NAME
kadmin - Kerberos V5 database administration program SYNOPSIS
kadmin [-O|-N] [-r realm] [-p principal] [-q query] [[-c
cachename]|[-k [-t keytab]]|-n] [-w password] [-s adminserver[:port]] [command args...]
kadmin.local [-r realm] [-p principal] [-q query] [-d dbname] [-e
enc:salt ...] [-m] [-x dbargs] [command args...] DESCRIPTION
kadmin and kadmin.local are command-line interfaces to the Kerberos V5 administration system. They provide nearly identical functionalities; the difference is that kadmin.local directly accesses the KDC database, while kadmin performs operations using kadmind(8). Except as explic‐ itly noted otherwise, this man page will use "kadmin" to refer to both versions. kadmin provides for the maintenance of Kerberos principals, password policies, and service key tables (keytabs). The remote kadmin client uses Kerberos to authenticate to kadmind using the service principal kadmin/ADMINHOST (where ADMINHOST is the
fully-qualified hostname of the admin server) or kadmin/admin. If the credentials cache contains a ticket for one of these principals, and
the -c credentialscache option is specified, that ticket is used to
authenticate to kadmind. Otherwise, the -p and -k options are used to specify the client Kerberos principal name used to authenticate. Once kadmin has determined the principal name, it requests a service ticket from the KDC, and uses that service ticket to authenticate to kadmind. Since kadmin.local directly accesses the KDC database, it usually must be run directly on the master KDC with sufficient permissions to read the KDC database. If the KDC database uses the LDAP database module, kadmin.local can be run on any host which can access the LDAP server. OPTIONS
-r realm Use realm as the default database realm.
-p principal Use principal to authenticate. Otherwise, kadmin will append /admin to the primary principal name of the default ccache, the value of the USER environment variable, or the username as obtained with getpwuid, in order of preference.
-k Use a keytab to decrypt the KDC response instead of prompting for a password. In this case, the default principal will be
host/hostname. If there is no keytab specified with the -t option, then the default keytab will be used.
-t keytab Use keytab to decrypt the KDC response. This can only be used
with the -k option.
-n Requests anonymous processing. Two types of anonymous princi‐ pals are supported. For fully anonymous Kerberos, configure PKINIT on the KDC and configure pkinitanchors in the client's
krb5.conf(5). Then use the -n option with a principal of the
form @REALM (an empty principal name followed by the at-sign and a realm name). If permitted by the KDC, an anonymous ticket will be returned. A second form of anonymous tickets is sup‐
ported; these realm-exposed tickets hide the identity of the
client but not the client's realm. For this mode, use kinit -n with a normal principal name. If supported by the KDC, the principal (but not realm) will be replaced by the anonymous principal. As of release 1.8, the MIT Kerberos KDC only sup‐ ports fully anonymous operation.
-c credentialscache Use credentialscache as the credentials cache. The cache should contain a service ticket for the kadmin/ADMINHOST (where
ADMINHOST is the fully-qualified hostname of the admin server) or kadmin/admin service; it can be acquired with the kinit(1) program. If this option is not specified, kadmin requests a new service ticket from the KDC, and stores it in its own temporary ccache.
-w password Use password instead of prompting for one. Use this option with care, as it may expose the password to other users on the system via the process list.
-q query Perform the specified query and then exit.
-d dbname Specifies the name of the KDC database. This option does not apply to the LDAP database module.
-s adminserver[:port] Specifies the admin server which kadmin should contact.
-m If using kadmin.local, prompt for the database master password instead of reading it from a stash file.
-e enc:salt ... Sets the keysalt list to be used for any new keys created. See Keysaltlists in kdc.conf(5) for a list of possible values.
-O Force use of old AUTHGSSAPI authentication flavor.
-N Prevent fallback to AUTHGSSAPI authentication flavor.
-x dbargs Specifies the database specific arguments. See the next section for supported options.
Starting with release 1.14, if any command-line arguments remain after the options, they will be treated as a single query to be executed. This mode of operation is intended for scripts and behaves differently from the interactive mode in several respects: · Query arguments are split by the shell, not by kadmin. · Informational and warning messages are suppressed. Error messages and query output (e.g. for getprincipal) will still be displayed.
· Confirmation prompts are disabled (as if -force was given). Password prompts will still be issued as required.
· The exit status will be non-zero if the query fails.
