diff options
Diffstat (limited to 'doc/html/admin/admin_commands/kadmin_local.html')
| -rw-r--r-- | doc/html/admin/admin_commands/kadmin_local.html | 374 |
1 files changed, 197 insertions, 177 deletions
diff --git a/doc/html/admin/admin_commands/kadmin_local.html b/doc/html/admin/admin_commands/kadmin_local.html index 270fc9376f04..6cca1815ffd9 100644 --- a/doc/html/admin/admin_commands/kadmin_local.html +++ b/doc/html/admin/admin_commands/kadmin_local.html @@ -1,33 +1,31 @@ + <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> - <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - - <title>kadmin — MIT Kerberos Documentation</title> - + <title>kadmin — MIT Kerberos Documentation</title> <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" /> <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" /> <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" /> - <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../../', - VERSION: '1.16', + VERSION: '1.21.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', - HAS_SOURCE: true + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt' }; </script> <script type="text/javascript" src="../../_static/jquery.js"></script> <script type="text/javascript" src="../../_static/underscore.js"></script> <script type="text/javascript" src="../../_static/doctools.js"></script> <link rel="author" title="About these documents" href="../../about.html" /> + <link rel="index" title="Index" href="../../genindex.html" /> + <link rel="search" title="Search" href="../../search.html" /> <link rel="copyright" title="Copyright" href="../../copyright.html" /> - <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" /> - <link rel="up" title="Administration programs" href="index.html" /> <link rel="next" title="kadmind" href="kadmind.html" /> <link rel="prev" title="Administration programs" href="index.html" /> </head> @@ -61,7 +59,7 @@ <div class="documentwrapper"> <div class="bodywrapper"> - <div class="body"> + <div class="body" role="main"> <div class="section" id="kadmin"> <span id="kadmin-1"></span><h1>kadmin<a class="headerlink" href="#kadmin" title="Permalink to this headline">¶</a></h1> @@ -75,31 +73,31 @@ [[<strong>-c</strong> <em>cache_name</em>]|[<strong>-k</strong> [<strong>-t</strong> <em>keytab</em>]]|<strong>-n</strong>] [<strong>-w</strong> <em>password</em>] [<strong>-s</strong> <em>admin_server</em>[:<em>port</em>]] -[command args...]</p> +[command args…]</p> <p><strong>kadmin.local</strong> [<strong>-r</strong> <em>realm</em>] [<strong>-p</strong> <em>principal</em>] [<strong>-q</strong> <em>query</em>] [<strong>-d</strong> <em>dbname</em>] -[<strong>-e</strong> <em>enc</em>:<em>salt</em> ...] +[<strong>-e</strong> <em>enc</em>:<em>salt</em> …] [<strong>-m</strong>] [<strong>-x</strong> <em>db_args</em>] -[command args...]</p> +[command args…]</p> </div> <div class="section" id="description"> -<span id="kadmin-synopsis-end"></span><h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2> +<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2> <p>kadmin and kadmin.local are command-line interfaces to the Kerberos V5 administration system. They provide nearly identical functionalities; the difference is that kadmin.local directly accesses the KDC -database, while kadmin performs operations using <a class="reference internal" href="kadmind.html#kadmind-8"><em>kadmind</em></a>. -Except as explicitly noted otherwise, this man page will use “kadmin” +database, while kadmin performs operations using <a class="reference internal" href="kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>. +Except as explicitly noted otherwise, this man page will use “kadmin” to refer to both versions. kadmin provides for the maintenance of Kerberos principals, password policies, and service key tables (keytabs).</p> <p>The remote kadmin client uses Kerberos to authenticate to kadmind -using the service principal <tt class="docutils literal"><span class="pre">kadmin/ADMINHOST</span></tt> (where <em>ADMINHOST</em> is -the fully-qualified hostname of the admin server) or <tt class="docutils literal"><span class="pre">kadmin/admin</span></tt>. -If the credentials cache contains a ticket for one of these +using the service principal <code class="docutils literal"><span class="pre">kadmin/admin</span></code> or <code class="docutils literal"><span class="pre">kadmin/ADMINHOST</span></code> +(where <em>ADMINHOST</em> is the fully-qualified hostname of the admin +server). If the credentials cache contains a ticket for one of these principals, and the <strong>-c</strong> credentials_cache option is specified, that ticket is used to authenticate to kadmind. Otherwise, the <strong>-p</strong> and <strong>-k</strong> options are used to specify the client Kerberos principal name @@ -107,7 +105,7 @@ used to authenticate. Once kadmin has determined the principal name, it requests a service ticket from the KDC, and uses that service ticket to authenticate to kadmind.</p> <p>Since kadmin.local directly accesses the KDC database, it usually must -be run directly on the master KDC with sufficient permissions to read +be run directly on the primary KDC with sufficient permissions to read the KDC database. If the KDC database uses the LDAP database module, kadmin.local can be run on any host which can access the LDAP server.</p> </div> @@ -118,13 +116,13 @@ kadmin.local can be run on any host which can access the LDAP server.</p> <dd>Use <em>realm</em> as the default database realm.</dd> <dt><strong>-p</strong> <em>principal</em></dt> <dd>Use <em>principal</em> to authenticate. Otherwise, kadmin will append -<tt class="docutils literal"><span class="pre">/admin</span></tt> to the primary principal name of the default ccache, +<code class="docutils literal"><span class="pre">/admin</span></code> to the primary principal name of the default ccache, the value of the <strong>USER</strong> environment variable, or the username as obtained with getpwuid, in order of preference.</dd> <dt><strong>-k</strong></dt> <dd>Use a keytab to decrypt the KDC response instead of prompting for a password. In this case, the default principal will be -<tt class="docutils literal"><span class="pre">host/hostname</span></tt>. If there is no keytab specified with the +<code class="docutils literal"><span class="pre">host/hostname</span></code>. If there is no keytab specified with the <strong>-t</strong> option, then the default keytab will be used.</dd> <dt><strong>-t</strong> <em>keytab</em></dt> <dd>Use <em>keytab</em> to decrypt the KDC response. This can only be used @@ -132,23 +130,23 @@ with the <strong>-k</strong> option.