kadmin

kadmin administers the realm over the network (authenticating as an admin principal); kadmin.local does the same on the KDC itself, straight into the database. addprinc adds a principal (-pw with a password, -randkey with a random key for a server), getprinc/listprincs inspect them, and ktadd SERVICE writes a service's key into a keytab (default /etc/krb5.keytab) so the server can open tickets, bumping the key version. kdb5_util create makes the realm's database; ksu USER becomes another user by Kerberos ticket instead of a password, checking the target's ~/.k5login.

kadmin command usage

kadmin -p admin/admin -w PASSWORD -q 'QUERY'
kadmin.local -q 'addprinc [-pw PASS | -randkey] PRINCIPAL'
kadmin ... -q 'ktadd SERVICE'
ksu USER [-e COMMAND]

Options

-q 'QUERY'

run one command and exit (addprinc, ktadd, getprinc, listprincs)

-pw PASS / -randkey

addprinc: a password, or a random key (for servers)

ktadd SERVICE

write the service's key into a keytab

-p admin/admin -w PASS

kadmin: authenticate as this admin principal

kadmin examples

kadmin.local -q 'addprinc -pw correct-horse alice'

Adds the user alice with a password, on the KDC.

kadmin -p admin/admin -w admin-secret -q 'ktadd host/shellserver.lab'

Writes the server's key into its keytab, so it can accept logins.

klist -k /etc/krb5.keytab

Shows the principals and key versions in a keytab.

Pitfalls

• ktadd rotates the key: old tickets for that service stop opening, so rebuild a keytab before clients get new tickets.
• A keytab lets its holder impersonate the service; keep it readable only by root.

Run it on real machines