KADMIND(8)

💅 KADMIND(8) — kadmind 💅

the server for administrative access to Kerberos database 🎀 (and yes bestie, this is a System Manager's Manual situation, section 8, we love a daemon era)

---

✨ SYNOPSIS ✨

kadmind [-c file | --config-file=file] [-k file | --key-file=file]
        [--keytab=keytab] [-r realm | --realm=realm] [-d | --debug] [-p
        port | --ports=port]

---

🌸 DESCRIPTION 🌸

okay so kadmind is literally the girl who sits there listening for requests to change the Kerberos database, and then actually does them — but only subject to permissions, because boundaries are self-care 💖.

When it starts up: if stdin is a socket, it assumes it got launched by inetd(8) (vintage behavior, we respect it). Otherwise it behaves as a daemon, forking off processes for every new connection like it's running its own little group chat 🫶. And the --debug option makes kadmind accept exactly one connection — extremely useful for debugging, no cap.

The kpasswdd(8) daemon is the one responsible for the Kerberos 5 password changing protocol (the one kpasswd(1) uses). So that's a different girl, don't mix them up 💀.

🚨 IMPORTANT, bestie: this daemon should only be run on the master server, and NOT on any slaves. Periodt.

Principals are always allowed to change their own password and list their own principal. That's the bare minimum, it's giving basic autonomy ✨. Apart from that? Doing any operation requires permission explicitly added in the ACL file /var/heimdal/kadmind.acl. The format of this file is:

principal rights [principal-pattern]

Where rights is any (comma separated) combination of:

• change-password or cpw
• list
• delete
• modify
• add
• get
• get-keys
• all (everything except get-keys) 🙈

And the optional principal-pattern restricts the rights to operations on principals that match the glob-style pattern. Slay, we love scoped permissions 🎀.

Supported options:

• -c file, --config-file=file — location of config file 📁
• -k file, --key-file=file — location of master key file 🔑
• --keytab=keytab — what keytab to use 🗝️
• -r realm, --realm=realm — realm to use 🌍
• -d, --debug — enable debugging 🐛
• -p port, --ports=port — ports to listen to. By default, if run as a daemon, it listens to port 749, but you can add any number of ports with this option. The port string is a whitespace separated list of port specifications, with the special string “+” representing the default port. 👑

---

📂 FILES 📂

• /var/heimdal/kadmind.acl

---

🌈 EXAMPLES 🌈

This will cause kadmind to listen to port 4711 in addition to any compiled in defaults:

kadmind --ports="+ 4711" &

This acl file will grant Joe all rights, and allow Mallory to view and add host principals, as well as extract host principal keys (e.g., into keytabs). Obsessed with a clean ACL, fr fr 💜:

joe/admin@EXAMPLE.COM      all
mallory/admin@EXAMPLE.COM  add,get-keys  host/*@EXAMPLE.COM

---

👀 SEE ALSO 👀

kpasswd(1), kadmin(1), kdc(8), kpasswdd(8)

---

and that's the whole vibe check, bestie 🦋 this icon came from HEIMDAL, dated December 8, 2004 — old money, still iconic, we stan 💖✨👑