kdb_util(8krb)kdb_util(8krb)Name
kdb_util - Kerberos database utility
Syntax
/var/dss/kerberos/bin/kdb_util operation filename [ database ]
Arguments
operation
Function to perform on the database. The operation argument must be one of the following values:
load Converts the database in file filename, to format and overwrites the database specified.
dump Converts the database into form, and writes the result to file, filename.
slave_dump
Performs the same function as dump, and creates the file when finished. The is used by to determine if a slave_dump is in
progress, or if it did not complete successfully.
new_master_key
Prompts you for the old key of the Kerberos database as well as a new master key. It converts the database into format
and, at the same time, decrypts those sections of the database encrypted with the old master key and re-encrypts them with
the new master key. The result is written to the file, filename.
filename The name of the source file for the load operation or the destination file for the operations: dump, slave_dump, and new_mas-
ter_key.
database The name of the database. If the argument is not included, the Kerberos database is stored in files and by default.
Description
The command allows the Kerberos administrator to perform several functions on the entire Kerberos database of a master or slave Kerberos
server in one operation. The database argument specifies the name of the Kerberos database. The Kerberos database utility reads from and
writes to the Kerberos database and, in addition, it reads from and writes to a file in format: filename. A file is an ASCII representa-
tion of a Kerberos database. The functions that can be specified by the operation argument are listed in the Arguments section.
Whenever the Kerberos database is changed by the modification time of is updated. The file indicates the age of the database.
Files
See Also
krb_dbase(5krb), kdb_init(8krb), kdb_edit(8krb), kdb_destroy(8krb), kstash(8krb)kdb_util(8krb)
Check Out this Related Man Page
kdb5_util(1M)kdb5_util(1M)NAME
kdb5_util - Kerberos Database maintenance utility
SYNOPSIS
/usr/sbin/kdb5_util [-d dbname] [-f stashfile_name] [-k mkeytype] [-m ] [-M mkeyname] [-P password] [-r realm] cmd
The kdb5_util utility enables you to create, dump, load, and destroy the Kerberos V5 database. You can also use kdb5_util to create a stash
file containing the Kerberos database master key.
The following options are supported:
-d dbname
Specify the database name. .db is appended to whatever name is specified. You can specify an absolute path. If you do not specify the
-d option, the default database name is /var/krb5/principal.
-f stashfile_name
Specify the stash file name. You can specify an absolute path.
-k mkeytype
Specify the master key type. Valid values are des3-cbc-sha1, des-cbc-crc, des-cbc-md5, des-cbc-raw, arcfour-hmac-md5, arcfour-hmac-
md5-exp, aes128-cts-hmac-sha1-96, and aes256-cts-hmac-sha1-96.
-m
Enter the master key manually.
-M mkeyname
Specify the master key name.
-P password
Use the specified password instead of the stash file.
-r realm
Use realm as the default database realm.
The following operands are supported:
cmd Specifies whether to create, destroy, dump, or load the database, or to create a stash file.
You can specify the following commands:
create -s
Creates the database specified by the -d option. You will be prompted for the database master password. If you specify -s, a
stash file is created as specified by the -f option. If you did not specify -f, the default stash file name is
/var/krb5/.k5.realm. If you use the -f, -k, or -M options when you create a database, then you must use the same options when
modifying or destroying the database.
destroy
Destroys the database specified by the -d option.
stash
Creates a stash file. If -f was not specified, the default stash file name is /var/krb5/.k5.realm. You will be prompted for
the master database password. This command is useful when you want to generate the stash file from the password.
dump [-verbose] [filename] [principals]
Dumps the Kerberos database to a flat file that can be used for loading or propagating to a slave KDC. See kprop(1M). Specify
file name for a location to dump the Kerberos database. If filename is not specified, the principal data is printed to stan-
dard error. Specify -verbose to print out the principal names to standard error in addition to being dumping into the file.
Use principals to specify the list of principals that should be dumped.
load [-verbose] [-update] filename
Loads the database specified by dbname (see -d option, above) with data from the file specified by filename, which must be a
file created by the dump command. Use -update to specify that the existing database should be updated; otherwise, a new data-
base is created. Specify -verbose to print out the principal names to standard error, in addition to being loaded.
Example 1: Creating File that Contains Information about Two Principals
The following example creates a file named slavedata that contains the information about two principals, jdb@ACME.COM and pak@ACME.COM.
# /usr/krb5/bin/kdb5_util dump -verbose slavedata
jdb@ACME.COM pak@ACME.COM
/var/krb5/principal
Kerberos principal database.
/var/krb5/principal.kadm5
Kerberos administrative database. Contains policy information.
/var/krb5/principal.kadm5.lock
Lock file for the Kerberos administrative database. This file works backwards from most other lock files (that is, kadmin exits with an
error if this file does not exist).
/var/krb5/principal.ulog
The update log file for incremental propagation.
See attributes(5) for descriptions of the following attributes:
+-----------------------------+-----------------------------+
| ATTRIBUTE TYPE | ATTRIBUTE VALUE |
+-----------------------------+-----------------------------+
|Availability |SUNWkdcu |
+-----------------------------+-----------------------------+
|Interface Stability |Evolving |
+-----------------------------+-----------------------------+
kpasswd(1), gkadmin(1M), kadmin(1M), kadmind(1M), kadmin.local(1M), kproplog(1M), kadm5.acl(4), kdc.conf(4), attributes(5), SEAM(5)
30 Mar 2005 kdb5_util(1M)