diff options
Diffstat (limited to 'doc/html/admin/admin_commands/kdb5_util.html')
| -rw-r--r-- | doc/html/admin/admin_commands/kdb5_util.html | 147 |
1 files changed, 77 insertions, 70 deletions
diff --git a/doc/html/admin/admin_commands/kdb5_util.html b/doc/html/admin/admin_commands/kdb5_util.html index 87493732a708..dcd33e4f9fe4 100644 --- a/doc/html/admin/admin_commands/kdb5_util.html +++ b/doc/html/admin/admin_commands/kdb5_util.html @@ -1,33 +1,31 @@ + <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd"> - <html xmlns="http://www.w3.org/1999/xhtml"> <head> <meta http-equiv="Content-Type" content="text/html; charset=utf-8" /> - - <title>kdb5_util — MIT Kerberos Documentation</title> - + <title>kdb5_util — MIT Kerberos Documentation</title> <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" /> <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" /> <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" /> - <script type="text/javascript"> var DOCUMENTATION_OPTIONS = { URL_ROOT: '../../', - VERSION: '1.16', + VERSION: '1.21.1', COLLAPSE_INDEX: false, FILE_SUFFIX: '.html', - HAS_SOURCE: true + HAS_SOURCE: true, + SOURCELINK_SUFFIX: '.txt' }; </script> <script type="text/javascript" src="../../_static/jquery.js"></script> <script type="text/javascript" src="../../_static/underscore.js"></script> <script type="text/javascript" src="../../_static/doctools.js"></script> <link rel="author" title="About these documents" href="../../about.html" /> + <link rel="index" title="Index" href="../../genindex.html" /> + <link rel="search" title="Search" href="../../search.html" /> <link rel="copyright" title="Copyright" href="../../copyright.html" /> - <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" /> - <link rel="up" title="Administration programs" href="index.html" /> <link rel="next" title="kdb5_ldap_util" href="kdb5_ldap_util.html" /> <link rel="prev" title="kadmind" href="kadmind.html" /> </head> @@ -61,7 +59,7 @@ <div class="documentwrapper"> <div class="bodywrapper"> - <div class="body"> + <div class="body" role="main"> <div class="section" id="kdb5-util"> <span id="kdb5-util-8"></span><h1>kdb5_util<a class="headerlink" href="#kdb5-util" title="Permalink to this headline">¶</a></h1> @@ -71,10 +69,12 @@ [<strong>-r</strong> <em>realm</em>] [<strong>-d</strong> <em>dbname</em>] [<strong>-k</strong> <em>mkeytype</em>] -[<strong>-M</strong> <em>mkeyname</em>] [<strong>-kv</strong> <em>mkeyVNO</em>] -[<strong>-sf</strong> <em>stashfilename</em>] +[<strong>-M</strong> <em>mkeyname</em>] [<strong>-m</strong>] +[<strong>-sf</strong> <em>stashfilename</em>] +[<strong>-P</strong> <em>password</em>] +[<strong>-x</strong> <em>db_args</em>] <em>command</em> [<em>command_options</em>]</p> </div> <div class="section" id="description"> @@ -97,31 +97,34 @@ commands.</p> <dd>specifies the Kerberos realm of the database.</dd> <dt><strong>-d</strong> <em>dbname</em></dt> <dd>specifies the name under which the principal database is stored; -by default the database is that listed in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>. The +by default the database is that listed in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>. The password policy database and lock files are also derived from this value.</dd> <dt><strong>-k</strong> <em>mkeytype</em></dt> <dd>specifies the key type of the master key in the database. The default is given by the <strong>master_key_type</strong> variable in -<a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>.</dd> +<a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>.</dd> <dt><strong>-kv</strong> <em>mkeyVNO</em></dt> <dd>Specifies the version number of the master key in the database; the default is 1. Note that 0 is not allowed.</dd> <dt><strong>-M</strong> <em>mkeyname</em></dt> <dd>principal name for the master key in the database. If not specified, the name is determined by the <strong>master_key_name</strong> -variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>.</dd> +variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>.</dd> <dt><strong>-m</strong></dt> <dd>specifies that the master database password should be read from the keyboard rather than fetched from a file on disk.