Man1 - kadmin.1

#+begin_quote add_principal [/options/] newprinc

#+end_quote

Creates the principal newprinc, prompting twice for a password. If no password policy is specified with the -policy option, and the policy named default is assigned to the principal if it exists. However, creating a policy named default will not automatically assign this policy to previously existing principals. This policy assignment can be suppressed with the -clearpolicy option.

This command requires the add privilege.

Aliases: addprinc, ank

Options:

-expire expdate

(getdate string) The expiration date of the principal.

-pwexpire pwexpdate

(getdate string) The password expiration date.

-maxlife maxlife

(duration or getdate string) The maximum ticket life for the principal.

-maxrenewlife maxrenewlife

(duration or getdate string) The maximum renewable life of tickets for the principal.

-kvno kvno

The initial key version number.

-policy policy

The password policy used by this principal. If not specified, the policy default is used if it exists (unless -clearpolicy is specified).

-clearpolicy

Prevents any policy from being assigned when -policy is not specified.

{-|+}*allow_postdated*

-allow_postdated prohibits this principal from obtaining postdated tickets. +allow_postdated clears this flag.

{-|+}*allow_forwardable*

-allow_forwardable prohibits this principal from obtaining forwardable tickets. +allow_forwardable clears this flag.

{-|+}*allow_renewable*

-allow_renewable prohibits this principal from obtaining renewable tickets. +allow_renewable clears this flag.

{-|+}*allow_proxiable*

-allow_proxiable prohibits this principal from obtaining proxiable tickets. +allow_proxiable clears this flag.

{-|+}*allow_dup_skey*

-allow_dup_skey disables user-to-user authentication for this principal by prohibiting others from obtaining a service ticket encrypted in this principal’s TGT session key. +allow_dup_skey clears this flag.

{-|+}*requires_preauth*

+requires_preauth requires this principal to preauthenticate before being allowed to kinit. -requires_preauth clears this flag. When +requires_preauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client’s initial authentication was performed using preauthentication.

{-|+}*requires_hwauth*

+requires_hwauth requires this principal to preauthenticate using a hardware device before being allowed to kinit. -requires_hwauth clears this flag. When +requires_hwauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client’s initial authentication was performed using a hardware device to preauthenticate.

{-|+}*ok_as_delegate*

+ok_as_delegate sets the okay as delegate flag on tickets issued with this principal as the service. Clients may use this flag as a hint that credentials should be delegated when authenticating to the service. -ok_as_delegate clears this flag.

{-|+}*allow_svr*

-allow_svr prohibits the issuance of service tickets for this principal. In release 1.17 and later, user-to-user service tickets are still allowed unless the -allow_dup_skey flag is also set. +allow_svr clears this flag.

{-|+}*allow_tgs_req*

-allow_tgs_req specifies that a Ticket-Granting Service (TGS) request for a service ticket for this principal is not permitted. +allow_tgs_req clears this flag.

{-|+}*allow_tix*

-allow_tix forbids the issuance of any tickets for this principal. +allow_tix clears this flag.

{-|+}*needchange*

+needchange forces a password change on the next initial authentication to this principal. -needchange clears this flag.

{-|+}*password_changing_service*

+password_changing_service marks this principal as a password change service principal.

{-|+}*ok_to_auth_as_delegate*

+ok_to_auth_as_delegate allows this principal to acquire forwardable tickets to itself from arbitrary users, for use with constrained delegation.

{-|+}*no_auth_data_required*

+no_auth_data_required prevents PAC or AD-SIGNEDPATH data from being added to service tickets for the principal.

{-|+}*lockdown_keys*

+lockdown_keys prevents keys for this principal from leaving the KDC via kadmind. The chpass and extract operations are denied for a principal with this attribute. The chrand operation is allowed, but will not return the new keys. The delete and rename operations are also denied if this attribute is set, in order to prevent a malicious administrator from replacing principals like krbtgt/* or kadmin/* with new principals without the attribute. This attribute can be set via the network protocol, but can only be removed using kadmin.local.

-randkey

Sets the key of the principal to a random value.

-nokey

Causes the principal to be created with no key. New in release 1.12.

-pw password

Sets the password of the principal to the specified string and does not prompt for a password. Note: using this option in a shell script may expose the password to other users on the system via the process list.

