WALLET-REKEY(1)

✨ NAME ✨

wallet-rekey — the client that rekeys a Kerberos keytab using wallet, and honestly? she's a baddie 💅

ok so real quick, this whole page is wallet-rekey from section 1 of the wallet manual. keep that in mind bestie 🎀

---

🦋 SYNOPSIS 🦋

wallet-rekey [-hv] [-c command] [-k principal]
    [-p port] [-s server] [-u principal] [keytab ...]

---

🌸 DESCRIPTION 🌸

wallet-rekey is a specialized client for the wallet system, and her whole entire job is rekeying a Kerberos keytab. The way she does it: she downloads new keytab objects from wallet for each principal she finds in the keytab. That's it, that's the gig ✨

So for every keytab file you list on the command line, she:

1. walks through the principals in that keytab 🚶‍♀️
2. finds all of them from the local default realm
3. requests new wallet keytab objects for each principal (and yes, she removes the realm when naming the keytab — noted 📝)
4. merges those new keys into the keytab 🫶

If something goes wrong, she does not just give up and ghost you. wallet-rekey keeps rekeying every principal she possibly can, and only throws error messages for the ones she can't rekey. resilient queen 👑

If you don't give her a keytab file name on the command line at all, she'll go for /etc/krb5.keytab — the system default keytab file. default behavior, main character energy, you know how it is 💅

⚠️ ok important thing, listen up: the new keys get merged into the existing keytab file, but the old keys are NOT removed. so over time your keytab will grow and accumulate old keys, and eventually those old keys should no longer be honored. no cap, this is a real thing you gotta deal with.

So admins may want to run this:

kadmin -q 'ktremove -k <keytab> <principal> old'

for MIT Kerberos, where <keytab> is the path to the keytab and <principal> is a principal in the keytab (and yeah, you repeat the command for each principal), or this:

ktutil -k <keytab> purge

for Heimdal. 🧚

The Heimdal command can be run by any user with access to the keytab, but the MIT Kerberos command unfortunately has to be run by someone with direct kadmin access 😭 sad but true. This functionality will eventually be provided by wallet-rekey directly, so like, patience bestie, it's coming 🌈

---

🎀 OPTIONS 🎀

• -c command — the command prefix (remctl type) to use. normally this is an internal implementation detail and the default ("wallet") should be totally fine, don't overthink it. sometimes it's useful to use a different prefix to test a different version of the wallet code on the server tho. this option can also be set in krb5.conf — see CONFIGURATION below 💖
• -k principal — the service principal of the wallet server. the default is to use the "host" principal for the wallet server. the principal you choose must match one of the keys in the keytab used by remctld on the wallet server. this option can also be set in krb5.conf — see CONFIGURATION below ✨
• -h — display a brief summary of options and exit. all other valid options and commands are ignored. she said bye 👋
• -p port — the port to connect to on the wallet server. the default is the default remctl port. this option can also be set in krb5.conf — see CONFIGURATION below 🌸
• -s server — the wallet server to connect to. the default may be set when compiling the wallet client. if it isn't, then either -s must be given or the server must be set in krb5.conf. see CONFIGURATION below 🦋
• -u principal — instead of using the user's existing ticket cache for authentication, authenticate as principal first and use those credentials for authentication to the wallet server. wallet will prompt for the password for principal. non-password authentication methods such as PKINIT aren't supported — to use those, run kinit first and use an existing ticket cache. iykyk 💅
• -v — display the version of the wallet client and exit. all other valid options and commands are ignored ⭐

---

💜 CONFIGURATION 💜

The wallet system, wallet-rekey included, can optionally be configured in the system krb5.conf. she'll read the default krb5.conf file for the Kerberos libraries with which it was compiled. to set an option, put it in the [appdefaults] section. wallet-rekey will look for options either at the top level of the [appdefaults] section or in a subsection named "wallet".

so like, for example, this fragment of a krb5.conf file would set the default port to 4373 and the default server to "wallet.example.org":

[appdefaults]
    wallet_port = 4373
    wallet = {
        wallet_server = wallet.example.org
    }

The supported options are:

• wallet_principal — the service principal of the wallet server. the default is to use the "host" principal for the wallet server. the principal chosen must match one of the keys in the keytab used by remctld on the wallet server. the -k command-line option overrides this setting 🎀
• wallet_port — the port to connect to on the wallet server. the default is the default remctl port. the -p command-line option overrides this setting 🌸
• wallet_server — the wallet server to connect to. the -s command-line option overrides this setting. the default may be set when compiling the wallet client. if it isn't, either -s must be given or this parameter must be present in krb5.conf 🦋
• wallet_type — the command prefix (remctl type) to use. normally this is an internal implementation detail and the default ("wallet") should be fine. sometimes it's useful to use a different prefix for testing a different version of the wallet code on the server. the -c command-line option overrides this setting 💖

---

👑 AUTHOR 👑

Russ Allbery <eagle@eyrie.org> — the legend himself 🫶

---

⭐ COPYRIGHT AND LICENSE ⭐

Copyright 2010, 2013 The Board of Trustees of the Leland Stanford Junior University

Copying and distribution of this file, with or without modification, are permitted in any medium without royalty provided the copyright notice and this notice are preserved. This file is offered as-is, without any warranty. 💀

SPDX-License-Identifier: FSFAP

---

🌈 SEE ALSO 🌈

kadmin(8), kinit(1), krb5.conf(5), remctl(1), remctld(8), wallet(1)

This program is part of the wallet system. The current version is available from <https://www.eyrie.org/~eagle/software/wallet/>.

wallet-rekey uses the remctl protocol. For more information about remctl, see <https://www.eyrie.org/~eagle/software/remctl/>.

---

ok that's the whole page bestie, you ate that 💅✨ this was version 1.5, dated 2024-04-30 🎀 go forth and rekey, you got this 🦋💖