KTUTIL(1)

📦
version 1.22.2 · 12 versions
, in alpine 3.24, arch rolling, fedora 43, freebsd 15.1, nixos 26.05, nixpkgs unstable

✨ KTUTIL ✨ (that's section 1 of the manual, bestie)

okay so picture this: it's giving MIT Kerberos, and this little icon is called ktutil — the Kerberos keytab file maintenance utility. yeah. the keytab wrangler. 💅

🌸 SYNOPSIS 🌸

ktutil

that's it. that's the whole vibe. you just run it and it opens up a whole little world. 🦋

💖 DESCRIPTION 💖

so ktutil invokes a command interface — like, a whole interactive moment — from which an administrator can read, write, or edit entries in a keytab. that's the job. that's the assignment. 👑

heads up bestie: Kerberos V4 srvtab files are no longer supported. rip to them but they're different people now. 💀

🎀 COMMANDS 🎀

⭐ list

list [-t] [-k] [-e]

Displays the current keylist. If -t, -k, and/or -e are specified, also display the timestamp, key contents, or enctype (respectively). like, you get the bonus info. the extra lore. 🔥

Alias: l

🦋 read_kt

read_kt keytab

Read the Kerberos V5 keytab file keytab into the current keylist. it's literally just scooping up that file and putting it in the list. no cap. ✨

Alias: rkt

🌈 write_kt

write_kt keytab

Write the current keylist into the Kerberos V5 keytab file keytab. the reverse. the remix. 🫶

Alias: wkt

🧚 clear_list

clear_list

Clear the current keylist. poof. gone. fresh start energy. 💜

Alias: clear

🍓 delete_entry

delete_entry slot

Delete the entry in slot number slot from the current keylist. bye bye specific little guy. 👋

Alias: delent

💅 add_entry

add_entry {-key|-password} -p principal -k kvno [-e enctype] [-f|-s
salt]

Add principal to keylist using key or password. okay here's the tea, listen closely:

  • If the -f flag is specified, salt information will be fetched from the KDC; in this case the -e flag may be omitted, or it may be supplied to force a particular enctype. so like, -f means "go ask the KDC bestie" and you can still override the enctype if you want.
  • If the -f flag is not specified, the -e flag must be specified, and the default salt will be used unless overridden with the -s option. so no -f means you gotta bring your own -e. non-negotiable fr fr.

Alias: addent

😭 list_requests

list_requests

Displays a listing of available commands. it's the help menu. the little map. the "wait what can i even do here" button. 🗺️

Aliases: lr, ?

👑 quit

quit

Quits ktutil. you're free. go touch grass. 🌱

Aliases: exit, q

🌟 EXAMPLE 🌟

ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes128-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes256-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  write_kt alice.keytab
ktutil:

look at alice. two enctypes. one keytab. main character behaviour honestly. 🌸

🐚 ENVIRONMENT 🐚

See kerberos for a description of Kerberos environment variables. the env vars live over there, iykyk. ✨

🫶 SEE ALSO 🫶

  • kadmin
  • kdb5_util
  • kerberos

go read those too, they're all part of the same friend group. 🌈

💜 AUTHOR 💜

MIT

1985-2026, MIT

okay that's the whole thing, you absolutely ate that 💅 this was the MIT Kerberos ktutil page, version 1.22.2, brought to you by MIT (copyright 1985-2026, MIT) — periodt. now go write a keytab or something, i believe in you 🎀🦋💖

📦 where this page comes from