-e enc:/salt/,…

Uses the specified keysalt list for setting the keys of the principal. See Keysalt_lists in kdc.conf(5) for a list of possible values.

-x db_princ_args

Indicates database-specific options. The options for the LDAP database module are:

*-x dn=*/dn/

Specifies the LDAP object that will contain the Kerberos principal being created.

*-x linkdn=*/dn/

Specifies the LDAP object to which the newly created Kerberos principal object will point.

*-x containerdn=*/container_dn/

Specifies the container object under which the Kerberos principal is to be created.

*-x tktpolicy=*/policy/

Associates a ticket policy to the Kerberos principal.

NOTE:

#+begin_quote

#+begin_quote

#+begin_quote

• The containerdn and linkdn options cannot be specified with the dn option.
• If the dn or containerdn options are not specified while adding the principal, the principals are created under the principal container configured in the realm or the realm container.
• dn and containerdn should be within the subtrees or principal container configured in the realm.

#+end_quote #+end_quote #+end_quote

Example:

#+begin_quote

      kadmin: addprinc jennifer
      No policy specified for "jennifer@ATHENA.MIT.EDU";
      defaulting to no policy.
      Enter password for principal jennifer@ATHENA.MIT.EDU:
      Re-enter password for principal jennifer@ATHENA.MIT.EDU:
      Principal "jennifer@ATHENA.MIT.EDU" created.
      kadmin:

#+end_quote

#+begin_quote modify_principal [/options/] principal

#+end_quote

Modifies the specified principal, changing the fields as specified. The options to add_principal also apply to this command, except for the -randkey, -pw, and -e options. In addition, the option -clearpolicy will clear the current policy of a principal.

This command requires the modify privilege.

Alias: modprinc

Options (in addition to the addprinc options):

-unlock

Unlocks a locked principal (one which has received too many failed authentication attempts without enough time between them according to its password policy) so that it can successfully authenticate.

#+begin_quote rename_principal [*-force*] old_principal new_principal

#+end_quote

Renames the specified old_principal to new_principal. This command prompts for confirmation, unless the -force option is given.

This command requires the add and delete privileges.

Alias: renprinc

#+begin_quote delete_principal [*-force*] principal

#+end_quote

Deletes the specified principal from the database. This command prompts for deletion, unless the -force option is given.

This command requires the delete privilege.

Alias: delprinc

#+begin_quote change_password [/options/] principal

#+end_quote

Changes the password of principal. Prompts for a new password if neither -randkey or -pw is specified.

This command requires the changepw privilege, or that the principal running the program is the same as the principal being changed.

Alias: cpw

The following options are available:

-randkey

Sets the key of the principal to a random value.

-pw password

Set the password to the specified string. Using this option in a script may expose the password to other users on the system via the process list.

-e enc:/salt/,…

Uses the specified keysalt list for setting the keys of the principal. See Keysalt_lists in kdc.conf(5) for a list of possible values.

-keepold

Keeps the existing keys in the database. This flag is usually not necessary except perhaps for krbtgt principals.

Example:

#+begin_quote

      kadmin: cpw systest
      Enter password for principal systest@BLEEP.COM:
      Re-enter password for principal systest@BLEEP.COM:
      Password for systest@BLEEP.COM changed.
      kadmin:

#+end_quote

#+begin_quote purgekeys [*-all*|*-keepkvno* oldest_kvno_to_keep/] /principal

#+end_quote

Purges previously retained old keys (e.g., from change_password -keepold) from principal. If -keepkvno is specified, then only purges keys with kvnos lower than oldest_kvno_to_keep. If -all is specified, then all keys are purged. The -all option is new in release 1.12.

This command requires the modify privilege.

#+begin_quote get_principal [*-terse*] principal

#+end_quote

Gets the attributes of principal. With the -terse option, outputs fields as quoted tab-separated strings.

This command requires the inquire privilege, or that the principal running the the program to be the same as the one being listed.

