ipa-rmkeytab(1)

💖 ipa-rmkeytab — the "bye bye keytab entry" era 💖

okay bestie, so you know ipa-rmkeytab? that's the one — it's an IPA Manual Pages girlie and she does exactly one job and she does it slayfully: remove a kerberos principal from a keytab. that's it. that's the whole vibe. 🎀

✨ SYNOPSIS ✨

ipa-rmkeytab [ -p principal-name ] [ -k keytab-file ] [ -r realm ] [ -d ]

🌸 DESCRIPTION 🌸

So. She removes a kerberos principal from a keytab. Iconic, minimal, no notes. 💅

Now let's talk keytabs, because this is the lore you need. Kerberos keytabs are what services (like sshd) use to do kerberos authentication. A keytab is literally just a file with one or more secrets (or keys) for a kerberos principal. that's it. a lil file full of secrets. 🫶

And a kerberos service principal? That's a kerberos identity you can use for authentication. Service principals contain three things: the name of the service, the hostname of the server, and the realm name. all three, together, no cap. ✨

ipa-rmkeytab gives you two ways to remove principals, and honestly pick your fighter:

• you can remove a specific principal, or
• you can remove all principals for a given realm. 🔥

When she removes a principal, all encryption types and versions of that principal go too. every single one. gone. 💀

Oh and when you're removing a specific principal, the realm may be included — but it is not required. your call, queen. 👑

NOTE: removing a principal from the keytab does not affect the Kerberos principal stored in the IPA server. It merely removes the entry from the local keytab. So don't panic — the server-side principal is untouched, this is a local-file situation only. 🙈

🦋 OPTIONS 🦋

• -p principal-name — the non-realm part of the full principal name.
• -k keytab-file — the keytab file to remove the principal(s) from.
• -r realm — a realm to remove all principals for.
• -d — debug mode. additional information is displayed. (for when you need the tea ☕)

🌈 EXAMPLES 🌈

Remove the NFS service principal on the host foo.example.com from /tmp/nfs.keytab:

# ipa-rmkeytab -p nfs/foo.example.com -k /tmp/nfs.keytab

Remove the ldap service principal on the host foo.example.com from /etc/krb5.keytab:

# ipa-rmkeytab -p ldap/foo.example.com -k /etc/krb5.keytab

Remove all principals for the realm EXAMPLE.COM:

# ipa-rmkeytab -r EXAMPLE.COM -k /etc/krb5.keytab

⭐ EXIT STATUS ⭐

The exit status is 0 on success, nonzero on error. she will tell you. 💜

1. Kerberos initialization failed
2. Memory allocation error
3. Unable to open keytab
4. Unable to parse the principal name
5. Principal name or realm not found in keytab
6. Unable to remove principal from keytab
7. Failed to set cursor

and that's the whole page bestie, you're so welcome. this one's brought to you by IPA, dated Oct 30 2009 — vintage but still eating, fr fr. go forth and clean up your keytabs, you've got this 💖✨🎀