[7767] in Kerberos
Re: Mundane kerberos question: srvtab management
daemon@ATHENA.MIT.EDU (Barry Jaspan)
Wed Aug 14 12:35:16 1996
Date: Wed, 14 Aug 1996 12:21:18 -0400
From: "Barry Jaspan" <bjaspan@MIT.EDU>
To: Ken Hornstein <kenh@cmf.nrl.navy.mil>
Cc: kerberos@MIT.EDU
In-Reply-To: [7762]
The new KADM5 administration system that will be released with beta 7
has improved keytab-handling features. Specifically, the kadmin
client has commands to add (ktadd) and remove (ktremove) entries from
keytabs. These commands can be run safely from anywhere on the
network (all kadm5 traffic is encrypted). This does not completely
solve the keytab distribution problem, but it definately gives you a
better basic tool to work with.
From the man page:
ktadd [-k keytab] [-q] [principal | -glob princ-exp] [...]
Adds a principal or all principals matching princ-exp
to a keytab. Requires the inquire privilege. An entry
for each of the principal's unique encryption types is
added, ignoring multiple keys with the same encryption
type but different salt types. If the -k argument is
not specified, the default keytab /etc/v5srvtab is
used. If the -q option is specified, less verbose
status information is displayed.
The -glob option requires the list privilege. princ-
exp follows the same rules described for the
get_principals command.
EXAMPLE:
kadmin: ktadd -k /krb5/kadmind.keytab kadmin/admin kadmin/change-w
kadmin: Entry for principal kadmin/admin@ATHENA.MIT.EDU with
kvno 3, encryption type DES-CBC-CRC added to keytab
WRFILE:/krb5/kadmind.keytab.
kadmin: Entry for principal kadmin/changepw@ATHENA.MIT.EDU
with kvno 3, encryption type DES-CBC-CRC added to keytab
WRFILE:/krb5/kadmind.keytab.
kadmin:
ktremove [-k keytab] [-q] principal [kvno | all | old]
Removes entries for the specified principal from a key-
tab. Requires no permissions, since this does not
require database access. If the string "all" is speci-
fied, all entries for that principal are removed; if
the string "old" is specified, all entries for that
principal except those with the highest kvno are
removed. Otherwise, the value specified is parsed as
an integer, and all entries whose kvno match that
integer are removed. If the -k argument is not speci-
feid, the default keytab /etc/v5srvtab is used. If the
-q option is specified, less verbose status information
is displayed.
EXAMPLE:
kadmin: ktremove -k /krb5/kadmind.keytab kadmin/admin
kadmin: Entry for principal kadmin/admin with kvno 3 removed
from keytab WRFILE:/krb5/kadmind.keytab.
kadmin:
Also note that the kadmin program itself is designed to make it easy
to use a keytab as the source of authentication, so that (for example)
you can authenticate to the server as host/machine.domain instead of a
regular admin principal. Since all principals are allowed to change
their own keys, this means that a host can re-key itself with kadmin
without requiring human intervention and without an admin's password
having to be typed in or available online.
Barry
