KVNO(1)

💖 KVNO(1) — the kvno girlies' guide 💖

okay so bestie, welcome to kvno, straight out of MIT Kerberos. This is your little backstage pass to peeking at the key version numbers of Kerberos principals. Iconic behaviour, honestly.

---

✨ NAME ✨

kvno — print key version numbers of Kerberos principals 🎀

---

🌸 SYNOPSIS 🌸

kvno [-c ccache] [-e etype] [-k keytab] [-q] [-u | -S sname] [-P]
[--cached-only] [--no-store] [--out-cache cache] [[{-F cert_file | {-I |
-U} for_user} [-P]] | --u2u ccache] service1 service2 ...

---

🦋 DESCRIPTION 🦋

So basically: kvno goes and gets a service ticket for all the Kerberos principals you name, and then prints out the key version number of each one. That's it. That's the whole job. She's a one-trick pony and the trick is delicious. 💅

---

👑 OPTIONS 👑

Every single one, no skips, periodt:

• -c ccache — names the credentials cache to use. Only matters if you're not vibing with the default one.
• -e etype — picks the enctype that'll be requested for the session key of all the services on the command line. Genuinely useful in certain backward compatibility situations, bestie. Throwback energy.
• -k keytab — decrypt the acquired tickets using keytab so you can confirm they're actually valid. Vibe check, but cryptographically.
• -q — quiet mode: suppress printing output when successful. BUT if a service ticket can't be obtained, the error message still prints and kvno still exits with nonzero status. Not me trying to be sneaky and still getting caught. 😭
• -u — use the unknown name type in the requested service principal names. > Heads up: this option cannot be used with -S. They do not get along.
• -P — says that the service1 service2 ... arguments should be treated as services you want credentials for using constrained delegation. This option is only valid when used in conjunction with protocol transition. Fancy, constrained, exclusive.
• -S sname — says the service1 service2 ... arguments are actually hostnames, and the service principals get constructed from those hostnames plus the service name sname. Those service hostnames will be canonicalized according to the usual rules for constructing service principals. 🫶
• -I for_user — use protocol transition (S4U2Self) to acquire a ticket on behalf of for_user. > Note: if constrained delegation isn't requested, the service name must match the credentials cache client principal.
• -U for_user — same as -I, but treats for_user as an enterprise name.
• -F cert_file — use protocol transition, identifying the client principal with the X.509 certificate in cert_file. > The certificate file must be in PEM format. No PEM, no party. 💀
• --cached-only — only retrieve credentials already chilling in the cache, not from the KDC. (Added in release 1.19.)
• --no-store — do not store retrieved credentials in the cache. But if --out-cache is also specified, credentials will still be stored into the output credential cache. (Added in release 1.19.)
• --out-cache ccache — initialize ccache and store all retrieved credentials into it. Do not store acquired credentials in the input cache. (Added in release 1.19.)
• --u2u ccache — requests a user-to-user ticket. ccache must contain a local krbtgt ticket for the server principal. > The reported version number will typically be 0, because the resulting ticket is not encrypted in the server's long-term key. Zero, she's giving nothing, and that's correct.

---

🌈 ENVIRONMENT 🌈

See kerberos for a description of Kerberos environment variables. (Yes, she outsources the env var lore. Respect.)

---

🍓 FILES 🍓

• FILE:/tmp/krb5cc_%{uid} — default location of the credentials cache. Where your tickets live rent-free.

---

⭐ SEE ALSO ⭐

kinit, kdestroy, kerberos

---

💜 AUTHOR 💜

MIT

---

🎀 COPYRIGHT 🎀

1985-2026, MIT

---

okay that's the whole page, bestie, you ate that 🫶

This was kvno from MIT Kerberos, version 1.22.2. Thanks for reading my little manual moment — now go acquire some tickets responsibly. 💅✨