Alias: getprinc

Examples:

#+begin_quote

      kadmin: getprinc tlyu/admin
      Principal: tlyu/admin@BLEEP.COM
      Expiration date: [never]
      Last password change: Mon Aug 12 14:16:47 EDT 1996
      Password expiration date: [never]
      Maximum ticket life: 0 days 10:00:00
      Maximum renewable life: 7 days 00:00:00
      Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
      Last successful authentication: [never]
      Last failed authentication: [never]
      Failed password attempts: 0
      Number of keys: 1
      Key: vno 1, aes256-cts-hmac-sha384-192
      MKey: vno 1
      Attributes:
      Policy: [none]

      kadmin: getprinc -terse systest
      systest@BLEEP.COM   3    86400     604800    1
      785926535 753241234 785900000
      tlyu/admin@BLEEP.COM     786100034 0    0
      kadmin:

#+end_quote

#+begin_quote list_principals [/expression/]

#+end_quote

Retrieves all or some principal names. expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []. All principal names matching the expression are printed. If no expression is provided, all principal names are printed. If the expression does not contain an @ character, an @ character followed by the local realm is appended to the expression.

This command requires the list privilege.

Alias: listprincs, get_principals, getprincs

Example:

#+begin_quote

      kadmin:  listprincs test*
      test3@SECURE-TEST.OV.COM
      test2@SECURE-TEST.OV.COM
      test1@SECURE-TEST.OV.COM
      testuser@SECURE-TEST.OV.COM
      kadmin:

#+end_quote

#+begin_quote get_strings principal

#+end_quote

Displays string attributes on principal.

This command requires the inquire privilege.

Alias: getstrs

#+begin_quote set_string principal name value

#+end_quote

Sets a string attribute on principal. String attributes are used to supply per-principal configuration to the KDC and some KDC plugin modules. The following string attribute names are recognized by the KDC:

require_auth

Specifies an authentication indicator which is required to authenticate to the principal as a service. Multiple indicators can be specified, separated by spaces; in this case any of the specified indicators will be accepted. (New in release 1.14.)

session_enctypes

Specifies the encryption types supported for session keys when the principal is authenticated to as a server. See Encryption_types in kdc.conf(5) for a list of the accepted values.

otp

Enables One Time Passwords (OTP) preauthentication for a client principal. The value is a JSON string representing an array of objects, each having optional type and username fields.

pkinit_cert_match

Specifies a matching expression that defines the certificate attributes required for the client certificate used by the principal during PKINIT authentication. The matching expression is in the same format as those used by the pkinit_cert_match option in krb5.conf(5). (New in release 1.16.)

This command requires the modify privilege.

Alias: setstr

Example:

#+begin_quote

      set_string host/foo.mit.edu session_enctypes aes128-cts
      set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"

#+end_quote

#+begin_quote del_string principal key

#+end_quote

Deletes a string attribute from principal.

This command requires the delete privilege.

Alias: delstr

#+begin_quote add_policy [/options/] policy

#+end_quote

Adds a password policy named policy to the database.

This command requires the add privilege.

Alias: addpol

The following options are available:

-maxlife time

(duration or getdate string) Sets the maximum lifetime of a password.

-minlife time

(duration or getdate string) Sets the minimum lifetime of a password.

-minlength length

Sets the minimum length of a password.

-minclasses number

Sets the minimum number of character classes required in a password. The five character classes are lower case, upper case, numbers, punctuation, and whitespace/unprintable characters.

-history number

Sets the number of past keys kept for a principal. This option is not supported with the LDAP KDC database module.

-maxfailure maxnumber

Sets the number of authentication failures before the principal is locked. Authentication failures are only tracked for principals which require preauthentication. The counter of failed attempts resets to 0 after a successful attempt to authenticate. A maxnumber value of 0 (the default) disables lockout.

-failurecountinterval failuretime

(duration or getdate string) Sets the allowable time between authentication failures. If an authentication failure happens after failuretime has elapsed since the previous failure, the number of authentication failures is reset to 1. A failuretime value of 0 (the default) means forever.

-lockoutduration lockouttime

(duration or getdate string) Sets the duration for which the principal is locked from authenticating if too many authentication failures occur without the specified failure count interval elapsing. A duration of 0 (the default) means the principal remains locked out until it is administratively unlocked with modprinc -unlock.

-allowedkeysalts

Specifies the key/salt tuples supported for long-term keys when setting or changing a principal’s password/keys. See Keysalt_lists in kdc.conf(5) for a list of the accepted values, but note that key/salt tuples must be separated with commas (’,’) only. To clear the allowed key/salt policy use a value of ’-’.

