NAME¶

kadmin - Kerberos V5 database administration program

SYNOPSIS¶

kadmin

[-O | -N] [-r realm] [-p principal] [-q query]
[[-c cache_name] | [-k [-t keytab]] | -n] [-w password] [-s admin_server[:port]

kadmin.local

[-r realm] [-p principal] [-q query]
[-d dbname] [-e "enc:salt ..."] [-m] [-x db_args]

DESCRIPTION¶

kadmin and kadmin.local are command-line interfaces to the Kerberos V5 KADM5 administration system. Both kadmin and kadmin.local provide identical functionalities; the difference is that kadmin.local runs on the master KDC if the database is db2 and does not use Kerberos to authenticate to the database. Except as explicitly noted otherwise, this man page will use kadmin to refer to both versions. kadmin provides for the maintenance of Kerberos principals, KADM5 policies, and service key tables (keytabs).

The remote version uses Kerberos authentication and an encrypted RPC, to operate securely from anywhere on the network. It authenticates to the KADM5 server using the service principal kadmin/admin. If the credentials cache contains a ticket for the kadmin/admin principal, and the -c credentials_cache option is specified, that ticket is used to authenticate to KADM5. Otherwise, the -p and -k options are used to specify the client Kerberos principal name used to authenticate. Once kadmin has determined the principal name, it requests a kadmin/admin Kerberos service ticket from the KDC, and uses that service ticket to authenticate to KADM5.

If the database is db2, the local client kadmin.local, is intended to run directly on the master KDC without Kerberos authentication. The local version provides all of the functionality of the now obsolete kdb5_edit(8), except for database dump and load, which is now provided by the kdb5_util(8) utility.

If the database is LDAP, kadmin.local need not be run on the KDC.

kadmin.local can be configured to log updates for incremental database propagation. Incremental propagation allows slave KDC servers to receive principal and policy updates incrementally instead of receiving full dumps of the database. This facility can be enabled in the kdc.conf file with the iprop_enable option. See the kdc.conf documentation for other options for tuning incremental propagation parameters.

OPTIONS¶

-r realm

Use realm as the default database realm.

-p principal

Use principal to authenticate. Otherwise, kadmin will append "/admin" to the primary principal name of the default ccache, the value of the USER environment variable, or the username as obtained with getpwuid, in order of preference.

-k

Use a keytab to decrypt the KDC response instead of prompting for a password on the TTY. In this case, the default principal will be host/hostname. If there is not a keytab specified with the -t option, then the default keytab will be used.

-t keytab

Use keytab to decrypt the KDC response. This can only be used with the -k option. -n Requests anonymous processing. Two types of anonymous principals are supported. For fully anonymous Kerberos, configure pkinit on the KDC and configure pkinit_anchors in the client's krb5.conf. Then use the -n option with a principal of the form @REALM (an empty principal name followed by the at-sign and a realm name). If permitted by the KDC, an anonymous ticket will be returned. A second form of anonymous tickets is supported; these realm-exposed tickets hide the identity of the client but not the client's realm. For this mode, use kinit -n with a normal principal name. If supported by the KDC, the principal (but not realm) will be replaced by the anonymous principal. As of release 1.8, the MIT Kerberos KDC only supports fully anonymous operation.

-c credentials_cache

Use credentials_cache as the credentials cache. The credentials_cache should contain a service ticket for the kadmin/admin service; it can be acquired with the kinit(1) program. If this option is not specified, kadmin requests a new service ticket from the KDC, and stores it in its own temporary ccache.

-w password

Use password instead of prompting for one on the TTY. Note: placing the password for a Kerberos principal with administration access into a shell script can be dangerous if unauthorized users gain read access to the script.

-q query

pass query directly to kadmin, which will perform query and then exit. This can be useful for writing scripts.

-d dbname

Specifies the name of the Kerberos database. This option does not apply to the LDAP database.

-s admin_server[:port]

Specifies the admin server which kadmin should contact.

-m

Do not authenticate using a keytab. This option will cause kadmin to prompt for the master database password.

-e enc:salt_list

Sets the list of encryption types and salt types to be used for any new keys created.

-O

Force use of old AUTH_GSSAPI authentication flavor.

-N

Prevent fallback to AUTH_GSSAPI authentication flavor.

-x db_args

Specifies the database specific arguments.

Options supported for LDAP database are:

DATE FORMAT¶

Various commands in kadmin can take a variety of date formats, specifying durations or absolute times. Examples of valid formats are:

1 month ago
2 hours ago
400000 seconds ago
last year
this Monday
next Monday
yesterday
tomorrow
now
second Monday
a fortnight ago
3/31/92 10:00:07 PST
January 23, 1987 10:05pm
22:00 GMT

Dates which do not have the "ago" specifier default to being absolute dates, unless they appear in a field where a duration is expected. In that case the time specifier will be interpreted as relative. Specifying "ago" in a duration may result in unexpected behavior.

