ktutil(1) User Commands ktutil(1)NAME
ktutil - Kerberos keytab maintenance utility
SYNOPSIS
/usr/bin/ktutil
DESCRIPTION
The ktutil command is an interactive command-line interface utility for managing the keylist in keytab files. You must read in a keytab's
keylist before you can manage it. Also, the user running the ktutil command must have read/write permissions on the keytab. For example,
if a keytab is owned by root, which it typically is, ktutil must be run as root to have the appropriate permissions.
COMMANDS
clear_list Clears the current keylist.
clear
read_kt file Reads a keytab into the current keylist. You must specify a keytab file to read.
rkt file
write_kt file Writes the current keylist to a keytab file. You must specify a keytab file to write. If the keytab file already
wkt file exists, the current keylist is appended to the existing keytab file.
add_entry number Adds an entry to the current keylist. Specify the entry by the keylist slot number.
addent number
delete_entry number Deletes an entry from the current keylist. Specify the entry by the keylist slot number.
delent number
list Lists the current keylist.
l
list_request Lists available requests (commands).
lr
quit Exits utility.
exit
q
EXAMPLES
Example 1: Deleting a principal from a file
The following example deletes the host/denver@ACME.com principal from the /etc/krb5/krb5.keytab file. Notice that if you want to delete an
entry from an existing keytab, you must first write the keylist to a temporary keytab and then overwrite the existing keytab with the the
temporary keytab. This is because the wkt command actually appends the current keylist to an existing keytab, so you can't use it to over-
write a keytab.
example# /usr/krb5/bin/ktutil
ktutil: rkt /etc/krb5/krb5.keytab
ktutil: list
slot KVNO Principal
---- ---- ---------------------------------------
1 8 host/vail@ACME.COM
2 5 host/denver@ACME.COM
ktutil:delent 2
ktutil:l
slot KVNO Principal
---- ---- --------------------------------------
1 8 host/vail@ACME.COM
ktutil:wkt /tmp/krb5.keytab
ktutil:q
example# mv /tmp/krb5.keytab /etc/krb5/krb5.keytab
FILES
/etc/krb5/krb5.keytab keytab file for Kerberos clients
ATTRIBUTES
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWkrbu |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
|Command arguments |Evolving |
+-----------------------------+-----------------------------+
|Command output |Unstable |
+-----------------------------+-----------------------------+
SEE ALSO SEAM(5)SunOS 5.10 11 Apr 2003 ktutil(1)
Check Out this Related Man Page
krb5_keytab_intro(3) HeimdalKerberos5library krb5_keytab_intro(3)NAME
krb5_keytab_intro - The keytab handing functions
Kerberos Keytabs
See the library functions here: Heimdal Kerberos 5 keytab handling functions
Keytabs are long term key storage for servers, their equvalment of password files.
Normally the only function that useful for server are to specify what keytab to use to other core functions like krb5_rd_req()
krb5_kt_resolve(), and krb5_kt_close().
Keytab names
A keytab name is on the form type:residual. The residual part is specific to each keytab-type.
When a keytab-name is resolved, the type is matched with an internal list of keytab types. If there is no matching keytab type, the default
keytab is used. The current default type is FILE.
The default value can be changed in the configuration file /etc/krb5.conf by setting the variable [defaults]default_keytab_name.
The keytab types that are implemented in Heimdal are:
o file store the keytab in a file, the type's name is FILE . The residual part is a filename. For compatibility with other Kerberos
implemtation WRFILE and JAVA14 is also accepted. WRFILE has the same format as FILE. JAVA14 have a format that is compatible with older
versions of MIT kerberos and SUN's Java based installation. They store a truncted kvno, so when the knvo excess 255, they are truncted in
this format.
o keytab store the keytab in a AFS keyfile (usually /usr/afs/etc/KeyFile ), the type's name is AFSKEYFILE. The residual part is a filename.
o memory The keytab is stored in a memory segment. This allows sensitive and/or temporary data not to be stored on disk. The type's name is
MEMORY. Each MEMORY keytab is referenced counted by and opened by the residual name, so two handles can point to the same memory area.
When the last user closes using krb5_kt_close() the keytab, the keys in they keytab is memset() to zero and freed and can no longer be
looked up by name.
Keytab example
This is a minimalistic version of ktutil.
int
main (int argc, char **argv)
{
krb5_context context;
krb5_keytab keytab;
krb5_kt_cursor cursor;
krb5_keytab_entry entry;
krb5_error_code ret;
char *principal;
if (krb5_init_context (&context) != 0)
errx(1, 'krb5_context');
ret = krb5_kt_default (context, &keytab);
if (ret)
krb5_err(context, 1, ret, 'krb5_kt_default');
ret = krb5_kt_start_seq_get(context, keytab, &cursor);
if (ret)
krb5_err(context, 1, ret, 'krb5_kt_start_seq_get');
while((ret = krb5_kt_next_entry(context, keytab, &entry, &cursor)) == 0){
krb5_unparse_name(context, entry.principal, &principal);
printf('principal: %s0, principal);
free(principal);
krb5_kt_free_entry(context, &entry);
}
ret = krb5_kt_end_seq_get(context, keytab, &cursor);
if (ret)
krb5_err(context, 1, ret, 'krb5_kt_end_seq_get');
ret = krb5_kt_close(context, keytab);
if (ret)
krb5_err(context, 1, ret, 'krb5_kt_close');
krb5_free_context(context);
return 0;
}
Version 1.5.2 11 Jan 2012 krb5_keytab_intro(3)