KTUTIL(1)

NAME
ktutil - manage Kerberos keytabs

SYNOPSIS
ktutil [-k keytab - -keytab=keytab] [-v | - -verbose] [- -version] [-h | - -help] command [args]

DESCRIPTION
ktutil is a program for managing keytabs. Supported options:

-v, - -verbose
    Verbose output.

command can be one of the following:

add [-p principal] [- -principal=principal] [-V kvno] [- -kvno=kvno] [-e enctype] [- -keepold | - -keepallold | - -pruneall] [- -enctype=enctype] [-w password] [- -password=password] [-r] [- -random] [-s] [- -no-salt] [-H] [- -hex]
    Adds a key to the keytab. Options that are not specified will be prompted for. This requires that you know the password or the hex key of the principal to add; if what you really want is to add a new principal to the keytab, you should consider the get command, which talks to the kadmin server.

change [-r realm] [- -realm=realm] [- -keepold | - -keepallold | - -pruneall] [- -enctype=enctype] [- -a host] [- -admin-server=host] [- -s port] [- -server-port=port]
    Update one or several keys to new versions. By default, use the admin server for the realm of a keytab entry. Otherwise it will use the values specified by the options.

    If no principals are given, all the ones in the keytab are updated.

copy [- -copy-duplicates] keytab-src keytab-dest
    Copies all the entries from keytab-src to keytab-dest. Because entries already in keytab-dest are kept, this command functions to merge keytabs. Entries for the same principal, key version number, and encryption type in the keytab-src that are also in the keytab-dest will not be copied to the keytab-dest unless the - -copy-duplicates option is given.

get [-p admin principal] [- -principal=admin principal] [-e enctype] [- -no-create] [- -no-change-keys] [- -keepold | - -keepallold | - -pruneall] [- -enctypes=enctype] [-r realm] [- -realm=realm] [-a admin server] [- -admin-server=admin server] [-s server port] [- -server-port=server port] principal ...

    For each principal, get a the principal's keys from the KDC via the kadmin protocol, creating the principal if it doesn't exist (unless - -no-create is given), and changing its keys to new random keys (unless - -no-change-keys is given).

    If no realm is specified, the realm to operate on is taken from the first principal.

import [JSON-FILE]
    Read an array of keytab entries in a JSON file and copy them to the keytab. Use the list command with its - -json option and - -keys option to export a keytab.

list [- -keys] [- -timestamp [[- -json]]]
    List the keys stored in the keytab. Use the - -json and - -keys options to export a keytab as JSON for importing with the import command.

remove [-p principal] [- -principal=principal] [-V -kvno] [- -kvno=kvno] [-e -enctype] [- -enctype=enctype]
    Removes the specified key or keys. Not specifying a kvno removes keys with any version number. Not specifying an enctype removes keys of any type.

merge [- -copy-duplicates] keytab-src keytab-dest
    An alias for the copy command.

rename from-principal to-principal
    Renames all entries for the from-principal in the keytab from-principal to to-principal.

purge [- -age=age]
    Removes all old versions of a key for which there is a newer version that is at least age (default one week) old. Note that this does not update the KDC database. The kadmin(1) command has a prune command that can do this on the KDC side.

ENVIRONMENT

KRB5_KTNAME
    Specifies the default keytab.

KRB5_CONFIG
    The file name of krb5.conf, the default being /etc/krb5.conf.

KEYTAB NAMING
The syntax for the value of the ‘KRB5_KTNAME’ environment variable and [-k keytab - -keytab=keytab] options is ‘TYPE:name’ where the TYPE is one of ‘FILE’, ‘HDBGET’, ‘HDB’, or ‘ANY’, and the name syntax is specific to the keytab type.

For the FILE keytab type the name is the path to a file whose format is the well-known keytab file format used by MIT Kerberos, Heimdal, Java, and others.

For the HDB and HDBGET keytab types the name syntax is ‘[<path>][:mkey=<path>]’ where the first path is the path to the HDB and the second path is the path to the master key file. Note that to use the HDB and HDBGET keytab types in a program linked with Heimdal libraries one first load the ‘libhdb’ library and then register their keytab methods using krb5_kt_register(3). Note also that ktutil does not load and register the HDB and HDBGET keytab types at this time.

The ANY keytab type name syntax is a sequence of other keytab names (including their TYPE: prefix) separated by commas. Note that there is no escape sequence for commas in keytab names.

SEE ALSO
kadmin(1) kinit(1) krb5_kt_register(3)