The -q option does not carry these behavior differences; the query will
be processed as if it was entered interactively. The -q option cannot be used in combination with a query in the remaining arguments. DATABASE OPTIONS
Database options can be used to override database-specific defaults. Supported options for the DB2 module are:
-x dbname=*filename* Specifies the base filename of the DB2 database.
-x lockiter Make iteration operations hold the lock for the duration of the entire operation, rather than temporarily releasing the lock while handling each principal. This is the default behavior, but this option exists to allow command line over‐ ride of a [dbmodules] setting. First introduced in release 1.13.
-x unlockiter Make iteration operations unlock the database for each prin‐ cipal, instead of holding the lock for the duration of the entire operation. First introduced in release 1.13. Supported options for the LDAP module are:
-x host=ldapuri Specifies the LDAP server to connect to by a LDAP URI.
-x binddn=binddn Specifies the DN used to bind to the LDAP server.
-x bindpwd=password Specifies the password or SASL secret used to bind to the LDAP server. Using this option may expose the password to other users on the system via the process list; to avoid this, instead stash the password using the stashsrvpw command of kdb5ldaputil(8).
-x saslmech=mechanism Specifies the SASL mechanism used to bind to the LDAP server. The bind DN is ignored if a SASL mechanism is used. New in release 1.13.
-x saslauthcid=name Specifies the authentication name used when binding to the LDAP server with a SASL mechanism, if the mechanism requires one. New in release 1.13.
-x saslauthzid=name Specifies the authorization name used when binding to the LDAP server with a SASL mechanism. New in release 1.13.
-x saslrealm=realm Specifies the realm used when binding to the LDAP server with a SASL mechanism, if the mechanism uses one. New in release 1.13.
-x debug=level sets the OpenLDAP client library debug level. level is an integer to be interpreted by the library. Debugging messages are printed to standard error. New in release 1.12. COMMANDS When using the remote client, available commands may be restricted according to the privileges specified in the kadm5.acl(5) file on the admin server. addprincipal addprincipal [options] newprinc Creates the principal newprinc, prompting twice for a password. If no
password policy is specified with the -policy option, and the policy named default is assigned to the principal if it exists. However, cre‐ ating a policy named default will not automatically assign this policy to previously existing principals. This policy assignment can be sup‐
pressed with the -clearpolicy option. This command requires the add privilege. Aliases: addprinc, ank Options:
-expire expdate (getdate string) The expiration date of the principal.
-pwexpire pwexpdate (getdate string) The password expiration date.
-maxlife maxlife (duration or getdate string) The maximum ticket life for the principal.
-maxrenewlife maxrenewlife (duration or getdate string) The maximum renewable life of tick‐ ets for the principal.
-kvno kvno The initial key version number.
-policy policy The password policy used by this principal. If not specified,
the policy default is used if it exists (unless -clearpolicy is specified).
-clearpolicy
Prevents any policy from being assigned when -policy is not specified.
{-|+}allowpostdated
-allowpostdated prohibits this principal from obtaining post‐ dated tickets. +allowpostdated clears this flag.
{-|+}allowforwardable
-allowforwardable prohibits this principal from obtaining for‐ wardable tickets. +allowforwardable clears this flag.
{-|+}allowrenewable
-allowrenewable prohibits this principal from obtaining renew‐ able tickets. +allowrenewable clears this flag.
{-|+}allowproxiable
-allowproxiable prohibits this principal from obtaining proxi‐ able tickets. +allowproxiable clears this flag.
{-|+}allowdupskey
-allowdupskey disables user-to-user authentication for this principal by prohibiting this principal from obtaining a session key for another user. +allowdupskey clears this flag.
{-|+}requirespreauth +requirespreauth requires this principal to preauthenticate
before being allowed to kinit. -requirespreauth clears this flag. When +requirespreauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client's initial authentication was performed using preauthentication.
{-|+}requireshwauth +requireshwauth requires this principal to preauthenticate using a hardware device before being allowed to kinit.
-requireshwauth clears this flag. When +requireshwauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client's initial authentica‐ tion was performed using a hardware device to preauthenticate.
{-|+}okasdelegate +okasdelegate sets the okay as delegate flag on tickets issued with this principal as the service. Clients may use this flag as a hint that credentials should be delegated when authenticat‐
ing to the service. -okasdelegate clears this flag.
{-|+}allowsvr
-allowsvr prohibits the issuance of service tickets for this principal. +allowsvr clears this flag.