</dd> <dt><strong>-n</strong></dt> <dd>Requests anonymous processing. Two types of anonymous principals are supported. For fully anonymous Kerberos, configure PKINIT on -the KDC and configure <strong>pkinit_anchors</strong> in the client’s -<a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a>. Then use the <strong>-n</strong> option with a principal -of the form <tt class="docutils literal"><span class="pre">@REALM</span></tt> (an empty principal name followed by the +the KDC and configure <strong>pkinit_anchors</strong> in the client’s +<a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>. Then use the <strong>-n</strong> option with a principal +of the form <code class="docutils literal"><span class="pre">@REALM</span></code> (an empty principal name followed by the at-sign and a realm name). If permitted by the KDC, an anonymous ticket will be returned. A second form of anonymous tickets is supported; these realm-exposed tickets hide the identity of the -client but not the client’s realm. For this mode, use <tt class="docutils literal"><span class="pre">kinit</span> -<span class="pre">-n</span></tt> with a normal principal name. If supported by the KDC, the +client but not the client’s realm. For this mode, use <code class="docutils literal"><span class="pre">kinit</span> +<span class="pre">-n</span></code> with a normal principal name. If supported by the KDC, the principal (but not realm) will be replaced by the anonymous principal. As of release 1.8, the MIT Kerberos KDC only supports fully anonymous operation.</dd> <dt><strong>-c</strong> <em>credentials_cache</em></dt> -<dd>Use <em>credentials_cache</em> as the credentials cache. The -cache should contain a service ticket for the <tt class="docutils literal"><span class="pre">kadmin/ADMINHOST</span></tt> -(where <em>ADMINHOST</em> is the fully-qualified hostname of the admin -server) or <tt class="docutils literal"><span class="pre">kadmin/admin</span></tt> service; it can be acquired with the -<a class="reference internal" href="../../user/user_commands/kinit.html#kinit-1"><em>kinit</em></a> program. If this option is not specified, kadmin +<dd>Use <em>credentials_cache</em> as the credentials cache. The cache +should contain a service ticket for the <code class="docutils literal"><span class="pre">kadmin/admin</span></code> or +<code class="docutils literal"><span class="pre">kadmin/ADMINHOST</span></code> (where <em>ADMINHOST</em> is the fully-qualified +hostname of the admin server) service; it can be acquired with the +<a class="reference internal" href="../../user/user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> program. If this option is not specified, kadmin requests a new service ticket from the KDC, and stores it in its own temporary ccache.</dd> <dt><strong>-w</strong> <em>password</em></dt> @@ -165,9 +163,9 @@ apply to the LDAP database module.</dd> <dt><strong>-m</strong></dt> <dd>If using kadmin.local, prompt for the database master password instead of reading it from a stash file.</dd> -<dt><strong>-e</strong> “<em>enc</em>:<em>salt</em> ...”</dt> +<dt><strong>-e</strong> “<em>enc</em>:<em>salt</em> …”</dt> <dd>Sets the keysalt list to be used for any new keys created. See -<a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><em>Keysalt lists</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a list of possible +<a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><span class="std std-ref">Keysalt lists</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of possible values.</dd> <dt><strong>-O</strong></dt> <dd>Force use of old AUTH_GSSAPI authentication flavor.</dd> @@ -177,7 +175,7 @@ values.</dd> <dd>Specifies the database specific arguments. See the next section for supported options.</dd> </dl> -<p id="kadmin-options-end">Starting with release 1.14, if any command-line arguments remain after +<p>Starting with release 1.14, if any command-line arguments remain after the options, they will be treated as a single query to be executed. This mode of operation is intended for scripts and behaves differently from the interactive mode in several respects:</p> @@ -228,7 +226,7 @@ entire operation. First introduced in release 1.13.</dd> server. Using this option may expose the password to other users on the system via the process list; to avoid this, instead stash the password using the <strong>stashsrvpw</strong> command of -<a class="reference internal" href="kdb5_ldap_util.html#kdb5-ldap-util-8"><em>kdb5_ldap_util</em></a>.</dd> +<a class="reference internal" href="kdb5_ldap_util.html#kdb5-ldap-util-8"><span class="std std-ref">kdb5_ldap_util</span></a>.</dd> <dt><strong>-x sasl_mech=</strong><em>mechanism</em></dt> <dd>Specifies the SASL mechanism used to bind to the LDAP server. The bind DN is ignored if a SASL mechanism is used. New in @@ -254,7 +252,7 @@ are printed to standard error. New in release 1.12.</dd> <div class="section" id="commands"> <h2>COMMANDS<a class="headerlink" href="#commands" title="Permalink to this headline">¶</a></h2> <p>When using the remote client, available commands may be restricted -according to the privileges specified in the <a class="reference internal" href="../conf_files/kadm5_acl.html#kadm5-acl-5"><em>kadm5.acl</em></a> file +according to the privileges specified in the <a class="reference internal" href="../conf_files/kadm5_acl.html#kadm5-acl-5"><span class="std std-ref">kadm5.acl</span></a> file on the admin server.</p> <div class="section" id="add-principal"> <span id="id1"></span><h3>add_principal<a class="headerlink" href="#add-principal" title="Permalink to this headline">¶</a></h3> @@ -262,8 +260,8 @@ on the admin server.</p> <div><strong>add_principal</strong> [<em>options</em>] <em>newprinc</em></div></blockquote> <p>Creates the principal <em>newprinc</em>, prompting twice for a password. If no password policy is specified with the <strong>-policy</strong> option, and the -policy named <tt class="docutils literal"><span class="pre">default</span></tt> is assigned to the principal if it exists. -However, creating a policy named <tt class="docutils literal"><span class="pre">default</span></tt> will not automatically +policy named <code class="docutils literal"><span class="pre">default</span></code> is assigned to the principal if it exists. +However, creating a policy named <code class="docutils literal"><span class="pre">default</span></code> will not automatically assign this policy to previously existing principals. This policy assignment can be suppressed with the <strong>-clearpolicy</strong> option.</p> <p>This command requires the <strong>add</strong> privilege.</p> @@ -271,20 +269,20 @@ assignment can be suppressed with the <strong>-clearpolicy</strong> option.</p> <p>Options:</p> <dl class="docutils"> <dt><strong>-expire</strong> <em>expdate</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) The expiration date of the principal.</dd> +<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) The expiration date of the principal.</dd> <dt><strong>-pwexpire</strong> <em>pwexpdate</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) The password expiration date.</dd> +<dd>(<a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) The password expiration date.</dd> <dt><strong>-maxlife</strong> <em>maxlife</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) The maximum ticket life +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) The maximum ticket life for the principal.</dd> <dt><strong>-maxrenewlife</strong> <em>maxrenewlife</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) The maximum renewable +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) The maximum renewable life of tickets for the principal.</dd> <dt><strong>-kvno</strong> <em>kvno</em></dt> <dd>The initial key version number.