KTUTIL(1)

💅 KTUTIL(1) — the manual page, but make it a group chat

okay bestie, so you know how you're the certified keeper of all the secrets in a Kerberos realm? yeah. this is the tool for that. it's from MIT Kerberos, and the whole page is about keeping your keytab entries cute, correct, and not a mess. 🎀

---

✨ SYNOPSIS ✨

ktutil

that's it. that's the whole vibe. you just run it and you're in. 🦋

---

🌸 DESCRIPTION 🌸

so the ktutil command literally opens up a command interface for you, and from inside that interface an administrator (that's you, queen 👑) can read, write, or edit entries in a keytab. that's the whole job.

💀 important heads-up: Kerberos V4 srvtab files are no longer supported. not a thing anymore. do not come for them. they're gone.

---

🌈 COMMANDS 🌈

📋 list

list [-t] [-k] [-e]

shows you the current keylist. and if you pass -t, -k, and/or -e, it also shows you the timestamp, the key contents, or the enctype — respectively, in that order, matching those flags. ✨

Alias: l

---

📖 read_kt

read_kt keytab

reads the Kerberos V5 keytab file keytab into the current keylist. boom, it's in there now. 🫶

Alias: rkt

---

✍️ write_kt

write_kt keytab

writes the current keylist into the Kerberos V5 keytab file keytab. take what's in your list, put it in the file. slay.

Alias: wkt

---

🧹 clear_list

clear_list

clears the current keylist. empty. blank. a fresh start. 🌸

Alias: clear

---

✂️ delete_entry

delete_entry slot

deletes the entry sitting in slot number slot from the current keylist. bye bestie 👋

Alias: delent

---

➕ add_entry

add_entry {-key|-password} -p principal -k kvno [-e enctype] [-f|-s
salt]

adds principal to the keylist using either a key or a password. here's the tea:

• if the -f flag is specified, the salt info gets fetched from the KDC. in that case the -e flag can be left out — or you can still hand it over to force a particular enctype.
• if the -f flag is not specified, then the -e flag must be specified, and the default salt will be used unless you override it with the -s option.

Alias: addent

---

🗒️ list_requests

list_requests

displays a listing of all the available commands. like a menu, but make it ✨aesthetic✨.

Aliases: lr, ?

---

🚪 quit

quit

quits ktutil. and honestly? self care. 🧚

Aliases: exit, q

---

💖 EXAMPLE 💖

ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes128-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes256-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  write_kt alice.keytab
ktutil:

look at her go. two enctypes, two passwords, one write_kt, and we're out. 💅

---

🌟 ENVIRONMENT 🌟

see kerberos for a description of Kerberos environment variables. (yes, that's where the env var lore lives, not here. iykyk.)

---

👀 SEE ALSO 👀

kadmin, kdb5_util, kerberos

---

🫶 AUTHOR 🫶

MIT

---

©️ COPYRIGHT ©️

1985-2025, MIT

---

okay that's the whole page, bestie. and before you go — this masterpiece is version 1.22.1, from the MIT Kerberos squad, and it's been holding it down since way back. go forth and manage those keytabs, you absolute icon. 👑✨💖