</dd> <dt><strong>-sf</strong> <em>stash_file</em></dt> <dd>specifies the stash filename of the master database password. If not specified, the filename is determined by the -<strong>key_stash_file</strong> variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>.</dd> +<strong>key_stash_file</strong> variable in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>.</dd> <dt><strong>-P</strong> <em>password</em></dt> <dd>specifies the master database password. Using this option may expose the password to other users on the system via the process list.</dd> +<dt><strong>-x</strong> <em>db_args</em></dt> +<dd>specifies database-specific options. See <a class="reference internal" href="kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> for +supported options.</dd> </dl> </div> <div class="section" id="commands"> @@ -147,34 +150,33 @@ the <strong>-f</strong> argument, does not prompt the user.</p> <span id="kdb5-util-destroy-end"></span><h3>stash<a class="headerlink" href="#stash" title="Permalink to this headline">¶</a></h3> <blockquote id="kdb5-util-stash"> <div><strong>stash</strong> [<strong>-f</strong> <em>keyfile</em>]</div></blockquote> -<p>Stores the master principal’s keys in a stash file. The <strong>-f</strong> +<p>Stores the master principal’s keys in a stash file. The <strong>-f</strong> argument can be used to override the <em>keyfile</em> specified in -<a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a>.</p> +<a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>.</p> </div> <div class="section" id="dump"> <span id="kdb5-util-stash-end"></span><h3>dump<a class="headerlink" href="#dump" title="Permalink to this headline">¶</a></h3> <blockquote id="kdb5-util-dump"> -<div><strong>dump</strong> [<strong>-b7</strong>|<strong>-ov</strong>|<strong>-r13</strong>] [<strong>-verbose</strong>] -[<strong>-mkey_convert</strong>] [<strong>-new_mkey_file</strong> <em>mkey_file</em>] [<strong>-rev</strong>] -[<strong>-recurse</strong>] [<em>filename</em> [<em>principals</em>...]]</div></blockquote> +<div><strong>dump</strong> [<strong>-b7</strong>|<strong>-r13</strong>|<strong>-r18</strong>] +[<strong>-verbose</strong>] [<strong>-mkey_convert</strong>] [<strong>-new_mkey_file</strong> +<em>mkey_file</em>] [<strong>-rev</strong>] [<strong>-recurse</strong>] [<em>filename</em> +[<em>principals</em>…]]</div></blockquote> <p>Dumps the current Kerberos and KADM5 database into an ASCII file. By -default, the database is dumped in current format, “kdb5_util -load_dump version 7”. If filename is not specified, or is the string -“-”, the dump is sent to standard output. Options:</p> +default, the database is dumped in current format, “kdb5_util +load_dump version 7”. If filename is not specified, or is the string +“-“, the dump is sent to standard output. Options:</p> <dl class="docutils"> <dt><strong>-b7</strong></dt> -<dd>causes the dump to be in the Kerberos 5 Beta 7 format (“kdb5_util -load_dump version 4”). This was the dump format produced on +<dd>causes the dump to be in the Kerberos 5 Beta 7 format (“kdb5_util +load_dump version 4”). This was the dump format produced on releases prior to 1.2.2.</dd> -<dt><strong>-ov</strong></dt> -<dd>causes the dump to be in “ovsec_adm_export” format.</dd> <dt><strong>-r13</strong></dt> -<dd>causes the dump to be in the Kerberos 5 1.3 format (“kdb5_util -load_dump version 5”). This was the dump format produced on +<dd>causes the dump to be in the Kerberos 5 1.3 format (“kdb5_util +load_dump version 5”). This was the dump format produced on releases prior to 1.8.</dd> <dt><strong>-r18</strong></dt> -<dd>causes the dump to be in the Kerberos 5 1.8 format (“kdb5_util -load_dump version 6”). This was the dump format produced on +<dd>causes the dump to be in the Kerberos 5 1.8 format (“kdb5_util +load_dump version 6”). This was the dump format produced on releases prior to 1.11.</dd> <dt><strong>-verbose</strong></dt> <dd>causes the name of each principal and policy to be printed as it @@ -210,8 +212,8 @@ doing a normal dump instead of a recursive traversal.