</dd> <dt><strong>-policy</strong> <em>policy</em></dt> <dd>The password policy used by this principal. If not specified, the -policy <tt class="docutils literal"><span class="pre">default</span></tt> is used if it exists (unless <strong>-clearpolicy</strong> +policy <code class="docutils literal"><span class="pre">default</span></code> is used if it exists (unless <strong>-clearpolicy</strong> is specified).</dd> <dt><strong>-clearpolicy</strong></dt> <dd>Prevents any policy from being assigned when <strong>-policy</strong> is not @@ -303,21 +301,22 @@ renewable tickets. <strong>+allow_renewable</strong> clears this flag.</dd> proxiable tickets. <strong>+allow_proxiable</strong> clears this flag.</dd> <dt>{-|+}<strong>allow_dup_skey</strong></dt> <dd><strong>-allow_dup_skey</strong> disables user-to-user authentication for this -principal by prohibiting this principal from obtaining a session -key for another user. <strong>+allow_dup_skey</strong> clears this flag.</dd> +principal by prohibiting others from obtaining a service ticket +encrypted in this principal’s TGT session key. +<strong>+allow_dup_skey</strong> clears this flag.</dd> <dt>{-|+}<strong>requires_preauth</strong></dt> <dd><strong>+requires_preauth</strong> requires this principal to preauthenticate before being allowed to kinit. <strong>-requires_preauth</strong> clears this flag. When <strong>+requires_preauth</strong> is set on a service principal, the KDC will only issue service tickets for that service principal -if the client’s initial authentication was performed using +if the client’s initial authentication was performed using preauthentication.</dd> <dt>{-|+}<strong>requires_hwauth</strong></dt> <dd><strong>+requires_hwauth</strong> requires this principal to preauthenticate using a hardware device before being allowed to kinit. <strong>-requires_hwauth</strong> clears this flag. When <strong>+requires_hwauth</strong> is set on a service principal, the KDC will only issue service tickets -for that service principal if the client’s initial authentication was +for that service principal if the client’s initial authentication was performed using a hardware device to preauthenticate.</dd> <dt>{-|+}<strong>ok_as_delegate</strong></dt> <dd><strong>+ok_as_delegate</strong> sets the <strong>okay as delegate</strong> flag on tickets @@ -327,7 +326,9 @@ authenticating to the service. <strong>-ok_as_delegate</strong> clears this flag.</dd> <dt>{-|+}<strong>allow_svr</strong></dt> <dd><strong>-allow_svr</strong> prohibits the issuance of service tickets for this -principal. <strong>+allow_svr</strong> clears this flag.</dd> +principal. In release 1.17 and later, user-to-user service +tickets are still allowed unless the <strong>-allow_dup_skey</strong> flag is +also set. <strong>+allow_svr</strong> clears this flag.</dd> <dt>{-|+}<strong>allow_tgs_req</strong></dt> <dd><strong>-allow_tgs_req</strong> specifies that a Ticket-Granting Service (TGS) request for a service ticket for this principal is not permitted. @@ -369,9 +370,9 @@ be removed using kadmin.local.</dd> does not prompt for a password. Note: using this option in a shell script may expose the password to other users on the system via the process list.</dd> -<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,...</dt> +<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,…</dt> <dd>Uses the specified keysalt list for setting the keys of the -principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><em>Keysalt lists</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a +principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><span class="std std-ref">Keysalt lists</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of possible values.</dd> <dt><strong>-x</strong> <em>db_princ_args</em></dt> <dd><p class="first">Indicates database-specific options. The options for the LDAP @@ -405,18 +406,18 @@ principal container configured in the realm.</li> </dd> </dl> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: addprinc jennifer -WARNING: no policy specified for "jennifer@ATHENA.MIT.EDU"; -defaulting to no policy. -Enter password for principal jennifer@ATHENA.MIT.EDU: -Re-enter password for principal jennifer@ATHENA.MIT.EDU: -Principal "jennifer@ATHENA.MIT.EDU" created. -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">addprinc</span> <span class="n">jennifer</span> +<span class="n">No</span> <span class="n">policy</span> <span class="n">specified</span> <span class="k">for</span> <span class="s2">"jennifer@ATHENA.MIT.EDU"</span><span class="p">;</span> +<span class="n">defaulting</span> <span class="n">to</span> <span class="n">no</span> <span class="n">policy</span><span class="o">.</span> +<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> +<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> +<span class="n">Principal</span> <span class="s2">"jennifer@ATHENA.MIT.EDU"</span> <span class="n">created</span><span class="o">.</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="modify-principal"> -<span id="add-principal-end"></span><span id="id2"></span><h3>modify_principal<a class="headerlink" href="#modify-principal" title="Permalink to this headline">¶</a></h3> +<span id="id2"></span><h3>modify_principal<a class="headerlink" href="#modify-principal" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>modify_principal</strong> [<em>options</em>] <em>principal</em></div></blockquote> <p>Modifies the specified principal, changing the fields as specified. @@ -434,7 +435,7 @@ to its password policy) so that it can successfully authenticate.</dd> </dl> </div> <div class="section" id="rename-principal"> -<span id="modify-principal-end"></span><span id="id3"></span><h3>rename_principal<a class="headerlink" href="#rename-principal" title="Permalink to this headline">¶</a></h3> +<span id="id3"></span><h3>rename_principal<a class="headerlink" href="#rename-principal" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>rename_principal</strong> [<strong>-force</strong>] <em>old_principal</em> <em>new_principal</em></div></blockquote> <p>Renames the specified <em>old_principal</em> to <em>new_principal</em>. This @@ -444,7 +445,7 @@ given.</p> <p>Alias: <strong>renprinc</strong></p> </div> <div class="section" id="delete-principal"> -<span id="rename-principal-end"></span><span id="id4"></span><h3>delete_principal<a class="headerlink" href="#delete-principal" title="Permalink to this headline">¶</a></h3> +<span id="id4"></span><h3>delete_principal<a class="headerlink" href="#delete-principal" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>delete_principal</strong> [<strong>-force</strong>] <em>principal</em></div></blockquote> <p>Deletes the specified <em>principal</em> from the database. This command @@ -453,7 +454,7 @@ prompts for deletion, unless the <strong>-force</strong> option is given.</p> <p>Alias: <strong>delprinc</strong></p> </div> <div class="section" id="change-password"> -<span id="delete-principal-end"></span><span id="id5"></span><h3>change_password<a class="headerlink" href="#change-password" title="Permalink to this headline">¶</a></h3> +<span id="id5"></span><h3>change_password<a class="headerlink" href="#change-password" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>change_password</strong> [<em>options</em>] <em>principal</em></div></blockquote> <p>Changes the password of <em>principal</em>. Prompts for a new password if @@ -470,25 +471,25 @@ changed.