KTUTIL(1)

NAME
ktutil - manage Kerberos keytabs

SYNOPSIS
ktutil [-k keytab - -keytab=keytab] [-v | - -verbose] [- -version] [-h | - -help] command [args]

DESCRIPTION
ktutil is a program for managing keytabs. Supported options:

-v, - -verbose
    Verbose output.

command can be one of the following:

add [-p principal] [- -principal=principal] [-V kvno] [- -kvno=kvno] [-e enctype] [- -keepold | - -keepallold | - -pruneall] [- -enctype=enctype] [-w password] [- -password=password] [-r] [- -random] [-s] [- -no-salt] [-H] [- -hex]
    Adds a key to the keytab. Options that are not specified will be prompted for. This requires that you know the password or the hex key of the principal to add; if what you really want is to add a new principal to the keytab, you should consider the get command, which talks to the kadmin server.

change [-r realm] [- -realm=realm] [- -keepold | - -keepallold | - -pruneall] [- -enctype=enctype] [- -a host] [- -admin-server=host] [- -s port] [- -server-port=port]
    Update one or several keys to new versions. By default, use the admin server for the realm of a keytab entry. Otherwise it will use the values specified by the options.

    If no principals are given, all the ones in the keytab are updated.

copy [- -copy-duplicates] keytab-src keytab-dest
    Copies all the entries from keytab-src to keytab-dest. Because entries already in keytab-dest are kept, this command functions to merge keytabs. Entries for the same principal, key version number, and encryption type in the keytab-src that are also in the keytab-dest will not be copied to the keytab-dest unless the - -copy-duplicates option is given.

get [-p admin principal] [- -principal=admin principal] [-e enctype] [- -no-create] [- -no-change-keys] [- -keepold | - -keepallold | - -pruneall] [- -enctypes=enctype] [-r realm] [- -realm=realm] [-a admin server] [- -admin-server=admin server] [-s server port] [- -server-port=server port] principal ...

    For each principal, get a the principal's keys from the KDC via the kadmin protocol, creating the principal if it doesn't exist (unless - -no-create is given), and changing its keys to new random keys (unless - -no-change-keys is given).

    If no realm is specified, the realm to operate on is taken from the first principal.

import [JSON-FILE]
    Read an array of keytab entries in a JSON file and copy them to the keytab. Use the list command with its - -json option and - -keys option to export a keytab.

list [- -keys] [- -timestamp [[- -json]]]
    List the keys stored in the keytab. Use the - -json and - -keys options to export a keytab as JSON for importing with the import command.

remove [-p principal] [- -principal=principal] [-V -kvno] [- -kvno=kvno] [-e -enctype] [- -enctype=enctype]
    Removes the specified key or keys. Not specifying a kvno removes keys with any version number. Not specifying an enctype removes keys of any type.

merge [- -copy-duplicates] keytab-src keytab-dest
    An alias for the copy command.

rename from-principal to-principal
    Renames all entries for the from-principal in the keytab from-principal to to-principal.

purge [- -age=age]
    Removes all old versions of a key for which there is a newer version that is at least age (default one week) old. Note that this does not update the KDC database. The kadmin(1) command has a prune command that can do this on the KDC side.

SEE ALSO
kadmin(1)