K5SRVUTIL(1)

📦
version 1.22.2 · 9 versions
, in alpine 3.24, arch rolling, fedora 43, freebsd 15.1, nixos 26.05, nixpkgs unstable

🌸 K5SRVUTIL 💖

okay bestie, so k5srvutil is your go-to for messing with a host key table — aka a keytab. that's the whole vibe. it's the MIT Kerberos keytab-manipulation utility and she is iconic 💅

✨ SYNOPSIS ✨

k5srvutil operation [-i] [-f filename] [-e keysalts]

like, you give her an operation and maybe some flags and she goes off 🦋

💜 DESCRIPTION 💜

k5srvutil lets an administrator do three-ish things to a keytab: list the keys that are currently chillin' in it, get new keys for a principal that's already in it, or delete the non-current keys out of it. no cap.

operation has to be one of these, fr fr:

  • list — shows you the keys in a keytab, with the version number and principal name. it's giving inventory. 📋
  • change — uses the kadmin protocol to update the keys in the Kerberos database to new randomly-generated ones, and then updates the keys in the keytab so they match. ✨ here's the tea though: if a key's version number doesn't match the version number stored in the Kerberos server's database, the operation will fail 😭. if the -i flag is given, k5srvutil will prompt for confirmation before changing each key. if the -k option is given, the old and new keys will be displayed. ordinarily, keys get generated with the default encryption types and key salts — but you can override that with the -e option. old keys are retained in the keytab so that existing tickets keep working, but you should use delold after such tickets expire, to prevent attacks against the old keys. 🛡️
  • delold — deletes keys that aren't the most recent version from the keytab. you should run this some time after a change operation to remove the old keys, once the existing tickets issued for the service have expired. if the -i flag is given, k5srvutil will prompt for confirmation for each principal. 🧹
  • delete — deletes particular keys in the keytab, interactively prompting for each key. very hands-on, very choose-your-own-adventure. 🙈

in all cases, the default keytab is used unless you override it with the -f option. periodt.

and ngl, k5srvutil uses the kadmin program to edit the keytab in place. so that's the collab we're working with. 🤝

🌈 ENVIRONMENT 🌈

see kerberos for a description of Kerberos environment variables. that's where the lore lives, iykyk. 📖

👑 SEE ALSO 👑

kadmin, ktutil, kerberos

🎀 AUTHOR 🎀

MIT

1985-2026, MIT

and that's the whole page bestie 🫶 this was the MIT Kerberos manual for k5srvutil, version 1.22.2 — go forth and protect your keytab, she deserves it ⭐🌸💜

📦 where this page comes from