Updated kadmind.8 and kadmin.8.

kadmin/kadmin.8

@@ -146,7 +146,8 @@ enctypes.
 .Oc
 .Ar principal...
 .Bd -ragged -offset indent
-Creates a keytab with the keys of the specified principals.
+Creates a keytab with the keys of the specified principals.  Requires
+get-keys rights.
 .Ed
 .Pp
 .Nm get
@@ -228,6 +229,7 @@ kadmin -l modify -a -disallow-proxiable user
 .Ed
 .Pp
 .Nm passwd
+.Op Fl Fl keepold
 .Op Fl r | Fl Fl random-key
 .Op Fl Fl random-password
 .Oo Fl p Ar string \*(Ba Xo
@@ -260,6 +262,7 @@ Lists the operations you are allowed to perform. These include
 .Li delete ,
 .Li del_enctype ,
 .Li get ,
+.Li get-keys ,
 .Li list ,
 and
 .Li modify .

kadmin/kadmind.8

@@ -107,6 +107,8 @@ add
 .It
 get
 .It
+get-keys
+.It
 all
 .El
 .Pp
@@ -147,10 +149,11 @@ compiled in defaults:
 .D1 Nm Fl Fl ports Ns Li "=\*[q]+ 4711\*[q] &"
 .Pp
 This acl file will grant Joe all rights, and allow Mallory to view and
-add host principals.
+add host principals, as well as extract host principal keys (e.g., into
+keytabs).
 .Bd -literal -offset indent
 joe/admin@EXAMPLE.COM      all
-mallory/admin@EXAMPLE.COM  add,get  host/*@EXAMPLE.COM
+mallory/admin@EXAMPLE.COM  add,get-keys  host/*@EXAMPLE.COM
 .Ed
 .\".Sh DIAGNOSTICS
 .Sh SEE ALSO