</p> <div class="section" id="load"> <span id="kdb5-util-dump-end"></span><h3>load<a class="headerlink" href="#load" title="Permalink to this headline">¶</a></h3> <blockquote id="kdb5-util-load"> -<div><strong>load</strong> [<strong>-b7</strong>|<strong>-ov</strong>|<strong>-r13</strong>] [<strong>-hash</strong>] -[<strong>-verbose</strong>] [<strong>-update</strong>] <em>filename</em> [<em>dbname</em>]</div></blockquote> +<div><strong>load</strong> [<strong>-b7</strong>|<strong>-r13</strong>|<strong>-r18</strong>] [<strong>-hash</strong>] +[<strong>-verbose</strong>] [<strong>-update</strong>] <em>filename</em></div></blockquote> <p>Loads a database dump from the named file into the named database. If no option is given to determine the format of the dump file, the format is detected automatically and handled as appropriate. Unless @@ -223,24 +225,22 @@ database module, the <strong>-update</strong> flag is required.</p> <dl class="docutils"> <dt><strong>-b7</strong></dt> <dd>requires the database to be in the Kerberos 5 Beta 7 format -(“kdb5_util load_dump version 4”). This was the dump format +(“kdb5_util load_dump version 4”). This was the dump format produced on releases prior to 1.2.2.</dd> -<dt><strong>-ov</strong></dt> -<dd>requires the database to be in “ovsec_adm_import” format. Must be -used with the <strong>-update</strong> option.</dd> <dt><strong>-r13</strong></dt> -<dd>requires the database to be in Kerberos 5 1.3 format (“kdb5_util -load_dump version 5”). This was the dump format produced on +<dd>requires the database to be in Kerberos 5 1.3 format (“kdb5_util +load_dump version 5”). This was the dump format produced on releases prior to 1.8.</dd> <dt><strong>-r18</strong></dt> -<dd>requires the database to be in Kerberos 5 1.8 format (“kdb5_util -load_dump version 6”). This was the dump format produced on +<dd>requires the database to be in Kerberos 5 1.8 format (“kdb5_util +load_dump version 6”). This was the dump format produced on releases prior to 1.11.</dd> <dt><strong>-hash</strong></dt> -<dd>requires the database to be stored as a hash. If this option is -not specified, the database will be stored as a btree. This -option is not recommended, as databases stored in hash format are -known to corrupt data and lose principals.</dd> +<dd>stores the database in hash format, if using the DB2 database +type. If this option is not specified, the database will be +stored in btree format. This option is not recommended, as +databases stored in hash format are known to corrupt data and lose +principals.</dd> <dt><strong>-verbose</strong></dt> <dd>causes the name of each principal and policy to be printed as it is dumped.</dd> @@ -250,13 +250,11 @@ database. Otherwise, a new database is created containing only what is in the dump file and the old one destroyed upon successful completion.</dd> </dl> -<p>If specified, <em>dbname</em> overrides the value specified on the command -line or the default.</p> </div> <div class="section" id="ark"> <span id="kdb5-util-load-end"></span><h3>ark<a class="headerlink" href="#ark" title="Permalink to this headline">¶</a></h3> <blockquote> -<div><strong>ark</strong> [<strong>-e</strong> <em>enc</em>:<em>salt</em>,...] <em>principal</em></div></blockquote> +<div><strong>ark</strong> [<strong>-e</strong> <em>enc</em>:<em>salt</em>,…] <em>principal</em></div></blockquote> <p>Adds new random keys to <em>principal</em> at the next available key version number. Keys for the current highest key version number will be preserved. The <strong>-e</strong> option specifies the list of encryption and @@ -269,12 +267,12 @@ salt types to be used for the new keys.</p> <p>Adds a new master key to the master key principal, but does not mark it as active. Existing master keys will remain. The <strong>-e</strong> option specifies the encryption type of the new master key; see -<a class="reference internal" href="../conf_files/kdc_conf.html#encryption-types"><em>Encryption types</em></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><em>kdc.conf</em></a> for a list of possible +<a class="reference internal" href="../conf_files/kdc_conf.html#encryption-types"><span class="std std-ref">Encryption types</span></a> in <a class="reference internal" href="../conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> for a list of possible values. The <strong>-s</strong> option stashes the new master key in the stash -file, which will be created if it doesn’t already exist.