{-|+}allowtgsreq
-allowtgsreq specifies that a Ticket-Granting Service (TGS) request for a service ticket for this principal is not permit‐ ted. +allowtgsreq clears this flag.
{-|+}allowtix
-allowtix forbids the issuance of any tickets for this princi‐ pal. +allowtix clears this flag.
{-|+}needchange +needchange forces a password change on the next initial authen‐
tication to this principal. -needchange clears this flag.
{-|+}passwordchangingservice +passwordchangingservice marks this principal as a password change service principal.
{-|+}oktoauthasdelegate +oktoauthasdelegate allows this principal to acquire for‐ wardable tickets to itself from arbitrary users, for use with constrained delegation.
{-|+}noauthdatarequired
+noauthdatarequired prevents PAC or AD-SIGNEDPATH data from being added to service tickets for the principal.
{-|+}lockdownkeys +lockdownkeys prevents keys for this principal from leaving the KDC via kadmind. The chpass and extract operations are denied for a principal with this attribute. The chrand operation is allowed, but will not return the new keys. The delete and rename operations are also denied if this attribute is set, in order to prevent a malicious administrator from replacing prin‐ cipals like krbtgt/* or kadmin/* with new principals without the attribute. This attribute can be set via the network protocol, but can only be removed using kadmin.local.
-randkey Sets the key of the principal to a random value.
-nokey Causes the principal to be created with no key. New in release 1.12.
-pw password Sets the password of the principal to the specified string and does not prompt for a password. Note: using this option in a shell script may expose the password to other users on the sys‐ tem via the process list.
-e enc:salt,... Uses the specified keysalt list for setting the keys of the principal. See Keysaltlists in kdc.conf(5) for a list of pos‐ sible values.
-x dbprincargs
Indicates database-specific options. The options for the LDAP database module are:
-x dn=dn Specifies the LDAP object that will contain the Kerberos principal being created.
-x linkdn=dn Specifies the LDAP object to which the newly created Ker‐ beros principal object will point.
-x containerdn=containerdn Specifies the container object under which the Kerberos principal is to be created.
-x tktpolicy=policy Associates a ticket policy to the Kerberos principal. NOTE: · The containerdn and linkdn options cannot be specified with the dn option. · If the dn or containerdn options are not specified while adding the principal, the principals are created under the principal container configured in the realm or the realm container. · dn and containerdn should be within the subtrees or princi‐ pal container configured in the realm. Example: kadmin: addprinc jennifer WARNING: no policy specified for "jennifer@ATHENA.MIT.EDU"; defaulting to no policy. Enter password for principal jennifer@ATHENA.MIT.EDU:
Re-enter password for principal jennifer@ATHENA.MIT.EDU: Principal "jennifer@ATHENA.MIT.EDU" created. kadmin: modifyprincipal modifyprincipal [options] principal Modifies the specified principal, changing the fields as specified. The options to addprincipal also apply to this command, except for the
-randkey, -pw, and -e options. In addition, the option -clearpolicy will clear the current policy of a principal. This command requires the modify privilege. Alias: modprinc Options (in addition to the addprinc options):
-unlock Unlocks a locked principal (one which has received too many failed authentication attempts without enough time between them according to its password policy) so that it can successfully authenticate. renameprincipal
renameprincipal [-force] oldprincipal newprincipal Renames the specified oldprincipal to newprincipal. This command
prompts for confirmation, unless the -force option is given. This command requires the add and delete privileges. Alias: renprinc deleteprincipal
deleteprincipal [-force] principal Deletes the specified principal from the database. This command
prompts for deletion, unless the -force option is given. This command requires the delete privilege. Alias: delprinc changepassword changepassword [options] principal Changes the password of principal. Prompts for a new password if nei‐
ther -randkey or -pw is specified. This command requires the changepw privilege, or that the principal running the program is the same as the principal being changed. Alias: cpw The following options are available:
-randkey Sets the key of the principal to a random value.
-pw password Set the password to the specified string. Using this option in a script may expose the password to other users on the system via the process list.
-e enc:salt,... Uses the specified keysalt list for setting the keys of the principal. See Keysaltlists in kdc.conf(5) for a list of pos‐ sible values.
