| 1 |
|
|---|
| 2 | KADMIN(8) BSD System Manager's Manual KADMIN(8)
|
|---|
| 3 |
|
|---|
| 4 | NNAAMMEE
|
|---|
| 5 | kkaaddmmiinn -- Kerberos administration utility
|
|---|
| 6 |
|
|---|
| 7 | SSYYNNOOPPSSIISS
|
|---|
| 8 | kkaaddmmiinn [--pp _s_t_r_i_n_g | ----pprriinncciippaall==_s_t_r_i_n_g] [--KK _s_t_r_i_n_g | ----kkeeyyttaabb==_s_t_r_i_n_g]
|
|---|
| 9 | [--cc _f_i_l_e | ----ccoonnffiigg--ffiillee==_f_i_l_e] [--kk _f_i_l_e | ----kkeeyy--ffiillee==_f_i_l_e]
|
|---|
| 10 | [--rr _r_e_a_l_m | ----rreeaallmm==_r_e_a_l_m] [--aa _h_o_s_t | ----aaddmmiinn--sseerrvveerr==_h_o_s_t]
|
|---|
| 11 | [--ss _p_o_r_t _n_u_m_b_e_r | ----sseerrvveerr--ppoorrtt==_p_o_r_t _n_u_m_b_e_r] [--ll | ----llooccaall]
|
|---|
| 12 | [--hh | ----hheellpp] [--vv | ----vveerrssiioonn] [_c_o_m_m_a_n_d]
|
|---|
| 13 |
|
|---|
| 14 | DDEESSCCRRIIPPTTIIOONN
|
|---|
| 15 | The kkaaddmmiinn program is used to make modifications to the Kerberos data-
|
|---|
| 16 | base, either remotely via the kadmind(8) daemon, or locally (with the --ll
|
|---|
| 17 | option).
|
|---|
| 18 |
|
|---|
| 19 | Supported options:
|
|---|
| 20 |
|
|---|
| 21 | --pp _s_t_r_i_n_g, ----pprriinncciippaall==_s_t_r_i_n_g
|
|---|
| 22 | principal to authenticate as
|
|---|
| 23 |
|
|---|
| 24 | --KK _s_t_r_i_n_g, ----kkeeyyttaabb==_s_t_r_i_n_g
|
|---|
| 25 | keytab for authentication principal
|
|---|
| 26 |
|
|---|
| 27 | --cc _f_i_l_e, ----ccoonnffiigg--ffiillee==_f_i_l_e
|
|---|
| 28 | location of config file
|
|---|
| 29 |
|
|---|
| 30 | --kk _f_i_l_e, ----kkeeyy--ffiillee==_f_i_l_e
|
|---|
| 31 | location of master key file
|
|---|
| 32 |
|
|---|
| 33 | --rr _r_e_a_l_m, ----rreeaallmm==_r_e_a_l_m
|
|---|
| 34 | realm to use
|
|---|
| 35 |
|
|---|
| 36 | --aa _h_o_s_t, ----aaddmmiinn--sseerrvveerr==_h_o_s_t
|
|---|
| 37 | server to contact
|
|---|
| 38 |
|
|---|
| 39 | --ss _p_o_r_t _n_u_m_b_e_r, ----sseerrvveerr--ppoorrtt==_p_o_r_t _n_u_m_b_e_r
|
|---|
| 40 | port to use
|
|---|
| 41 |
|
|---|
| 42 | --ll, ----llooccaall
|
|---|
| 43 | local admin mode
|
|---|
| 44 |
|
|---|
| 45 | If no _c_o_m_m_a_n_d is given on the command line, kkaaddmmiinn will prompt for com-
|
|---|
| 46 | mands to process. Some of the commands that take one or more principals
|
|---|
| 47 | as argument (ddeelleettee, eexxtt__kkeeyyttaabb, ggeett, mmooddiiffyy, and ppaasssswwdd) will accept a
|
|---|
| 48 | glob style wildcard, and perform the operation on all matching princi-
|
|---|
| 49 | pals.
|
|---|
| 50 |
|
|---|
| 51 | Commands include:
|
|---|
| 52 |
|
|---|
| 53 | aadddd [--rr | ----rraannddoomm--kkeeyy] [----rraannddoomm--ppaasssswwoorrdd] [--pp _s_t_r_i_n_g |
|
|---|
| 54 | ----ppaasssswwoorrdd==_s_t_r_i_n_g] [----kkeeyy==_s_t_r_i_n_g] [----mmaaxx--ttiicckkeett--lliiffee==_l_i_f_e_t_i_m_e]
|
|---|
| 55 | [----mmaaxx--rreenneewwaabbllee--lliiffee==_l_i_f_e_t_i_m_e] [----aattttrriibbuutteess==_a_t_t_r_i_b_u_t_e_s]
|
|---|
| 56 | [----eexxppiirraattiioonn--ttiimmee==_t_i_m_e] [----ppww--eexxppiirraattiioonn--ttiimmee==_t_i_m_e] _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 57 |
|
|---|
| 58 | Adds a new principal to the database. The options not passed on the
|
|---|
| 59 | command line will be promped for.
