KADMIN(1) MIT Kerberos KADMIN(1) (NAME) kadmin - Kerberos V5 (SYNOPSIS) kadmin [-O|-N] [-r realm] [-p principal] [-q query] [[-c cache_name]|[-k [-t keytab]]|-n] [-w password] [-s admin_server[:port]] [command args...] kadmin.local [-r realm] [-p principal] [-q query] [-d dbname] [-e enc:salt ...] [-m] [-x db_args] [command args...] (DESCRIPTION) kadmin kadmin.local Kerberos V5 . kadmin.local KDC kadmin kadmind . "kadmin" . kadmin (keytabs) . kadmin kadmind kadmin/admin kadmin/ADMINHOST ( ADMINHOST ) . (credentials cache) -c credentials_cache kadmind . -p -k . kadmin KDC kadmind . kadmin.local KDC KDC KDC . KDC LDAP kadmin.local LDAP . (OPTIONS) -r realm realm . -p principal principal . kadmin /admin ccache USER getpwuid . -k keytab KDC . host/hostname . keytab -t keytab . -t keytab keytab KDC . -k . -n (anonymous). . PKINIT KDC pkinit_anchors krb5.conf . -n @REALM ( @ ) . KDC . . kinit -n . KDC ( ) . . KDC MIT . -c credentials_cache credentials_cache . kadmin/admin kadmin/ADMINHOST ( ADMINHOST ) kinit . kadmin KDC ccache . -w password password . . -q query . -d dbname KDC . LDAP . -s admin_server[:port] kadmin . -m kadmin.local stash . -e "enc:salt ..." keysalt . Keysalt lists kdc.conf . -O AUTH_GSSAPI. -N AUTH_GSSAPI. -x db_args . . . . : o kadmin. o . ( get_principal) . o ( -force ). . o (exit status) . -q . -q . (DATABASE OPTIONS) . DB2 : -x dbname=*filename* DB2 . -x lockiter . [dbmodules] . . . -x unlockiter . . . LDAP : -x host=ldapuri LDAP URI LDAP . -x binddn=bind_dn DN (bind) LDAP . -x bindpwd=password SASL LDAP . stashsrvpw kdb5_ldap_util (stash) . -x sasl_mech=mechanism SASL LDAP . SASL bind DN . .. -x sasl_authcid=name LDAP SASL . .. -x sasl_authzid=name (authorization) LDAP SASL . .. -x sasl_realm=realm LDAP SASL . .. -x debug=level OpenLDAP . level . . .. (COMMANDS) kadm5.acl . add_principal add_principal [options] newprinc newprinc . -policy default . default . -clearpolicy . add . : addprinc ank : -expire expdate ( getdate time) . -pwexpire pwexpdate ( getdate time) . -maxlife maxlife ( getdate time) . -maxrenewlife maxrenewlife ( getdate time) . -kvno kvno . -policy policy . default ( -clearpolicy ). -clearpolicy -policy . {-|+}allow_postdated -allow_postdated . +allow_postdated . {-|+}allow_forwardable -allow_forwardable . +allow_forwardable . {-|+}allow_renewable -allow_renewable . +allow_renewable . {-|+}allow_proxiable -allow_proxiable . +allow_proxiable . {-|+}allow_dup_skey -allow_dup_skey TGT . +allow_dup_skey . {-|+}requires_preauth +requires_preauth kinit . -requires_preauth . +requires_preauth KDC . {-|+}requires_hwauth +requires_hwauth kinit . -requires_hwauth . +requires_hwauth KDC . {-|+}ok_as_delegate +ok_as_delegate okay as delegate . . -ok_as_delegate . {-|+}allow_svr -allow_svr . . -allow_dup_skey . +allow_svr . {-|+}allow_tgs_req -allow_tgs_req (TGS) . +allow_tgs_req . {-|+}allow_tix -allow_tix . +allow_tix . {-|+}needchange +needchange . -needchange . {-|+}password_changing_service +password_changing_service . {-|+}ok_to_auth_as_delegate +ok_to_auth_as_delegate (constrained delegation) . {-|+}no_auth_data_required +no_auth_data_required PAC AD-SIGNEDPATH . {-|+}lockdown_keys +lockdown_keys KDC kadmind . chpass extract . chrand . delete rename krbtgt/* kadmin/* . kadmin.local . -randkey . -nokey . .. -pw password . : . -e enc:salt,... keysalt . Keysalt lists kdc.conf . -x db_princ_args . LDAP : -x dn=dn LDAP . -x linkdn=dn LDAP . -x containerdn=container_dn . -x tktpolicy=policy . : o containerdn linkdn dn . o dn containerdn . o dn containerdn . : kadmin: addprinc jennifer No policy specified for "jennifer@ATHENA.MIT.EDU"; defaulting to no policy. Enter password for principal jennifer@ATHENA.MIT.EDU: Re-enter password for principal jennifer@ATHENA.MIT.EDU: Principal "jennifer@ATHENA.MIT.EDU" created. kadmin: modify_principal modify_principal [options] principal . add_principal -randkey -pw -e . -clearpolicy . modify . : modprinc ( addprinc): -unlock ( ) . rename_principal rename_principal [-force] old_principal new_principal old_principal new_principal . -force . add delete . : renprinc add_alias add_alias alias_princ target_princ alias_princ target_princ . ( target_princ ). add alias_princ modify target_princ . ( ..) : alias delete_principal delete_principal [-force] principal principal . -force . delete . : delprinc change_password change_password [options] principal principal . -randkey -pw . changepw . : cpw : -randkey . -pw password . . -e enc:salt,... keysalt . Keysalt lists kdc.conf . -keepold . krbtgt . : kadmin: cpw systest Enter password for principal systest@BLEEP.COM: Re-enter password for principal systest@BLEEP.COM: Password for systest@BLEEP.COM changed. kadmin: purgekeys purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal ( change_password -keepold) principal . -keepkvno kvno oldest_kvno_to_keep . -all . -all . . modify . get_principal get_principal [-terse] principal . -terse . inquire . : getprinc : kadmin: getprinc tlyu/admin Principal: tlyu/admin@BLEEP.COM Expiration date: [never] Last password change: Mon Aug 12 14:16:47 EDT 1996 Password expiration date: [never] Maximum ticket life: 0 days 10:00:00 Maximum renewable life: 7 days 00:00:00 Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM) Last successful authentication: [never] Last failed authentication: [never] Failed password attempts: 0 Number of keys: 1 Key: vno 1, aes256-cts-hmac-sha384-192 MKey: vno 1 Attributes: Policy: [none] kadmin: getprinc -terse systest systest@BLEEP.COM 3 86400 604800 1 785926535 753241234 785900000 tlyu/admin@BLEEP.COM 786100034 0 0 kadmin: list_principals list_principals [expression] . expression glob ? * [] . . . @ @ . list . : listprincs get_principals getprincs : kadmin: listprincs test* test3@SECURE-TEST.OV.COM test2@SECURE-TEST.OV.COM test1@SECURE-TEST.OV.COM testuser@SECURE-TEST.OV.COM kadmin: get_strings get_strings principal principal . inquire . : getstrs set_string set_string principal name value principal . KDC KDC . KDC : require_auth . . ( ..) session_enctypes . Encryption types kdc.conf . otp (OTP) principal . value JSON type username . pkinit_cert_match PKINIT . pkinit_cert_match krb5.conf . ( ..) pac_privsvr_enctype PAC KDC krbtgt . aes-sha2 krbtgt "aes256-sha1" krbtgt . modify . : setstr : set_string host/foo.mit.edu session_enctypes aes128-cts set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]" del_string del_string principal key principal . delete . : delstr add_policy add_policy [options] policy policy . add . : addpol : -maxlife time ( getdate time) . -minlife time ( getdate time) . -minlength length . -minclasses number . : /. -history number . LDAP KDC . -maxfailure maxnumber . . . maxnumber () . -failurecountinterval failuretime ( getdate time) . failuretime . failuretime () ( ) . -lockoutduration lockouttime ( getdate time) () . () modprinc -unlock . -allowedkeysalts / / . Keysalt lists kdc.conf / (',') . / '-' . : kadmin: add_policy -maxlife "2 days" -minlength 5 guests kadmin: modify_policy modify_policy [options] policy policy . add_policy . modify . : modpol delete_policy delete_policy [-force] policy policy . . . delete . : delpol : kadmin: del_policy guests Are you sure you want to delete the policy "guests"? (yes/no): yes kadmin: get_policy get_policy [ -terse ] policy policy . -terse . inquire . : getpol : kadmin: get_policy admin Policy: admin Maximum password life: 180 days 00:00:00 Minimum password life: 00:00:00 Minimum password length: 6 Minimum number of password character classes: 2 Number of old keys kept: 5 Reference count: 17 kadmin: get_policy -terse admin admin 15552000 0 6 2 5 17 kadmin: "Reference count" . LDAP KDC Reference count . list_policies list_policies [expression] . expression glob ? * [] . . . list . : listpols get_policies getpols. : kadmin: listpols test-pol dict-only once-a-min test-pol-nopw kadmin: listpols t* test-pol test-pol-nopw kadmin: ktadd ktadd [options] principal ktadd [options] -glob princ-exp principal princ-exp keytab . . princ-exp list_principals . inquire changepw . -glob list . : -k[eytab] keytab keytab keytab. keytab . -e enc:salt,... keysalt . Keysalt lists kdc.conf . -q . -norandkey . . -e . . : xst : kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3, encryption type aes256-cts-hmac-sha1-96 added to keytab FILE:/tmp/foo-new-keytab kadmin: ktremove ktremove [options] principal [kvno | all | old] principal keytab . . "all" "old" kvno . kvno . : -k[eytab] keytab keytab keytab. keytab . -q . : ktrem : kadmin: ktremove kadmin/admin all Entry for principal kadmin/admin with kvno 3 removed from keytab FILE:/etc/krb5.keytab kadmin: lock . ! DB2 KDC . unlock . list_requests kadmin . : lr ? quit . . : exit q (HISTORY) kadmin Tom Yu MIT OpenVision . (ENVIRONMENT) kerberos . (SEE ALSO) kpasswd kadmind kerberos (AUTHORS) MIT (COPYRIGHT) 1985-2026, MIT 1.22.2 KADMIN(1)