KADMIN(8)

NAME
kadmin - network utility for Kerberos database administration

SYNOPSIS
kadmin [-u user] [-r default_realm] [-m] [-t]

DESCRIPTION
This utility provides a unified administration interface to the Kerberos master database. Kerberos administrators use kadmin to register new users and services to the master database, and to change information about existing database entries. For instance, an administrator can use kadmin to change a user's Kerberos password. A Kerberos administrator is a user with an ``admin'' instance whose name appears on one of the Kerberos administration access control lists. If the -u option is used, user will be used as the administrator instead of the local user. If the -r option is used, default_realm will be used as the default realm for transactions. Otherwise, the local realm will be used by default. If the -m option is used, multiple requests will be permitted on only one entry of the admin password. Some sites won't support this option. The -t option is used to tell kadmin to use the existing ticket file instead of creating a new one. The kadmin program communicates over the network with the kadmind program, which runs on the machine housing the Kerberos master database. The kadmind creates new entries and makes modifications to the database. When you enter the kadmin command, the program displays a message that welcomes you and explains how to ask for help. Then kadmin waits for you to enter commands (which are described below). It then asks you for your admin password before accessing the database. All commands can be abbreviated as long as they are unique. Some short versions of the commands are also recognized for backwards compatibility. Use the add_new_key (or ank for short) command to register a new principal with the master database. The command requires one argument, the principal's name. The name given can be fully qualified using the standard name.instance@realm convention. You are asked to enter your admin password, then prompted twice to enter the principal's new password. If no realm is specified, the local realm is used unless another was given on the commandline with the -r flag. If no instance is specified, a null instance is used. If a realm other than the default realm is specified, you will need to supply your admin password for the other realm. Use the change_password (cpw) to change a principal's Kerberos password. The command requires one argument, the principal's name. You are asked to enter your admin password, then prompted twice to enter the principal's new password. The name given can be fully qualified using the standard name.instance@realm convention. Use the change_key (ckey) if you have a need to change the raw key of a particular principal. In other words, if you do not want to input a DES key instead of a password that will get converted into a DES key. Use the change_admin_password (cap) to change your admin instance password. This command requires no arguments. It prompts you for your old admin password, then prompts you twice to enter the new admin password. If this is your first command, the default realm is used. Otherwise, the realm used in the last command is used. Use the del_entry (del) to remove an entry from the kerberos database. Use the mod_entry (mod) to modify a particular entry, for example to change the expire date. Use the destroy_tickets (dest) command to destroy your admin tickets explicitly. Use the list_requests (lr) command to get a list of possible commands. Use the help command to display kadmin's various help messages. If entered without an argument, help displays a general help message. You can get detailed information on specific kadmin commands by entering help command_name. To quit the program, type quit.

BUGS
The user interface is primitive, and the command names could be better.

SEE ALSO
kerberos(1), kadmind(8), kpasswd(1), ksrvutil(8)
``A Subsystem Utilities Package for UNIX'' by Ken Raeburn

AUTHORS
Jeffrey I. Schiller, MIT Project Athena
Emanuel Jay Berkenbilt, MIT Project Athena