</p> -<p>After a new master key is added, it should be propagated to slave -servers via a manual or periodic invocation of <a class="reference internal" href="kprop.html#kprop-8"><em>kprop</em></a>. Then, -the stash files on the slave servers should be updated with the +file, which will be created if it doesn’t already exist.</p> +<p>After a new master key is added, it should be propagated to replica +servers via a manual or periodic invocation of <a class="reference internal" href="kprop.html#kprop-8"><span class="std std-ref">kprop</span></a>. Then, +the stash files on the replica servers should be updated with the kdb5_util <strong>stash</strong> command. Once those steps are complete, the key is ready to be marked active with the kdb5_util <strong>use_mkey</strong> command.</p> </div> @@ -286,7 +284,7 @@ is ready to be marked active with the kdb5_util <strong>use_mkey</strong> comman Once a master key becomes active, it will be used to encrypt newly created principal keys. If no <em>time</em> argument is given, the current time is used, causing the specified master key version to become -active immediately. The format for <em>time</em> is <a class="reference internal" href="../../basic/date_format.html#getdate"><em>getdate time</em></a> string.</p> +active immediately. The format for <em>time</em> is <a class="reference internal" href="../../basic/date_format.html#getdate"><span class="std std-ref">getdate time</span></a> string.</p> <p>After a new master key becomes active, the kdb5_util <strong>update_princ_encryption</strong> command can be used to update all principal keys to be encrypted in the new master key.</p> @@ -297,8 +295,8 @@ principal keys to be encrypted in the new master key.</p> <div><strong>list_mkeys</strong></div></blockquote> <p>List all master keys, from most recent to earliest, in the master key principal. The output will show the kvno, enctype, and salt type for -each mkey, similar to the output of <a class="reference internal" href="kadmin_local.html#kadmin-1"><em>kadmin</em></a> <strong>getprinc</strong>. A -<tt class="docutils literal"><span class="pre">*</span></tt> following an mkey denotes the currently active master key.</p> +each mkey, similar to the output of <a class="reference internal" href="kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a> <strong>getprinc</strong>. A +<code class="docutils literal"><span class="pre">*</span></code> following an mkey denotes the currently active master key.</p> </div> <div class="section" id="purge-mkeys"> <h3>purge_mkeys<a class="headerlink" href="#purge-mkeys" title="Permalink to this headline">¶</a></h3> @@ -354,7 +352,7 @@ below).</p> instead of the default tab-separated (unquoted, unescaped) format</dd> <dt><strong>-e</strong></dt> <dd>write empty hexadecimal string fields as empty fields instead of -as “-1”.</dd> +as “-1”.</dd> <dt><strong>-n</strong></dt> <dd>produce numeric output for fields that normally have symbolic output, such as enctypes and flag names. Also requests output of @@ -372,7 +370,7 @@ output</dd> <dt><strong>name</strong></dt> <dd>principal name</dd> <dt><strong>keyindex</strong></dt> -<dd>index of this key in the principal’s key list</dd> +<dd>index of this key in the principal’s key list</dd> <dt><strong>kvno</strong></dt> <dd>key version number</dd> <dt><strong>enctype</strong></dt> @@ -432,7 +430,7 @@ set.</p> <dd>policy object name</dd> <dt><strong>mkvno</strong></dt> <dd>key version number of the master key that encrypts this -principal’s key data</dd> +principal’s key data</dd> <dt><strong>hist_kvno</strong></dt> <dd>key version number of the history key that encrypts the key history data for this principal</dd> @@ -467,27 +465,32 @@ lifetimes</p> </dd> </dl> <p>Examples:</p> -<div class="highlight-python"><div class="highlight"><pre>$ kdb5_util tabdump -o keyinfo.txt keyinfo +<div class="highlight-default"><div class="highlight"><pre><span></span>$ kdb5_util tabdump -o keyinfo.txt keyinfo $ cat keyinfo.txt name keyindex kvno enctype salttype salt +K/M@EXAMPLE.COM 0 1 aes256-cts-hmac-sha384-192 normal -1 foo@EXAMPLE.COM 0 1 aes128-cts-hmac-sha1-96 normal -1 bar@EXAMPLE.COM 0 1 aes128-cts-hmac-sha1-96 normal -1 -bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 $ sqlite3 sqlite> .mode tabs sqlite> .import keyinfo.txt keyinfo -sqlite> select * from keyinfo where enctype like 'des-cbc-%'; -bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 +sqlite> select * from keyinfo where enctype like 'aes256-%'; +K/M@EXAMPLE.COM 1 1 aes256-cts-hmac-sha384-192 normal -1 sqlite> .quit -$ awk -F'\t' '$4 ~ /des-cbc-/ { print }' keyinfo.txt -bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 +$ awk -F'\t' '$4 ~ /aes256-/ { print }' keyinfo.txt +K/M@EXAMPLE.COM 1 1 aes256-cts-hmac-sha384-192 normal -1 </pre></div> </div> </div> </div> +<div class="section" id="environment"> +<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2> +<p>See <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment +variables.