|
|---|
| 60 |
|
|---|
| 61 | aadddd__eennccttyyppee [--rr | ----rraannddoomm--kkeeyy] _p_r_i_n_c_i_p_a_l _e_n_c_t_y_p_e_s_._._.
|
|---|
| 62 |
|
|---|
| 63 | Adds a new encryption type to the principal, only random key are
|
|---|
| 64 | supported.
|
|---|
| 65 |
|
|---|
| 66 | ddeelleettee _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 67 |
|
|---|
| 68 | Removes a principal.
|
|---|
| 69 |
|
|---|
| 70 | ddeell__eennccttyyppee _p_r_i_n_c_i_p_a_l _e_n_c_t_y_p_e_s_._._.
|
|---|
| 71 |
|
|---|
| 72 | Removes some enctypes from a principal; this can be useful if the
|
|---|
| 73 | service belonging to the principal is known to not handle certain
|
|---|
| 74 | enctypes.
|
|---|
| 75 |
|
|---|
| 76 | eexxtt__kkeeyyttaabb [--kk _s_t_r_i_n_g | ----kkeeyyttaabb==_s_t_r_i_n_g] _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 77 |
|
|---|
| 78 | Creates a keytab with the keys of the specified principals.
|
|---|
| 79 |
|
|---|
| 80 | ggeett [--ll | ----lloonngg] [--ss | ----sshhoorrtt] [--tt | ----tteerrssee] [--oo _s_t_r_i_n_g |
|
|---|
| 81 | ----ccoolluummnn--iinnffoo==_s_t_r_i_n_g] _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 82 |
|
|---|
| 83 | Lists the matching principals, short prints the result as a table,
|
|---|
| 84 | while long format produces a more verbose output. Which columns to
|
|---|
| 85 | print can be selected with the --oo option. The argument is a comma
|
|---|
| 86 | separated list of column names optionally appended with an equal
|
|---|
| 87 | sign (`=') and a column header. Which columns are printed by
|
|---|
| 88 | default differ slightly between short and long output.
|
|---|
| 89 |
|
|---|
| 90 | The default terse output format is similar to --ss --oo _p_r_i_n_c_i_p_a_l_=,
|
|---|
| 91 | just printing the names of matched principals.
|
|---|
| 92 |
|
|---|
| 93 | Possible column names include: principal, princ_expire_time,
|
|---|
| 94 | pw_expiration, last_pwd_change, max_life, max_rlife, mod_time,
|
|---|
| 95 | mod_name, attributes, kvno, mkvno, last_success, last_failed,
|
|---|
| 96 | fail_auth_count, policy, and keytypes.
|
|---|
| 97 |
|
|---|
| 98 | mmooddiiffyy [--aa _a_t_t_r_i_b_u_t_e_s | ----aattttrriibbuutteess==_a_t_t_r_i_b_u_t_e_s]
|
|---|
| 99 | [----mmaaxx--ttiicckkeett--lliiffee==_l_i_f_e_t_i_m_e] [----mmaaxx--rreenneewwaabbllee--lliiffee==_l_i_f_e_t_i_m_e]
|
|---|
| 100 | [----eexxppiirraattiioonn--ttiimmee==_t_i_m_e] [----ppww--eexxppiirraattiioonn--ttiimmee==_t_i_m_e] [----kkvvnnoo==_n_u_m_b_e_r]
|
|---|
| 101 | _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 102 |
|
|---|
| 103 | Modifies certain attributes of a principal. If run without command
|
|---|
| 104 | line options, you will be prompted. With command line options, it
|
|---|
| 105 | will only change the ones specified.
|
|---|
| 106 |
|
|---|
| 107 | Possible attributes are: new-princ, support-desmd5,
|
|---|
| 108 | pwchange-service, disallow-svr, requires-pw-change,
|
|---|
| 109 | requires-hw-auth, requires-pre-auth, disallow-all-tix,
|
|---|
| 110 | disallow-dup-skey, disallow-proxiable, disallow-renewable,
|
|---|
| 111 | disallow-tgt-based, disallow-forwardable, disallow-postdated
|
|---|
| 112 |
|
|---|
| 113 | Attributes may be negated with a "-", e.g.,
|
|---|
| 114 |
|
|---|
| 115 | kadmin -l modify -a -disallow-proxiable user
|
|---|
| 116 |
|
|---|
| 117 | ppaasssswwdd [--rr | ----rraannddoomm--kkeeyy] [----rraannddoomm--ppaasssswwoorrdd] [--pp _s_t_r_i_n_g |
|
|---|
| 118 | ----ppaasssswwoorrdd==_s_t_r_i_n_g] [----kkeeyy==_s_t_r_i_n_g] _p_r_i_n_c_i_p_a_l_._._.