</p> <dd>Set the password to the specified string. Using this option in a script may expose the password to other users on the system via the process list.</dd> -<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,...</dt> +<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,…</dt> <dd>Uses the specified keysalt list for setting the keys of the -principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><em>Keysalt lists</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a +principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><span class="std std-ref">Keysalt lists</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of possible values.</dd> <dt><strong>-keepold</strong></dt> <dd>Keeps the existing keys in the database. This flag is usually not -necessary except perhaps for <tt class="docutils literal"><span class="pre">krbtgt</span></tt> principals.</dd> +necessary except perhaps for <code class="docutils literal"><span class="pre">krbtgt</span></code> principals.</dd> </dl> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: cpw systest -Enter password for principal systest@BLEEP.COM: -Re-enter password for principal systest@BLEEP.COM: -Password for systest@BLEEP.COM changed. -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">cpw</span> <span class="n">systest</span> +<span class="n">Enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">systest</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span> +<span class="n">Re</span><span class="o">-</span><span class="n">enter</span> <span class="n">password</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">systest</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span> +<span class="n">Password</span> <span class="k">for</span> <span class="n">systest</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span> <span class="n">changed</span><span class="o">.</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="purgekeys"> -<span id="change-password-end"></span><span id="id6"></span><h3>purgekeys<a class="headerlink" href="#purgekeys" title="Permalink to this headline">¶</a></h3> +<span id="id6"></span><h3>purgekeys<a class="headerlink" href="#purgekeys" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>purgekeys</strong> [<strong>-all</strong>|<strong>-keepkvno</strong> <em>oldest_kvno_to_keep</em>] <em>principal</em></div></blockquote> <p>Purges previously retained old keys (e.g., from <strong>change_password @@ -499,7 +500,7 @@ is new in release 1.12.</p> <p>This command requires the <strong>modify</strong> privilege.</p> </div> <div class="section" id="get-principal"> -<span id="purgekeys-end"></span><span id="id7"></span><h3>get_principal<a class="headerlink" href="#get-principal" title="Permalink to this headline">¶</a></h3> +<span id="id7"></span><h3>get_principal<a class="headerlink" href="#get-principal" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>get_principal</strong> [<strong>-terse</strong>] <em>principal</em></div></blockquote> <p>Gets the attributes of principal. With the <strong>-terse</strong> option, outputs @@ -508,64 +509,64 @@ fields as quoted tab-separated strings.</p> running the the program to be the same as the one being listed.</p> <p>Alias: <strong>getprinc</strong></p> <p>Examples:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: getprinc tlyu/admin -Principal: tlyu/admin@BLEEP.COM -Expiration date: [never] -Last password change: Mon Aug 12 14:16:47 EDT 1996 -Password expiration date: [none] -Maximum ticket life: 0 days 10:00:00 -Maximum renewable life: 7 days 00:00:00 -Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM) -Last successful authentication: [never] -Last failed authentication: [never] -Failed password attempts: 0 -Number of keys: 2 -Key: vno 1, des-cbc-crc -Key: vno 1, des-cbc-crc:v4 -Attributes: -Policy: [none] +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">getprinc</span> <span class="n">tlyu</span><span class="o">/</span><span class="n">admin</span> +<span class="n">Principal</span><span class="p">:</span> <span class="n">tlyu</span><span class="o">/</span><span class="n">admin</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span> +<span class="n">Expiration</span> <span class="n">date</span><span class="p">:</span> <span class="p">[</span><span class="n">never</span><span class="p">]</span> +<span class="n">Last</span> <span class="n">password</span> <span class="n">change</span><span class="p">:</span> <span class="n">Mon</span> <span class="n">Aug</span> <span class="mi">12</span> <span class="mi">14</span><span class="p">:</span><span class="mi">16</span><span class="p">:</span><span class="mi">47</span> <span class="n">EDT</span> <span class="mi">1996</span> +<span class="n">Password</span> <span class="n">expiration</span> <span class="n">date</span><span class="p">:</span> <span class="p">[</span><span class="n">never</span><span class="p">]</span> +<span class="n">Maximum</span> <span class="n">ticket</span> <span class="n">life</span><span class="p">:</span> <span class="mi">0</span> <span class="n">days</span> <span class="mi">10</span><span class="p">:</span><span class="mi">00</span><span class="p">:</span><span class="mi">00</span> +<span class="n">Maximum</span> <span class="n">renewable</span> <span class="n">life</span><span class="p">:</span> <span class="mi">7</span> <span class="n">days</span> <span class="mi">00</span><span class="p">:</span><span class="mi">00</span><span class="p">:</span><span class="mi">00</span> +<span class="n">Last</span> <span class="n">modified</span><span class="p">:</span> <span class="n">Mon</span> <span class="n">Aug</span> <span class="mi">12</span> <span class="mi">14</span><span class="p">:</span><span class="mi">16</span><span class="p">:</span><span class="mi">47</span> <span class="n">EDT</span> <span class="mi">1996</span> <span class="p">(</span><span class="n">bjaspan</span><span class="o">/</span><span class="n">admin</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span><span class="p">)</span> +<span class="n">Last</span> <span class="n">successful</span> <span class="n">authentication</span><span class="p">:</span> <span class="p">[</span><span class="n">never</span><span class="p">]</span> +<span class="n">Last</span> <span class="n">failed</span> <span class="n">authentication</span><span class="p">:</span> <span class="p">[</span><span class="n">never</span><span class="p">]</span> +<span class="n">Failed</span> <span class="n">password</span> <span class="n">attempts</span><span class="p">:</span> <span class="mi">0</span> +<span class="n">Number</span> <span class="n">of</span> <span class="n">keys</span><span class="p">:</span> <span class="mi">1</span> +<span class="n">Key</span><span class="p">:</span> <span class="n">vno</span> <span class="mi">1</span><span class="p">,</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha384</span><span class="o">-</span><span class="mi">192</span> +<span class="n">MKey</span><span class="p">:</span> <span class="n">vno</span> <span class="mi">1</span> +<span class="n">Attributes</span><span class="p">:</span> +<span class="n">Policy</span><span class="p">:</span> <span class="p">[</span><span class="n">none</span><span class="p">]</span> -kadmin: getprinc -terse systest -systest@BLEEP.COM 3 86400 604800 1 -785926535 753241234 785900000 -tlyu/admin@BLEEP.COM 786100034 0 0 -kadmin: +<span class="n">kadmin</span><span class="p">:</span> <span class="n">getprinc</span> <span class="o">-</span><span class="n">terse</span> <span class="n">systest</span> +<span class="n">systest</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span> <span class="mi">3</span> <span class="mi">86400</span> <span class="mi">604800</span> <span class="mi">1</span> +<span class="mi">785926535</span> <span class="mi">753241234</span> <span class="mi">785900000</span> +<span class="n">tlyu</span><span class="o">/</span><span class="n">admin</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span> <span class="mi">786100034</span> <span class="mi">0</span> <span class="mi">0</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="list-principals"> -<span id="get-principal-end"></span><span id="id8"></span><h3>list_principals<a class="headerlink" href="#list-principals" title="Permalink to this headline">¶</a></h3> +<span id="id8"></span><h3>list_principals<a class="headerlink" href="#list-principals" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>list_principals</strong> [<em>expression</em>]</div></blockquote> <p>Retrieves all or some principal names. <em>expression</em> is a shell-style -glob expression that can contain the wild-card characters <tt class="docutils literal"><span class="pre">?</span></tt>, -<tt class="docutils literal"><span class="pre">*</span></tt>, and <tt class="docutils literal"><span class="pre">[]</span></tt>. All principal names matching the expression are +glob expression that can contain the wild-card characters <code class="docutils literal"><span class="pre">?</span></code>, +<code class="docutils literal"><span class="pre">*</span></code>, and <code class="docutils literal"><span class="pre">[]</span></code>. All principal names matching the expression are printed. If no expression is provided, all principal names are -printed. If the expression does not contain an <tt class="docutils literal"><span class="pre">@</span></tt> character, an -<tt class="docutils literal"><span class="pre">@</span></tt> character followed by the local realm is appended to the +printed. If the expression does not contain an <code class="docutils literal"><span class="pre">@</span></code> character, an +<code class="docutils literal"><span class="pre">@</span></code> character followed by the local realm is appended to the expression.</p> <p>This command requires the <strong>list</strong> privilege.</p> -<p>Alias: <strong>listprincs</strong>, <strong>get_principals</strong>, <strong>get_princs</strong></p> +<p>Alias: <strong>listprincs</strong>, <strong>get_principals</strong>, <strong>getprincs</strong></p> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: listprincs test* -test3@SECURE-TEST.OV.COM -test2@SECURE-TEST.OV.COM -test1@SECURE-TEST.OV.COM -testuser@SECURE-TEST.OV.COM -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">listprincs</span> <span class="n">test</span><span class="o">*</span> +<span class="n">test3</span><span class="nd">@SECURE</span><span class="o">-</span><span class="n">TEST</span><span class="o">.</span><span class="n">OV</span><span class="o">.</span><span class="n">COM</span> +<span class="n">test2</span><span class="nd">@SECURE</span><span class="o">-</span><span class="n">TEST</span><span class="o">.</span><span class="n">OV</span><span class="o">.</span><span class="n">COM</span> +<span class="n">test1</span><span class="nd">@SECURE</span><span class="o">-</span><span class="n">TEST</span><span class="o">.</span><span class="n">OV</span><span class="o">.</span><span class="n">COM</span> +<span class="n">testuser</span><span class="nd">@SECURE</span><span class="o">-</span><span class="n">TEST</span><span class="o">.</span><span class="n">OV</span><span class="o">.</span><span class="n">COM</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="get-strings"> -<span id="list-principals-end"></span><span id="id9"></span><h3>get_strings<a class="headerlink" href="#get-strings" title="Permalink to this headline">¶</a></h3> +<span id="id9"></span><h3>get_strings<a class="headerlink" href="#get-strings" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>get_strings</strong> <em>principal</em></div></blockquote> <p>Displays string attributes on <em>principal</em>.</p> <p>This command requires the <strong>inquire</strong> privilege.</p> -<p>Alias: <strong>getstr</strong></p> +<p>Alias: <strong>getstrs</strong></p> </div> <div class="section" id="set-string"> -<span id="get-strings-end"></span><span id="id10"></span><h3>set_string<a class="headerlink" href="#set-string" title="Permalink to this headline">¶</a></h3> +<span id="id10"></span><h3>set_string<a class="headerlink" href="#set-string" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>set_string</strong> <em>principal</em> <em>name</em> <em>value</em></div></blockquote> <p>Sets a string attribute on <em>principal</em>. String attributes are used to @@ -581,29 +582,37 @@ specified indicators will be accepted. (New in release 1.14.)</dd> <dt><strong>session_enctypes</strong></dt> <dd>Specifies the encryption types supported for session keys when the principal is authenticated to as a server. See -<a class="reference internal" href="../conf_files/kdc_conf.html#encryption-types"><em>Encryption types</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a list of the +<a class="reference internal" href="../conf_files/kdc_conf.html#encryption-types"><span class="std std-ref">Encryption types</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of the accepted values.</dd> <dt><strong>otp</strong></dt> <dd>Enables One Time Passwords (OTP) preauthentication for a client <em>principal</em>. The <em>value</em> is a JSON string representing an array -of objects, each having optional <tt class="docutils literal"><span class="pre">type</span></tt> and <tt class="docutils literal"><span class="pre">username</span></tt> fields.</dd> +of objects, each having optional <code class="docutils literal"><span class="pre">type</span></code> and <code class="docutils literal"><span class="pre">username</span></code> fields.</dd> <dt><strong>pkinit_cert_match</strong></dt> <dd>Specifies a matching expression that defines the certificate attributes required for the client certificate used by the principal during PKINIT authentication. The matching expression is in the same format as those used by the <strong>pkinit_cert_match</strong> -option in <a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a>. (New in release 1.16.)</dd> +option in <a class="reference internal" href="../conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>. (New in release 1.16.)</dd> +<dt><strong>pac_privsvr_enctype</strong></dt> +<dd>Forces the encryption type of the PAC KDC checksum buffers to the +specified encryption type for tickets issued to this server, by +deriving a key from the local krbtgt key if it is of a different +encryption type. It may be necessary to set this value to +“aes256-sha1” on the cross-realm krbtgt entry for an Active +Directory realm when using aes-sha2 keys on the local krbtgt +entry.</dd> </dl> <p>This command requires the <strong>modify</strong> privilege.