2001-06-21 02:12:07 +00:00
|
|
|
.\" $Id: kadmin.8,v 1.5 2001/06/08 21:27:57 joda Exp $
|
2001-02-13 16:46:19 +00:00
|
|
|
.\"
|
|
|
|
|
.Dd September 10, 2000
|
|
|
|
|
.Dt KADMIN 8
|
|
|
|
|
.Os HEIMDAL
|
|
|
|
|
.Sh NAME
|
|
|
|
|
.Nm kadmin
|
2001-05-08 14:57:13 +00:00
|
|
|
.Nd Kerberos administration utility
|
2001-02-13 16:46:19 +00:00
|
|
|
.Sh SYNOPSIS
|
|
|
|
|
.Nm
|
|
|
|
|
.Oo Fl p Ar string \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -principal= Ns Ar string
|
|
|
|
|
.Xc
|
|
|
|
|
.Oc
|
|
|
|
|
.Oo Fl K Ar string \*(Ba Xo
|
|
|
|
|
.Fl -keytab= Ns Ar string
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Oo Fl c Ar file \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -config-file= Ns Ar file
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Oo Fl k Ar file \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -key-file= Ns Ar file
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Oo Fl r Ar realm \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -realm= Ns Ar realm
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Oo Fl a Ar host \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -admin-server= Ns Ar host
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Oo Fl s Ar port number \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -server-port= Ns Ar port number
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Op Fl l | Fl -local
|
|
|
|
|
.Op Fl h | Fl -help
|
|
|
|
|
.Op Fl v | Fl -version
|
|
|
|
|
.Op Ar command
|
|
|
|
|
.Sh DESCRIPTION
|
|
|
|
|
The
|
|
|
|
|
.Nm
|
|
|
|
|
program is used to make modification to the Kerberos database, either remotely via the
|
|
|
|
|
.Xr kadmind 8
|
|
|
|
|
daemon, or locally (with the
|
|
|
|
|
.Fl l
|
|
|
|
|
option).
|
|
|
|
|
.Pp
|
|
|
|
|
Supported options:
|
|
|
|
|
.Bl -tag -width Ds
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl p Ar string Ns ,
|
|
|
|
|
.Fl -principal= Ns Ar string
|
|
|
|
|
.Xc
|
|
|
|
|
principal to authenticate as
|
|
|
|
|
.It Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl K Ar string Ns ,
|
|
|
|
|
.Fl -keytab= Ns Ar string
|
|
|
|
|
.Xc
|
|
|
|
|
keytab for authentication pricipal
|
|
|
|
|
.It Xo
|
2001-02-13 16:46:19 +00:00
|
|
|
.Fl c Ar file Ns ,
|
|
|
|
|
.Fl -config-file= Ns Ar file
|
|
|
|
|
.Xc
|
|
|
|
|
location of config file
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl k Ar file Ns ,
|
|
|
|
|
.Fl -key-file= Ns Ar file
|
|
|
|
|
.Xc
|
|
|
|
|
location of master key file
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl r Ar realm Ns ,
|
|
|
|
|
.Fl -realm= Ns Ar realm
|
|
|
|
|
.Xc
|
|
|
|
|
realm to use
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl a Ar host Ns ,
|
|
|
|
|
.Fl -admin-server= Ns Ar host
|
|
|
|
|
.Xc
|
|
|
|
|
server to contact
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl s Ar port number Ns ,
|
|
|
|
|
.Fl -server-port= Ns Ar port number
|
|
|
|
|
.Xc
|
|
|
|
|
port to use
|
|
|
|
|
.It Xo
|
|
|
|
|
.Fl l Ns ,
|
|
|
|
|
.Fl -local
|
|
|
|
|
.Xc
|
|
|
|
|
local admin mode
|
|
|
|
|
.El
|
|
|
|
|
.Pp
|
|
|
|
|
If no
|
|
|
|
|
.Ar command
|
|
|
|
|
is given on the command line,
|
|
|
|
|
.Nm
|
|
|
|
|
will prompt for commands to process. Commands include:
|
|
|
|
|
.\" not using a list here, since groff apparently gets confused
|
|
|
|
|
.\" with nested Xo/Xc
|
|
|
|
|
.Bd -ragged -offset indent
|
|
|
|
|
.Nm add
|
|
|
|
|
.Op Fl r | Fl -random-key
|
|
|
|
|
.Op Fl -random-password
|
|
|
|
|
.Oo Fl p Ar string \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -password= Ns Ar string
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Op Fl -key= Ns Ar string
|
|
|
|
|
.Op Fl -max-ticket-life= Ns Ar lifetime
|
|
|
|
|
.Op Fl -max-renewable-life= Ns Ar lifetime
|
|
|
|
|
.Op Fl -attributes= Ns Ar attributes
|
|
|
|
|
.Op Fl -expiration-time= Ns Ar time
|
|
|
|
|
.Op Fl -pw-expiration-time= Ns Ar time
|
|
|
|
|
.Ar principal...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
creates a new principal
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm passwd
|
|
|
|
|
.Op Fl r | Fl -random-key
|
|
|
|
|
.Op Fl -random-password
|
|
|
|
|
.Oo Fl p Ar string \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -password= Ns Ar string
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Op Fl -key= Ns Ar string
|
|
|
|
|
.Ar principal...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
changes the password of an existing principal
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm delete
|
|
|
|
|
.Ar principal...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
removes a principal
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm del_enctype
|
|
|
|
|
.Ar principal enctypes...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
removes some enctypes from a principal, this can be useful the service
|
|
|
|
|
belonging to the principal is known to not handle certain enctypes
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm ext_keytab
|
|
|
|
|
.Oo Fl k Ar string \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -keytab= Ns Ar string
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Ar principal...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
creates a keytab with the keys of the specified principals
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm get
|
|
|
|
|
.Op Fl l | Fl -long
|
|
|
|
|
.Op Fl s | Fl -short
|
|
|
|
|
.Op Fl t | Fl -terse
|
|
|
|
|
.Ar expression...