Example:

#+begin_quote

      kadmin: add_policy -maxlife "2 days" -minlength 5 guests
      kadmin:

#+end_quote

#+begin_quote modify_policy [/options/] policy

#+end_quote

Modifies the password policy named policy. Options are as described for add_policy.

This command requires the modify privilege.

Alias: modpol

#+begin_quote delete_policy [*-force*] policy

#+end_quote

Deletes the password policy named policy. Prompts for confirmation before deletion. The command will fail if the policy is in use by any principals.

This command requires the delete privilege.

Alias: delpol

Example:

#+begin_quote

      kadmin: del_policy guests
      Are you sure you want to delete the policy "guests"?
      (yes/no): yes
      kadmin:

#+end_quote

#+begin_quote get_policy [ -terse ] policy

#+end_quote

Displays the values of the password policy named policy. With the -terse flag, outputs the fields as quoted strings separated by tabs.

This command requires the inquire privilege.

Alias: getpol

Examples:

#+begin_quote

      kadmin: get_policy admin
      Policy: admin
      Maximum password life: 180 days 00:00:00
      Minimum password life: 00:00:00
      Minimum password length: 6
      Minimum number of password character classes: 2
      Number of old keys kept: 5
      Reference count: 17

      kadmin: get_policy -terse admin
      admin     15552000  0    6    2    5    17
      kadmin:

#+end_quote

The “Reference count” is the number of principals using that policy. With the LDAP KDC database module, the reference count field is not meaningful.

#+begin_quote list_policies [/expression/]

#+end_quote

Retrieves all or some policy names. expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []. All policy names matching the expression are printed. If no expression is provided, all existing policy names are printed.

This command requires the list privilege.

Aliases: listpols, get_policies, getpols.

Examples:

#+begin_quote

      kadmin:  listpols
      test-pol
      dict-only
      once-a-min
      test-pol-nopw

      kadmin:  listpols t*
      test-pol
      test-pol-nopw
      kadmin:

#+end_quote

#+begin_quote

      ktadd [options] principal
      ktadd [options] -glob princ-exp

#+end_quote

Adds a principal, or all principals matching princ-exp, to a keytab file. Each principal’s keys are randomized in the process. The rules for princ-exp are described in the list_principals command.

This command requires the inquire and changepw privileges. With the -glob form, it also requires the list privilege.

The options are:

-k[eytab] keytab

Use keytab as the keytab file. Otherwise, the default keytab is used.

-e enc:/salt/,…

Uses the specified keysalt list for setting the new keys of the principal. See Keysalt_lists in kdc.conf(5) for a list of possible values.

-q

Display less verbose information.

-norandkey

Do not randomize the keys. The keys and their version numbers stay unchanged. This option cannot be specified in combination with the -e option.

An entry for each of the principal’s unique encryption types is added, ignoring multiple keys with the same encryption type but different salt types.

Alias: xst

Example:

#+begin_quote

      kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu
      Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
           encryption type aes256-cts-hmac-sha1-96 added to keytab
           FILE:/tmp/foo-new-keytab
      kadmin:

#+end_quote

#+begin_quote ktremove [options] principal [/kvno/ | all | /old/]

#+end_quote

Removes entries for the specified principal from a keytab. Requires no permissions, since this does not require database access.

If the string “all” is specified, all entries for that principal are removed; if the string “old” is specified, all entries for that principal except those with the highest kvno are removed. Otherwise, the value specified is parsed as an integer, and all entries whose kvno match that integer are removed.

The options are:

-k[eytab] keytab

Use keytab as the keytab file. Otherwise, the default keytab is used.

-q

Display less verbose information.

Alias: ktrem

Example:

#+begin_quote

      kadmin: ktremove kadmin/admin all
      Entry for principal kadmin/admin with kvno 3 removed from keytab
           FILE:/etc/krb5.keytab
      kadmin:

#+end_quote

Lock database exclusively. Use with extreme caution! This command only works with the DB2 KDC database module.

Release the exclusive database lock.

Lists available for kadmin requests.

Aliases: lr, ?

Exit program. If the database was locked, the lock is released.

Aliases: exit, q