</p> <p>Alias: <strong>setstr</strong></p> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>set_string host/foo.mit.edu session_enctypes aes128-cts -set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]" +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">set_string</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> <span class="n">session_enctypes</span> <span class="n">aes128</span><span class="o">-</span><span class="n">cts</span> +<span class="n">set_string</span> <span class="n">user</span><span class="nd">@FOO</span><span class="o">.</span><span class="n">COM</span> <span class="n">otp</span> <span class="s2">"[{""type"":""hotp"",""username"":""al""}]"</span> </pre></div> </div> </div> <div class="section" id="del-string"> -<span id="set-string-end"></span><span id="id11"></span><h3>del_string<a class="headerlink" href="#del-string" title="Permalink to this headline">¶</a></h3> +<span id="id11"></span><h3>del_string<a class="headerlink" href="#del-string" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>del_string</strong> <em>principal</em> <em>key</em></div></blockquote> <p>Deletes a string attribute from <em>principal</em>.</p> @@ -611,7 +620,7 @@ set_string user@FOO.COM otp "[{""type"":""hot <p>Alias: <strong>delstr</strong></p> </div> <div class="section" id="add-policy"> -<span id="del-string-end"></span><span id="id12"></span><h3>add_policy<a class="headerlink" href="#add-policy" title="Permalink to this headline">¶</a></h3> +<span id="id12"></span><h3>add_policy<a class="headerlink" href="#add-policy" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>add_policy</strong> [<em>options</em>] <em>policy</em></div></blockquote> <p>Adds a password policy named <em>policy</em> to the database.</p> @@ -620,10 +629,10 @@ set_string user@FOO.COM otp "[{""type"":""hot <p>The following options are available:</p> <dl class="docutils"> <dt><strong>-maxlife</strong> <em>time</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) Sets the maximum +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) Sets the maximum lifetime of a password.</dd> <dt><strong>-minlife</strong> <em>time</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) Sets the minimum +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) Sets the minimum lifetime of a password.</dd> <dt><strong>-minlength</strong> <em>length</em></dt> <dd>Sets the minimum length of a password.</dd> @@ -645,7 +654,7 @@ resets to 0 after a successful attempt to authenticate. A </dl> <dl class="docutils" id="policy-failurecountinterval"> <dt><strong>-failurecountinterval</strong> <em>failuretime</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) Sets the allowable time +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) Sets the allowable time between authentication failures. If an authentication failure happens after <em>failuretime</em> has elapsed since the previous failure, the number of authentication failures is reset to 1. A @@ -653,28 +662,28 @@ failure, the number of authentication failures is reset to 1. A </dl> <dl class="docutils" id="policy-lockoutduration"> <dt><strong>-lockoutduration</strong> <em>lockouttime</em></dt> -<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string) Sets the duration for +<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> or <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string) Sets the duration for which the principal is locked from authenticating if too many authentication failures occur without the specified failure count interval elapsing. A duration of 0 (the default) means the principal remains locked out until it is administratively unlocked -with <tt class="docutils literal"><span class="pre">modprinc</span> <span class="pre">-unlock</span></tt>.</dd> +with <code class="docutils literal"><span class="pre">modprinc</span> <span class="pre">-unlock</span></code>.</dd> <dt><strong>-allowedkeysalts</strong></dt> <dd>Specifies the key/salt tuples supported for long-term keys when -setting or changing a principal’s password/keys. See -<a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><em>Keysalt lists</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a list of the +setting or changing a principal’s password/keys. See +<a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><span class="std std-ref">Keysalt lists</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of the accepted values, but note that key/salt tuples must be separated -with commas (‘,’) only. To clear the allowed key/salt policy use -a value of ‘-‘.</dd> +with commas (‘,’) only. To clear the allowed key/salt policy use +a value of ‘-‘.</dd> </dl> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: add_policy -maxlife "2 days" -minlength 5 guests -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">add_policy</span> <span class="o">-</span><span class="n">maxlife</span> <span class="s2">"2 days"</span> <span class="o">-</span><span class="n">minlength</span> <span class="mi">5</span> <span class="n">guests</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="modify-policy"> -<span id="add-policy-end"></span><span id="id13"></span><h3>modify_policy<a class="headerlink" href="#modify-policy" title="Permalink to this headline">¶</a></h3> +<span id="id13"></span><h3>modify_policy<a class="headerlink" href="#modify-policy" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>modify_policy</strong> [<em>options</em>] <em>policy</em></div></blockquote> <p>Modifies the password policy named <em>policy</em>. Options are as described @@ -683,7 +692,7 @@ for <strong>add_policy</strong>.</p> <p>Alias: <strong>modpol</strong></p> </div> <div class="section" id="delete-policy"> -<span id="modify-policy-end"></span><span id="id14"></span><h3>delete_policy<a class="headerlink" href="#delete-policy" title="Permalink to this headline">¶</a></h3> +<span id="id14"></span><h3>delete_policy<a class="headerlink" href="#delete-policy" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>delete_policy</strong> [<strong>-force</strong>] <em>policy</em></div></blockquote> <p>Deletes the password policy named <em>policy</em>. Prompts for confirmation @@ -692,7 +701,7 @@ principals.</p> <p>This command requires the <strong>delete</strong> privilege.</p> <p>Alias: <strong>delpol</strong></p> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: del_policy guests +<div class="highlight-default"><div class="highlight"><pre><span></span>kadmin: del_policy guests Are you sure you want to delete the policy "guests"? (yes/no): yes kadmin: @@ -700,60 +709,60 @@ kadmin: </div> </div> <div class="section" id="get-policy"> -<span id="delete-policy-end"></span><span id="id15"></span><h3>get_policy<a class="headerlink" href="#get-policy" title="Permalink to this headline">¶</a></h3> +<span id="id15"></span><h3>get_policy<a class="headerlink" href="#get-policy" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>get_policy</strong> [ <strong>-terse</strong> ] <em>policy</em></div></blockquote> <p>Displays the values of the password policy named <em>policy</em>. With the <strong>-terse</strong> flag, outputs the fields as quoted strings separated by tabs.</p> <p>This command requires the <strong>inquire</strong> privilege.