
KADMIN(8)               OpenBSD System Manager's Manual              KADMIN(8)

NAME
     kadmin - network utility for Kerberos database administration

SYNOPSIS
     kadmin [-p principal] [-u username] [-r realm] [-m] [-T timeout] [-t]
     [--version] [-h] [--help] [command]

DESCRIPTION
     This utility provides a unified administration interface to the Kerberos
     master database.  Kerberos administrators use kadmin to register new
     users and services to the master database, and to change information
     about existing database entries, such as changing a user's Kerberos pass-
     word. A Kerberos administrator is a user with an ``admin'' instance whose
     name appears on one of the Kerberos administration access control lists.

     Supported options:

     -p principal
             This is the adminstrator principal to use when talking to the
             Kadmin server. The default is taken from the users environment.

     -r realm
             This is the default realm to use for transactions. Default is the
             local realm.

     -u username
             This is similar to -p, but specifies a name, that gets appended
             with a ``admin'' instance.

     -T timeout
             To prevent someone from walking up to an unguarded terminal and
             doing malicious things, administrator tickets are destroyed after
             a period of inactivity. This flag changes the timeout from the
             default of one minute. A timeout of zero seconds disables this
             functionality.

     -m      Historically kadmin destroyed tickets after every command; this
             flag used to stop this behaviour (only destroying tickets upon
             exit). Now it's just a synonym for -T 0.

     -t      Use existing tickets (if any are available), this also disbles
             timeout, and doesn't destroy any tickets upon exit.

             These tickets have to be for the changepw.kerberos service.  Use
             kinit -p to acquire them.

     The kadmin program communicates over the network with the kadmind pro-
     gram, which runs on the machine housing the Kerberos master database, and
     does the actual modifications to the database.

     When you enter the kadmin command, the program displays a message that
     welcomes you and explains how to ask for help.  Then kadmin waits for you
     to enter commands (which are described below).  It then asks you for your
     administrator's password before accessing the database.

     All commands can be abbreviated as long as they are unique.  Some short
     versions of the commands are also recognized for backwards compatibility.

     Recognised commands:

     add_new_key principal
             Creates a new principal in the Kerberos database. You give the
             name of the new principal as an argument. You will then be asked
             for a maximum ticket lifetime, attributes, the expiration date of
             the principal, and finally the password of the principal.

     change_password principal
             Changes a principal's password. You will be prompted for the new
             password.

     change_key principal
             This is the same as change_password, but the password is given as
             a raw DES key (for the few occations when you need this).

     change_admin_password
             Changes your own admin password. It will prompt you for you old
             and new passwords.

     del_entry principal
             Removes principal from the database.

     get_entry principal
             Show various information for the given principal. Note that the
             key is shown as zeros.

     mod_entry principal
             Modifies a particular entry, for instance to change the expira-
             tion date.

     destroy_tickets
             Destroys your admin tickets explicitly.

     quit    Obvious.

SEE ALSO
     kerberos(1), kadmind(8), kinit(1), ksrvutil(8)

AUTHORS
     Jeffrey I. Schiller, MIT Project Athena

     Emanuel Jay Berkenbilt, MIT Project Athena

BUGS
     The user interface is primitive, and the command names could be better.

 KTH-KRB                       February 3, 1998                              2
