>Display less verbose information.

+</dd>

</dl>

Alias: ktrem

Example:

-<div class="highlight-default"><div class="highlight"><pre>kadmin: ktremove kadmin/admin all

Entry for principal kadmin/admin with kvno 3 removed from keytab

FILE:/etc/krb5.keytab

kadmin:

</pre></div>

</div>

-</div>

-<div class="section" id="lock">

+</section>

+<section id="lock">

Lock database exclusively. Use with extreme caution! This command

only works with the DB2 KDC database module.

-</div>

-<div class="section" id="unlock">

+</section>

+<section id="unlock">

<h3>unlock<a class="headerlink" href="#unlock" title="Permalink to this headline">¶</a></h3>

Release the exclusive database lock.

-</div>

-<div class="section" id="list-requests">

+</section>

+<section id="list-requests">

<h3>list_requests<a class="headerlink" href="#list-requests" title="Permalink to this headline">¶</a></h3>

Lists available for kadmin requests.

Aliases: lr, ?

-</div>

-<div class="section" id="quit">

+</section>

+<section id="quit">

Exit program. If the database was locked, the lock is released.

Aliases: exit, q

-</div>

-<div class="section" id="history">

+</section>

+<section id="history">

<h2>HISTORY<a class="headerlink" href="#history" title="Permalink to this headline">¶</a></h2>

The kadmin program was originally written by Tom Yu at MIT, as an

interface to the OpenVision Kerberos administration program.

-</div>

-<div class="section" id="environment">

+</section>

+<section id="environment">

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

See <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7">kerberos</a> for a description of Kerberos environment

variables.

-</div>

-<div class="section" id="see-also">

+</section>

+<section id="see-also">

<a class="reference internal" href="../../user/user_commands/kpasswd.html#kpasswd-1">kpasswd</a>, <a class="reference internal" href="kadmind.html#kadmind-8">kadmind</a>, <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7">kerberos</a>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">kadmin</a><ul>

@@ -977,6 +986,7 @@ variables.

</form>

</div>

</div>

@@ -984,8 +994,8 @@ variables.

- <div class="right" >Release: 1.21.2

+ <div class="right" >Release: 1.21.3

</div>