</p> -<p>Alias: getpol</p> +<p>Alias: <strong>getpol</strong></p> <p>Examples:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: get_policy admin -Policy: admin -Maximum password life: 180 days 00:00:00 -Minimum password life: 00:00:00 -Minimum password length: 6 -Minimum number of password character classes: 2 -Number of old keys kept: 5 -Reference count: 17 +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">get_policy</span> <span class="n">admin</span> +<span class="n">Policy</span><span class="p">:</span> <span class="n">admin</span> +<span class="n">Maximum</span> <span class="n">password</span> <span class="n">life</span><span class="p">:</span> <span class="mi">180</span> <span class="n">days</span> <span class="mi">00</span><span class="p">:</span><span class="mi">00</span><span class="p">:</span><span class="mi">00</span> +<span class="n">Minimum</span> <span class="n">password</span> <span class="n">life</span><span class="p">:</span> <span class="mi">00</span><span class="p">:</span><span class="mi">00</span><span class="p">:</span><span class="mi">00</span> +<span class="n">Minimum</span> <span class="n">password</span> <span class="n">length</span><span class="p">:</span> <span class="mi">6</span> +<span class="n">Minimum</span> <span class="n">number</span> <span class="n">of</span> <span class="n">password</span> <span class="n">character</span> <span class="n">classes</span><span class="p">:</span> <span class="mi">2</span> +<span class="n">Number</span> <span class="n">of</span> <span class="n">old</span> <span class="n">keys</span> <span class="n">kept</span><span class="p">:</span> <span class="mi">5</span> +<span class="n">Reference</span> <span class="n">count</span><span class="p">:</span> <span class="mi">17</span> -kadmin: get_policy -terse admin -admin 15552000 0 6 2 5 17 -kadmin: +<span class="n">kadmin</span><span class="p">:</span> <span class="n">get_policy</span> <span class="o">-</span><span class="n">terse</span> <span class="n">admin</span> +<span class="n">admin</span> <span class="mi">15552000</span> <span class="mi">0</span> <span class="mi">6</span> <span class="mi">2</span> <span class="mi">5</span> <span class="mi">17</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> -<p>The “Reference count” is the number of principals using that policy. +<p>The “Reference count” is the number of principals using that policy. With the LDAP KDC database module, the reference count field is not meaningful.</p> </div> <div class="section" id="list-policies"> -<span id="get-policy-end"></span><span id="id16"></span><h3>list_policies<a class="headerlink" href="#list-policies" title="Permalink to this headline">¶</a></h3> +<span id="id16"></span><h3>list_policies<a class="headerlink" href="#list-policies" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>list_policies</strong> [<em>expression</em>]</div></blockquote> <p>Retrieves all or some policy names. <em>expression</em> is a shell-style -glob expression that can contain the wild-card characters <tt class="docutils literal"><span class="pre">?</span></tt>, -<tt class="docutils literal"><span class="pre">*</span></tt>, and <tt class="docutils literal"><span class="pre">[]</span></tt>. All policy names matching the expression are +glob expression that can contain the wild-card characters <code class="docutils literal"><span class="pre">?</span></code>, +<code class="docutils literal"><span class="pre">*</span></code>, and <code class="docutils literal"><span class="pre">[]</span></code>. All policy names matching the expression are printed. If no expression is provided, all existing policy names are printed.</p> <p>This command requires the <strong>list</strong> privilege.</p> <p>Aliases: <strong>listpols</strong>, <strong>get_policies</strong>, <strong>getpols</strong>.</p> <p>Examples:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: listpols -test-pol -dict-only -once-a-min -test-pol-nopw +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">listpols</span> +<span class="n">test</span><span class="o">-</span><span class="n">pol</span> +<span class="nb">dict</span><span class="o">-</span><span class="n">only</span> +<span class="n">once</span><span class="o">-</span><span class="n">a</span><span class="o">-</span><span class="nb">min</span> +<span class="n">test</span><span class="o">-</span><span class="n">pol</span><span class="o">-</span><span class="n">nopw</span> -kadmin: listpols t* -test-pol -test-pol-nopw -kadmin: +<span class="n">kadmin</span><span class="p">:</span> <span class="n">listpols</span> <span class="n">t</span><span class="o">*</span> +<span class="n">test</span><span class="o">-</span><span class="n">pol</span> +<span class="n">test</span><span class="o">-</span><span class="n">pol</span><span class="o">-</span><span class="n">nopw</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="ktadd"> -<span id="list-policies-end"></span><span id="id17"></span><h3>ktadd<a class="headerlink" href="#ktadd" title="Permalink to this headline">¶</a></h3> +<span id="id17"></span><h3>ktadd<a class="headerlink" href="#ktadd" title="Permalink to this headline">¶</a></h3> <blockquote> <div><div class="line-block"> <div class="line"><strong>ktadd</strong> [options] <em>principal</em></div> @@ -761,7 +770,7 @@ kadmin: </div> </div></blockquote> <p>Adds a <em>principal</em>, or all principals matching <em>princ-exp</em>, to a -keytab file. Each principal’s keys are randomized in the process. +keytab file. Each principal’s keys are randomized in the process. The rules for <em>princ-exp</em> are described in the <strong>list_principals</strong> command.</p> <p>This command requires the <strong>inquire</strong> and <strong>changepw</strong> privileges. @@ -771,9 +780,9 @@ With the <strong>-glob</strong> form, it also requires the <strong>list</strong> <dt><strong>-k[eytab]</strong> <em>keytab</em></dt> <dd>Use <em>keytab</em> as the keytab file. Otherwise, the default keytab is used.</dd> -<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,...</dt> +<dt><strong>-e</strong> <em>enc</em>:<em>salt</em>,…</dt> <dd>Uses the specified keysalt list for setting the new keys of the -principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><em>Keysalt lists</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a +principal. See <a class="reference internal" href="../conf_files/kdc_conf.html#keysalt-lists"><span class="std std-ref">Keysalt lists</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of possible values.</dd> <dt><strong>-q</strong></dt> <dd>Display less verbose information.</dd> @@ -782,26 +791,27 @@ list of possible values.</dd> unchanged. This option cannot be specified in combination with the <strong>-e</strong> option.</dd> </dl> -<p>An entry for each of the principal’s unique encryption types is added, +<p>An entry for each of the principal’s unique encryption types is added, ignoring multiple keys with the same encryption type but different salt types.