</p> +</div> <div class="section" id="see-also"> <h2>SEE ALSO<a class="headerlink" href="#see-also" title="Permalink to this headline">¶</a></h2> -<p><a class="reference internal" href="kadmin_local.html#kadmin-1"><em>kadmin</em></a></p> +<p><a class="reference internal" href="kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>, <a class="reference internal" href="../../user/user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p> </div> </div> @@ -518,6 +521,7 @@ bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 <li><a class="reference internal" href="#tabdump">tabdump</a></li> </ul> </li> +<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li> <li><a class="reference internal" href="#see-also">SEE ALSO</a></li> </ul> </li> @@ -532,6 +536,7 @@ bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 <li class="toctree-l2"><a class="reference internal" href="../conf_files/index.html">Configuration Files</a></li> <li class="toctree-l2"><a class="reference internal" href="../realm_config.html">Realm configuration decisions</a></li> <li class="toctree-l2"><a class="reference internal" href="../database.html">Database administration</a></li> +<li class="toctree-l2"><a class="reference internal" href="../dbtypes.html">Database types</a></li> <li class="toctree-l2"><a class="reference internal" href="../lockout.html">Account lockout</a></li> <li class="toctree-l2"><a class="reference internal" href="../conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> <li class="toctree-l2"><a class="reference internal" href="../appl_servers.html">Application servers</a></li> @@ -539,6 +544,8 @@ bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 <li class="toctree-l2"><a class="reference internal" href="../backup_host.html">Backups of secure hosts</a></li> <li class="toctree-l2"><a class="reference internal" href="../pkinit.html">PKINIT configuration</a></li> <li class="toctree-l2"><a class="reference internal" href="../otp.html">OTP Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="../spake.html">SPAKE Preauthentication</a></li> +<li class="toctree-l2"><a class="reference internal" href="../dictionary.html">Addressing dictionary attack risks</a></li> <li class="toctree-l2"><a class="reference internal" href="../princ_dns.html">Principal names and DNS</a></li> <li class="toctree-l2"><a class="reference internal" href="../enctypes.html">Encryption types</a></li> <li class="toctree-l2"><a class="reference internal" href="../https.html">HTTPS proxy configuration</a></li> @@ -546,7 +553,7 @@ bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 <li class="toctree-l2 current"><a class="reference internal" href="index.html">Administration programs</a><ul class="current"> <li class="toctree-l3"><a class="reference internal" href="kadmin_local.html">kadmin</a></li> <li class="toctree-l3"><a class="reference internal" href="kadmind.html">kadmind</a></li> -<li class="toctree-l3 current"><a class="current reference internal" href="">kdb5_util</a></li> +<li class="toctree-l3 current"><a class="current reference internal" href="#">kdb5_util</a></li> <li class="toctree-l3"><a class="reference internal" href="kdb5_ldap_util.html">kdb5_ldap_util</a></li> <li class="toctree-l3"><a class="reference internal" href="krb5kdc.html">krb5kdc</a></li> <li class="toctree-l3"><a class="reference internal" href="kprop.html">kprop</a></li> @@ -591,8 +598,8 @@ bar@EXAMPLE.COM 1 1 des-cbc-crc normal -1 <div class="footer-wrapper"> <div class="footer" > - <div class="right" ><i>Release: 1.16</i><br /> - © <a href="../../copyright.html">Copyright</a> 1985-2017, MIT. + <div class="right" ><i>Release: 1.21.1</i><br /> + © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT. </div> <div class="left"> |