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
lists the principals that match the expressions (which are shell glob
|
|
|
|
|
like), long format gives more information, and terse just prints the
|
|
|
|
|
names
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm rename
|
|
|
|
|
.Ar from to
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
renames a principal
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm modify
|
|
|
|
|
.Oo Fl a Ar attributes \*(Ba Xo
|
2001-06-21 02:12:07 +00:00
|
|
|
.Fl -attributes= Ns Ar attributes
|
2001-02-13 16:46:19 +00:00
|
|
|
.Xc
|
2001-06-21 02:12:07 +00:00
|
|
|
.Oc
|
2001-02-13 16:46:19 +00:00
|
|
|
.Op Fl -max-ticket-life= Ns Ar lifetime
|
|
|
|
|
.Op Fl -max-renewable-life= Ns Ar lifetime
|
|
|
|
|
.Op Fl -expiration-time= Ns Ar time
|
|
|
|
|
.Op Fl -pw-expiration-time= Ns Ar time
|
|
|
|
|
.Op Fl -kvno= Ns Ar number
|
|
|
|
|
.Ar principal
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
modifies certain attributes of a principal
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm privileges
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
lists the operations you are allowd to perform
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Ed
|
2001-05-08 14:57:13 +00:00
|
|
|
.Pp
|
2001-02-13 16:46:19 +00:00
|
|
|
When running in local mode, the following commands can also be used.
|
|
|
|
|
.Bd -ragged -offset indent
|
|
|
|
|
.Nm dump
|
|
|
|
|
.Op Fl d | Fl -decrypt
|
|
|
|
|
.Op Ar dump-file
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
writes the database in
|
|
|
|
|
.Dq human readable
|
|
|
|
|
form to the specified file, or standard out
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm init
|
|
|
|
|
.Op Fl -realm-max-ticket-life= Ns Ar string
|
|
|
|
|
.Op Fl -realm-max-renewable-life= Ns Ar string
|
|
|
|
|
.Ar realm
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
initialises the Kerberos database with entries for a new realm, it's
|
|
|
|
|
possible to have more than one realm served by one server
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm load
|
|
|
|
|
.Ar file
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
reads a previously dumped database, and re-creates that database from scratch
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Nm merge
|
|
|
|
|
.Ar file
|
|
|
|
|
.Pp
|
2001-05-08 14:57:13 +00:00
|
|
|
.Bd -ragged -offset indent
|
2001-02-13 16:46:19 +00:00
|
|
|
similar to
|
|
|
|
|
.Nm list
|
|
|
|
|
but just modifies the database with the entries in the dump file
|
|
|
|
|
.Ed
|
|
|
|
|
.Pp
|
|
|
|
|
.Ed
|
|
|
|
|
.\".Sh ENVIRONMENT
|
|
|
|
|
.\".Sh FILES
|
|
|
|
|
.\".Sh EXAMPLES
|
|
|
|
|
.\".Sh DIAGNOSTICS
|
|
|
|
|
.Sh SEE ALSO
|
|
|
|
|
.Xr kadmind 8 ,
|
|
|
|
|
.Xr kdc 8
|
|
|
|
|
.\".Sh STANDARDS
|
|
|
|
|
.\".Sh HISTORY
|
|
|
|
|
.\".Sh AUTHORS
|
|
|
|
|
.\".Sh BUGS
|
