KADMIN(8)

NAME
kadmin - network utility for Kerberos database administration

SYNOPSIS
kadmin [-p principal] [-u username] [-r realm] [-m] [-T timeout] [-t] [--version] [-h] [--help] [command]

DESCRIPTION
This utility provides a unified administration interface to the Kerberos master database. Kerberos administrators use kadmin to register new users and services to the master database, and to change information about existing database entries, such as changing a user's Kerberos password. A Kerberos administrator is a user with an “admin” instance whose name appears on one of the Kerberos administration access control lists.

Supported options:

-p principal
    This is the adminstrator principal to use when talking to the Kadmin server. The default is taken from the users environment.

-r realm
    This is the default realm to use for transactions. Default is the local realm.

-u username
    This is similar to -p, but specifies a name, that gets appended with a “admin” instance.

-T timeout
    To prevent someone from walking up to an unguarded terminal and doing malicious things, administrator tickets are destroyed after a period of inactivity. This flag changes the timeout from the default of one minute. A timeout of zero seconds disables this functionality.

-m  Historically kadmin destroyed tickets after every command; this flag used to stop this behaviour (only destroying tickets upon exit). Now it's just a synonym for -T 0.

-t  Use existing tickets (if any are available), this also disbles timeout, and doesn't destroy any tickets upon exit. These tickets have to be for the changepw.kerberos service. Use kinit -p to acquire them.

The kadmin program communicates over the network with the kadmind program, which runs on the machine housing the Kerberos master database, and does the actual modifications to the database.

When you enter the kadmin command, the program displays a message that welcomes you and explains how to ask for help. Then kadmin waits for you to enter commands (which are described below). It then asks you for your administrator's password before accessing the database.

All commands can be abbreviated as long as they are unique. Some short versions of the commands are also recognized for backwards compatibility.

Recognised commands:

add_new_key principal
    Creates a new principal in the Kerberos database. You give the name of the new principal as an argument. You will then be asked for a maximum ticket lifetime, attributes, the expiration date of the principal, and finally the password of the principal.

change_password principal
    Changes a principal's password. You will be prompted for the new password.

change_key principal
    This is the same as change_password, but the password is given as a raw DES key (for the few occations when you need this).

change_admin_password
    Changes your own admin password. It will prompt you for you old and new passwords.

del_entry principal
    Removes principal from the database.

get_entry principal
    Show various information for the given principal. Note that the key is shown as zeros.

mod_entry principal
    Modifies a particular entry, for instance to change the expiration date.

destroy_tickets
    Destroys your admin tickets explicitly.

quit
    Obvious.

SEE ALSO
kerberos(1), kadmind(8), kpasswd(1), kinit(1), ksrvutil(8)

AUTHORS
Jeffrey I. Schiller, MIT Project Athena

Emanuel Jay Berkenbilt, MIT Project Athena

BUGS
The user interface is primitive, and the command names could be better.