</p> +<p>Alias: <strong>xst</strong></p> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu -Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3, - encryption type aes256-cts-hmac-sha1-96 added to keytab - FILE:/tmp/foo-new-keytab -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">ktadd</span> <span class="o">-</span><span class="n">k</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">foo</span><span class="o">-</span><span class="n">new</span><span class="o">-</span><span class="n">keytab</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">host</span><span class="o">/</span><span class="n">foo</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">3</span><span class="p">,</span> + <span class="n">encryption</span> <span class="nb">type</span> <span class="n">aes256</span><span class="o">-</span><span class="n">cts</span><span class="o">-</span><span class="n">hmac</span><span class="o">-</span><span class="n">sha1</span><span class="o">-</span><span class="mi">96</span> <span class="n">added</span> <span class="n">to</span> <span class="n">keytab</span> + <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">foo</span><span class="o">-</span><span class="n">new</span><span class="o">-</span><span class="n">keytab</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="ktremove"> -<span id="ktadd-end"></span><span id="id18"></span><h3>ktremove<a class="headerlink" href="#ktremove" title="Permalink to this headline">¶</a></h3> +<span id="id18"></span><h3>ktremove<a class="headerlink" href="#ktremove" title="Permalink to this headline">¶</a></h3> <blockquote> <div><strong>ktremove</strong> [options] <em>principal</em> [<em>kvno</em> | <em>all</em> | <em>old</em>]</div></blockquote> <p>Removes entries for the specified <em>principal</em> from a keytab. Requires no permissions, since this does not require database access.</p> -<p>If the string “all” is specified, all entries for that principal are -removed; if the string “old” is specified, all entries for that +<p>If the string “all” is specified, all entries for that principal are +removed; if the string “old” is specified, all entries for that principal except those with the highest kvno are removed. Otherwise, the value specified is parsed as an integer, and all entries whose kvno match that integer are removed.</p> @@ -813,16 +823,17 @@ used.</dd> <dt><strong>-q</strong></dt> <dd>Display less verbose information.</dd> </dl> +<p>Alias: <strong>ktrem</strong></p> <p>Example:</p> -<div class="highlight-python"><div class="highlight"><pre>kadmin: ktremove kadmin/admin all -Entry for principal kadmin/admin with kvno 3 removed from keytab - FILE:/etc/krb5.keytab -kadmin: +<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">kadmin</span><span class="p">:</span> <span class="n">ktremove</span> <span class="n">kadmin</span><span class="o">/</span><span class="n">admin</span> <span class="nb">all</span> +<span class="n">Entry</span> <span class="k">for</span> <span class="n">principal</span> <span class="n">kadmin</span><span class="o">/</span><span class="n">admin</span> <span class="k">with</span> <span class="n">kvno</span> <span class="mi">3</span> <span class="n">removed</span> <span class="kn">from</span> <span class="nn">keytab</span> + <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">.</span><span class="n">keytab</span> +<span class="n">kadmin</span><span class="p">:</span> </pre></div> </div> </div> <div class="section" id="lock"> -<span id="ktremove-end"></span><h3>lock<a class="headerlink" href="#lock" title="Permalink to this headline">¶</a></h3> +<h3>lock<a class="headerlink" href="#lock" title="Permalink to this headline">¶</a></h3> <p>Lock database exclusively. Use with extreme caution! This command only works with the DB2 KDC database module.</p> </div> @@ -846,9 +857,14 @@ only works with the DB2 KDC database module.</p> <p>The kadmin program was originally written by Tom Yu at MIT, as an interface to the OpenVision Kerberos administration program.</p> </div> +<div class="section" id="environment"> +<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2> +<p>See <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment +variables.</p> +</div> <div class="section" id="see-also"> <h2>SEE ALSO<a class="headerlink" href="#see-also" title="Permalink to this headline">¶</a></h2> -<p><a class="reference internal" href="../../user/user_commands/kpasswd.html#kpasswd-1"><em>kpasswd</em></a>, <a class="reference internal" href="kadmind.html#kadmind-8"><em>kadmind</em></a></p> +<p><a class="reference internal" href="../../user/user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>, <a class="reference internal" href="kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p> </div> </div> @@ -891,6 +907,7 @@ interface to the OpenVision Kerberos administration program.</p> </ul> </li> <li><a class="reference internal" href="#history">HISTORY</a></li> +<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li> <li><a class="reference internal" href="#see-also">SEE ALSO</a></li> </ul> </li> @@ -905,6 +922,7 @@ interface to the OpenVision Kerberos administration program.</p> <li class="toctree-l2"><a class="reference internal" href="../conf_files/index.html">Configuration Files</a></li> <li class="toctree-l2"><a class="reference internal" href="../realm_config.html">Realm configuration decisions</a></li> <li class="toctree-l2"><a class="reference internal" href="../database.html">Database administration</a></li> +<li class="toctree-l2"><a class="reference internal" href="../dbtypes.html">Database types</a></li> <li class="toctree-l2"><a class="reference internal" href="../lockout.html">Account lockout</a></li> <li class="toctree-l2"><a class="reference internal" href="../conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> <li class="toctree-l2"><a class="reference internal" href="../appl_servers.html">Application servers</a></li> @@ -912,12 +930,14 @@ interface to the OpenVision Kerberos administration program.</p> <li class="toctree-l2"><a class="reference internal" href="../backup_host.html">Backups of secure hosts</a></li> <li class="toctree-l2"><a class="reference internal" href="../pkinit.html">PKINIT configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="../otp.html">OTP Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="../spake.html">SPAKE Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="../dictionary.html">Addressing dictionary attack risks</a></li> <li class="toctree-l2"><a class="reference internal" href="../princ_dns.html">Principal names and DNS</a></li> <li class="toctree-l2"><a class="reference internal" href="../enctypes.html">Encryption types</a></li> <li class="toctree-l2"><a class="reference internal" href="../https.html">HTTPS proxy configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="../auth_indicator.html">Authentication indicators</a></li> <li class="toctree-l2 current"><a class="reference internal" href="index.html">Administration programs</a><ul class="current"> -<li class="toctree-l3 current"><a class="current reference internal" href="">kadmin</a></li> +<li class="toctree-l3 current"><a class="current reference internal" href="#">kadmin</a></li> <li class="toctree-l3"><a class="reference internal" href="kadmind.html">kadmind</a></li> <li class="toctree-l3"><a class="reference internal" href="kdb5_util.html">kdb5_util</a></li> <li class="toctree-l3"><a class="reference internal" href="kdb5_ldap_util.html">kdb5_ldap_util</a></li> @@ -964,8 +984,8 @@ interface to the OpenVision Kerberos administration program.</p> <div class="footer-wrapper"> <div class="footer" > - <div class="right" ><i>Release: 1.16</i><br /> - © <a href="../../copyright.html">Copyright</a> 1985-2017, MIT. + <div class="right" ><i>Release: 1.21.1</i><br /> + © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT. </div> <div class="left"> |