|
|---|
| 119 |
|
|---|
| 120 | Changes the password of an existing principal.
|
|---|
| 121 |
|
|---|
| 122 | ppaasssswwoorrdd--qquuaalliittyy _p_r_i_n_c_i_p_a_l _p_a_s_s_w_o_r_d
|
|---|
| 123 |
|
|---|
| 124 | Run the password quality check function locally. You can run this
|
|---|
| 125 | on the host that is configured to run the kadmind process to verify
|
|---|
| 126 | that your configuration file is correct. The verification is done
|
|---|
| 127 | locally, if kadmin is run in remote mode, no rpc call is done to
|
|---|
| 128 | the server.
|
|---|
| 129 |
|
|---|
| 130 | pprriivviilleeggeess
|
|---|
| 131 |
|
|---|
| 132 | Lists the operations you are allowed to perform. These include add,
|
|---|
| 133 | add_enctype, change-password, delete, del_enctype, get, list, and
|
|---|
| 134 | modify.
|
|---|
| 135 |
|
|---|
| 136 | rreennaammee _f_r_o_m _t_o
|
|---|
| 137 |
|
|---|
| 138 | Renames a principal. This is normally transparent, but since keys
|
|---|
| 139 | are salted with the principal name, they will have a non-standard
|
|---|
| 140 | salt, and clients which are unable to cope with this will fail.
|
|---|
| 141 | Kerberos 4 suffers from this.
|
|---|
| 142 |
|
|---|
| 143 | cchheecckk [_r_e_a_l_m]
|
|---|
| 144 |
|
|---|
| 145 | Check database for strange configurations on important principals.
|
|---|
| 146 | If no realm is given, the default realm is used.
|
|---|
| 147 |
|
|---|
| 148 | When running in local mode, the following commands can also be used:
|
|---|
| 149 |
|
|---|
| 150 | dduummpp [--dd | ----ddeeccrryypptt] [_d_u_m_p_-_f_i_l_e]
|
|---|
| 151 |
|
|---|
| 152 | Writes the database in ``human readable'' form to the specified
|
|---|
| 153 | file, or standard out. If the database is encrypted, the dump will
|
|---|
| 154 | also have encrypted keys, unless ----ddeeccrryypptt is used.
|
|---|
| 155 |
|
|---|
| 156 | iinniitt [----rreeaallmm--mmaaxx--ttiicckkeett--lliiffee==_s_t_r_i_n_g] [----rreeaallmm--mmaaxx--rreenneewwaabbllee--lliiffee==_s_t_r_i_n_g]
|
|---|
| 157 | _r_e_a_l_m
|
|---|
| 158 |
|
|---|
| 159 | Initializes the Kerberos database with entries for a new realm.
|
|---|
| 160 | It's possible to have more than one realm served by one server.
|
|---|
| 161 |
|
|---|
| 162 | llooaadd _f_i_l_e
|
|---|
| 163 |
|
|---|
| 164 | Reads a previously dumped database, and re-creates that database
|
|---|
| 165 | from scratch.
|
|---|
| 166 |
|
|---|
| 167 | mmeerrggee _f_i_l_e
|
|---|
| 168 |
|
|---|
| 169 | Similar to llooaadd but just modifies the database with the entries in
|
|---|
| 170 | the dump file.
|
|---|
| 171 |
|
|---|
| 172 | ssttaasshh [--ee _e_n_c_t_y_p_e | ----eennccttyyppee==_e_n_c_t_y_p_e] [--kk _k_e_y_f_i_l_e | ----kkeeyy--ffiillee==_k_e_y_f_i_l_e]
|
|---|
| 173 | [----ccoonnvveerrtt--ffiillee] [----mmaasstteerr--kkeeyy--ffdd==_f_d]
|
|---|
| 174 |
|
|---|
| 175 | Writes the Kerberos master key to a file used by the KDC.
|
|---|
| 176 |
|
|---|
| 177 | SSEEEE AALLSSOO
|
|---|
| 178 | kadmind(8), kdc(8)
|
|---|
| 179 |
|
|---|
| 180 | HEIMDAL Feb 22, 2007 HEIMDAL
|
|---|