COMMANDS¶

add_principal [options] newprinc

creates the principal newprinc, prompting twice for a password. If no policy is specified with the -policy option, and the policy named "default" exists, then that policy is assigned to the principal; note that the assignment of the policy "default" only occurs automatically when a principal is first created, so the policy "default" must already exist for the assignment to occur. This assignment of "default" can be suppressed with the -clearpolicy option. This command requires the add privilege. This command has the aliases addprinc and ank. The options are:

delete_principal [-force] principal

deletes the specified principal from the database. This command prompts for deletion, unless the -force option is given. This command requires the delete privilege. Aliased to delprinc.

modify_principal [options] principal

modifies the specified principal, changing the fields as specified. The options are as above for add_principal, except that password changing and flags related to password changing are forbidden by this command. In addition, the option -clearpolicy will clear the current policy of a principal. This command requires the modify privilege. Aliased to modprinc.

change_password [options] principal

changes the password of principal. Prompts for a new password if neither -randkey or -pw is specified. Requires the changepw privilege, or that the principal that is running the program to be the same as the one changed. Aliased to cpw. The following options are available:

purgekeys [-keepkvno oldest_kvno_to_keep] principal

purges previously retained old keys (e.g., from change_password -keepold) from principal. If -keepkvno is specified, then only purges keys with kvnos lower than oldest_kvno_to_keep.

get_principal [-terse] principal

gets the attributes of principal. Requires the inquire privilege, or that the principal that is running the the program to be the same as the one being listed. With the -terse option, outputs fields as quoted tab-separated strings. Alias getprinc.

list_principals [expression]

Retrieves all or some principal names. Expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []'s. All principal names matching the expression are printed. If no expression is provided, all principal names are printed. If the expression does not contain an "@" character, an "@" character followed by the local realm is appended to the expression. Requires the list privilege. Alias listprincs, get_principals, get_princs.

get_strings principal

displays string attributes on principal. String attributes are used to supply per-principal configuration to some KDC plugin modules. Alias getstrs.

set_string principal key value

sets a string attribute on principal. Alias setstr.

del_string principal key

deletes a string attribute from principal. Alias delstr.

add_policy [options] policy

adds the named policy to the policy database. Requires the add privilege. Aliased to addpol. The following options are available:

delete_policy [-force] policy

deletes the named policy. Prompts for confirmation before deletion. The command will fail if the policy is in use by any principals. Requires the delete privilege. Alias delpol.

modify_policy [options] policy

modifies the named policy. Options are as above for add_policy. Requires the modify privilege. Alias modpol.

get_policy [-terse] policy

displays the values of the named policy. Requires the inquire privilege. With the -terse flag, outputs the fields as quoted strings separated by tabs. Alias getpol.

list_policies [expression]

Retrieves all or some policy names. Expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []'s. All policy names matching the expression are printed. If no expression is provided, all existing policy names are printed. Requires the list privilege. Alias listpols, get_policies, getpols.

ktadd [-k keytab] [-q] [-e keysaltlist]

[-norandkey] [[principal | -glob princ-exp] [...]
Adds a principal or all principals matching princ-exp to a keytab. It randomizes each principal's key in the process, to prevent a compromised admin account from reading out all of the keys from the database. However, kadmin.local has the -norandkey option, which leaves the keys and their version numbers unchanged, similar to the Kerberos V4 ext_srvtab command. That allows users to continue to use the passwords they know to login normally, while simultaneously allowing scripts to login to the same account using a keytab. There is no significant security risk added since kadmin.local must be run by root on the KDC anyway.

Requires the inquire and changepw privileges. An entry for each of the principal's unique encryption types is added, ignoring multiple keys with the same encryption type but different salt types. If the -k argument is not specified, the default keytab /etc/krb5.keytab is used. If the -q option is specified, less verbose status information is displayed.

The -glob option requires the list privilege. princ-exp follows the same rules described for the list_principals command.

ktremove [-k keytab] [-q] principal [kvno | all | old]

Removes entries for the specified principal from a keytab. Requires no permissions, since this does not require database access. If the string "all" is specified, all entries for that principal are removed; if the string "old" is specified, all entries for that principal except those with the highest kvno are removed. Otherwise, the value specified is parsed as an integer, and all entries whose kvno match that integer are removed. If the -k argument is not specified, the default keytab /etc/krb5.keytab is used. If the -q option is specified, less verbose status information is displayed.

FILES¶

principal.db

default name for Kerberos principal database

<dbname>.kadm5

KADM5 administrative database. (This would be "principal.kadm5", if you use the default database name.) Contains policy information.

<dbname>.kadm5.lock

lock file for the KADM5 administrative database. This file works backwards from most other lock files. I.e., kadmin will exit with an error if this file does not exist.

Note:

The above three files are specific to db2 database.

kadm5.acl

file containing list of principals and their kadmin administrative privileges. See kadmind(8) for a description.

kadm5.keytab

keytab file for kadmin/admin principal.

kadm5.dict

file containing dictionary of strings explicitly disallowed as passwords.

HISTORY¶

The kadmin program was originally written by Tom Yu at MIT, as an interface to the OpenVision Kerberos administration program.

SEE ALSO¶

kerberos(1), kpasswd(1), kadmind(8)

BUGS¶

Command output needs to be cleaned up.