-keepold Keeps the existing keys in the database. This flag is usually not necessary except perhaps for krbtgt principals. Example: kadmin: cpw systest Enter password for principal systest@BLEEP.COM:
Re-enter password for principal systest@BLEEP.COM: Password for systest@BLEEP.COM changed. kadmin: purgekeys
purgekeys [-all|-keepkvno oldestkvnotokeep] principal
Purges previously retained old keys (e.g., from changepassword -keep‐
old) from principal. If -keepkvno is specified, then only purges keys
with kvnos lower than oldestkvnotokeep. If -all is specified, then
all keys are purged. The -all option is new in release 1.12. This command requires the modify privilege. getprincipal
getprincipal [-terse] principal
Gets the attributes of principal. With the -terse option, outputs
fields as quoted tab-separated strings. This command requires the inquire privilege, or that the principal run‐ ning the the program to be the same as the one being listed. Alias: getprinc Examples: kadmin: getprinc tlyu/admin Principal: tlyu/admin@BLEEP.COM Expiration date: [never] Last password change: Mon Aug 12 14:16:47 EDT 1996 Password expiration date: [none] Maximum ticket life: 0 days 10:00:00 Maximum renewable life: 7 days 00:00:00 Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM) Last successful authentication: [never] Last failed authentication: [never] Failed password attempts: 0 Number of keys: 2
Key: vno 1, des-cbc-crc
Key: vno 1, des-cbc-crc:v4 Attributes: Policy: [none]
kadmin: getprinc -terse systest systest@BLEEP.COM 3 86400 604800 1 785926535 753241234 785900000 tlyu/admin@BLEEP.COM 786100034 0 0 kadmin: listprincipals listprincipals [expression]
Retrieves all or some principal names. expression is a shell-style
glob expression that can contain the wild-card characters ?, *, and []. All principal names matching the expression are printed. If no expres‐ sion is provided, all principal names are printed. If the expression does not contain an @ character, an @ character followed by the local realm is appended to the expression. This command requires the list privilege. Alias: listprincs, getprincipals, getprincs Example: kadmin: listprincs test*
test3@SECURE-TEST.OV.COM
test2@SECURE-TEST.OV.COM
test1@SECURE-TEST.OV.COM
testuser@SECURE-TEST.OV.COM kadmin: getstrings getstrings principal Displays string attributes on principal. This command requires the inquire privilege. Alias: getstr setstring setstring principal name value Sets a string attribute on principal. String attributes are used to
supply per-principal configuration to the KDC and some KDC plugin mod‐ ules. The following string attribute names are recognized by the KDC: requireauth Specifies an authentication indicator which is required to authenticate to the principal as a service. Multiple indicators can be specified, separated by spaces; in this case any of the specified indicators will be accepted. (New in release 1.14.) sessionenctypes Specifies the encryption types supported for session keys when the principal is authenticated to as a server. See Encryp‐ tiontypes in kdc.conf(5) for a list of the accepted values. otp Enables One Time Passwords (OTP) preauthentication for a client principal. The value is a JSON string representing an array of objects, each having optional type and username fields. This command requires the modify privilege. Alias: setstr Example:
setstring host/foo.mit.edu sessionenctypes aes128-cts setstring user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]" delstring delstring principal key Deletes a string attribute from principal. This command requires the delete privilege. Alias: delstr addpolicy addpolicy [options] policy Adds a password policy named policy to the database. This command requires the add privilege. Alias: addpol The following options are available:
-maxlife time (duration or getdate string) Sets the maximum lifetime of a password.
-minlife time (duration or getdate string) Sets the minimum lifetime of a password.
-minlength length Sets the minimum length of a password.
-minclasses number Sets the minimum number of character classes required in a pass‐ word. The five character classes are lower case, upper case, numbers, punctuation, and whitespace/unprintable characters.
-history number Sets the number of past keys kept for a principal. This option is not supported with the LDAP KDC database module.
-maxfailure maxnumber Sets the number of authentication failures before the principal is locked. Authentication failures are only tracked for princi‐ pals which require preauthentication. The counter of failed attempts resets to 0 after a successful attempt to authenticate. A maxnumber value of 0 (the default) disables lockout.
-failurecountinterval failuretime (duration or getdate string) Sets the allowable time between authentication failures. If an authentication failure happens after failuretime has elapsed since the previous failure, the number of authentication failures is reset to 1. A failuretime value of 0 (the default) means forever.
