KTUTIL(1)

📦 version 7.8.git20240113.1b4565a, in debian bookworm, debian trixie, ubuntu jammy, ubuntu noble, ubuntu questing, ubuntu resolute, ubuntu stonking

✨ KTUTIL(1) — the manual page, but make it cute ✨

okay bestie, sit down, hydrate, and let's talk about ktutil from the General Commands Manual — it's a whole program for managing Kerberos keytabs and honestly? she's iconic. 👑

🌸 NAME 🌸

ktutil — manage Kerberos keytabs. that's it, that's the vibe. 💖

🎀 SYNOPSIS 🎀

       [-h | --help] command [args]

no cap, that's the whole shape of it — you pick your keytab, maybe get a lil chatty, maybe just wanna know the version or get some help, and then you tell her which command to run plus any args she needs. 💅

🦋 DESCRIPTION 🦋

okay so ktutil is literally a program for managing keytabs. that's her whole job and she does it beautifully. ✨

here are the options that apply to the program itself, the main-character ones:

  • -v, --verbose — verbose output. she'll tell you everything, and you're gonna listen. 🗣️

and then command can be one of the following — pick your fighter:

💖 add 💖

           enctype] [--enctype=enctype] [-w password]
           [--password=password] [-r] [--random] [-s] [--no-salt] [-H]
           [--hex]
  • -p principal, --principal=principal — which principal we're adding a key for
  • -V kvno, --kvno=kvno — the key version number
  • -e enctype, --enctype=enctype — the encryption type
  • -w password, --password=password — the password
  • -r, --random — random key energy 🌈
  • -s, --no-salt — no salt, we're going plain
  • -H, --hex — hex key input

what it does: adds a key to the keytab. any options you don't specify? she's gonna prompt you for them, bestie, so be ready. 🫶

⚠️ heads up fr fr: this one requires that you already know the password or the hex key of the principal you're adding. it's giving "you must already have the tea." 🍵

and if what you actually want is to add a brand new principal to the keytab? then you should lowkey consider the get command instead — she talks to the kadmin server and handles all of that for you. 💅

💜 change 💜

           port] [--server-port=port]
  • -r realm, --realm=realm — the realm
  • --a host, --admin-server=host — the admin server host
  • --s port, --server-port=port — the server port

what it does: updates one or several keys to new versions. by default she uses the admin server for the realm of a keytab entry. otherwise, she'll use the values you specified with the options. no guessing, just vibes. ✨

and if you give her no principals? she updates all the ones in the keytab. she's thorough like that. 😌

🧚 copy 🧚

what it does: copies all the entries from keytab-src to keytab-dest. simple. clean. ate. 💅

⭐ get ⭐

           [--enctypes=enctype] [-r realm] [--realm=realm] [-a admin
           server] [--admin-server=admin server] [-s server port]
           [--server-port=server port] principal ...
  • -p admin principal, --principal=admin principal — the admin principal
  • -e enctype, --enctypes=enctype — the enctypes
  • -r realm, --realm=realm — the realm
  • -a admin server, --admin-server=admin server — the admin server
  • -s server port, --server-port=server port — the server port
  • principal ... — one or more principals, give her the whole list bestie

what it does: for each principal, she generates a new key for it (creating it if it doesn't already exist 👀), and puts that key in the keytab. main character energy tbh.

and if no realm is specified, the realm she operates on is taken from the first principal. iykyk. 💖

🌈 list 🌈

  • --keys — show the keys
  • --timestamp — show the timestamps

what it does: lists the keys stored in the keytab. she's showing off, and honestly? she earned it. 👑

🍓 remove 🍓

           [-e -enctype] [--enctype=enctype]
  • -p principal, --principal=principal — the principal
  • -V -kvno, --kvno=kvno — the key version number
  • -e -enctype, --enctype=enctype — the encryption type

what it does: removes the specified key or keys. and listen, the defaults here are chaotic in the best way: not specifying a kvno removes keys with any version number, and not specifying an enctype removes keys of any type. she's not holding back. 💀

🎀 rename 🎀

what it does: renames all entries in the keytab that match the from-principal to to-principal. glow-up complete. ✨

🫶 purge 🫶

  • --age=age — how old is "old", bestie

what it does: removes all old versions of a key for which there is a newer version that is at least age old. the default for age is one week. she's cleaning house and she's not sorry. 🧹

👑 SEE ALSO 👑

💌 and that's the whole page!! this one came from HEIMDAL, dated April 14, 2005 — vintage but still serving. now go manage those keytabs, bestie. you've got this. 💖✨🎀🦋🌸💅🫶
📦 where this page comes from