-lockoutduration lockouttime (duration or getdate string) Sets the duration for which the principal is locked from authenticating if too many authentica‐ tion failures occur without the specified failure count interval elapsing. A duration of 0 (the default) means the principal remains locked out until it is administratively unlocked with
modprinc -unlock.
-allowedkeysalts
Specifies the key/salt tuples supported for long-term keys when setting or changing a principal's password/keys. See Keysaltlists in kdc.conf(5) for a list of the accepted values, but note that key/salt tuples must be separated with commas (',') only. To clear the allowed key/salt policy use a value of
'-'. Example:
kadmin: addpolicy -maxlife "2 days" -minlength 5 guests kadmin: modifypolicy modifypolicy [options] policy Modifies the password policy named policy. Options are as described for addpolicy. This command requires the modify privilege. Alias: modpol deletepolicy
deletepolicy [-force] policy Deletes the password policy named policy. Prompts for confirmation before deletion. The command will fail if the policy is in use by any principals. This command requires the delete privilege. Alias: delpol Example: kadmin: delpolicy guests Are you sure you want to delete the policy "guests"? (yes/no): yes kadmin: getpolicy
getpolicy [ -terse ] policy Displays the values of the password policy named policy. With the
-terse flag, outputs the fields as quoted strings separated by tabs. This command requires the inquire privilege. Alias: getpol Examples: kadmin: getpolicy admin Policy: admin Maximum password life: 180 days 00:00:00 Minimum password life: 00:00:00 Minimum password length: 6 Minimum number of password character classes: 2 Number of old keys kept: 5 Reference count: 17
kadmin: getpolicy -terse admin admin 15552000 0 6 2 5 17 kadmin: The "Reference count" is the number of principals using that policy. With the LDAP KDC database module, the reference count field is not meaningful. listpolicies listpolicies [expression]
Retrieves all or some policy names. expression is a shell-style glob
expression that can contain the wild-card characters ?, *, and []. All policy names matching the expression are printed. If no expression is provided, all existing policy names are printed. This command requires the list privilege. Aliases: listpols, getpolicies, getpols. Examples: kadmin: listpols
test-pol
dict-only
once-a-min
test-pol-nopw kadmin: listpols t*
test-pol
test-pol-nopw kadmin: ktadd ktadd [options] principal
ktadd [options] -glob princ-exp
Adds a principal, or all principals matching princ-exp, to a keytab file. Each principal's keys are randomized in the process. The rules
for princ-exp are described in the listprincipals command. This command requires the inquire and changepw privileges. With the
-glob form, it also requires the list privilege. The options are:
-k[eytab] keytab Use keytab as the keytab file. Otherwise, the default keytab is used.
-e enc:salt,... Uses the specified keysalt list for setting the new keys of the principal. See Keysaltlists in kdc.conf(5) for a list of pos‐ sible values.
-q Display less verbose information.
-norandkey Do not randomize the keys. The keys and their version numbers stay unchanged. This option cannot be specified in combination
with the -e option. An entry for each of the principal's unique encryption types is added, ignoring multiple keys with the same encryption type but different salt types. Example:
kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
encryption type aes256-cts-hmac-sha1-96 added to keytab
FILE:/tmp/foo-new-keytab kadmin: ktremove ktremove [options] principal [kvno | all | old] Removes entries for the specified principal from a keytab. Requires no permissions, since this does not require database access. If the string "all" is specified, all entries for that principal are removed; if the string "old" is specified, all entries for that princi‐ pal except those with the highest kvno are removed. Otherwise, the value specified is parsed as an integer, and all entries whose kvno match that integer are removed. The options are:
-k[eytab] keytab Use keytab as the keytab file. Otherwise, the default keytab is used.
-q Display less verbose information. Example: kadmin: ktremove kadmin/admin all Entry for principal kadmin/admin with kvno 3 removed from keytab FILE:/etc/krb5.keytab kadmin: lock Lock database exclusively. Use with extreme caution! This command only works with the DB2 KDC database module. unlock Release the exclusive database lock. listrequests Lists available for kadmin requests. Aliases: lr, ? quit Exit program. If the database was locked, the lock is released. Aliases: exit, q HISTORY The kadmin program was originally written by Tom Yu at MIT, as an interface to the OpenVision Kerberos administration program. SEE ALSO kpasswd(1), kadmind(8) AUTHOR MIT COPYRIGHT
1985-2017, MIT 1.15.1 KADMIN(1)