KADMIN(1)

💖 KADMIN(1) 💖

okay bestie, gather round 🫶 this is kadmin straight out of the MIT Kerberos manual, section 1, and it's lowkey the whole backstage pass to your Kerberos realm. It's giving "I run the database, you just live in it" 👑

---

✨ NAME ✨

kadmin — the Kerberos V5 database administration program 💅

---

✨ SYNOPSIS ✨

kadmin [-O|-N] [-r realm] [-p principal] [-q query] [[-c cache_name]|[-k
[-t keytab]]|-n] [-w password] [-s admin_server[:port]] [command
args...]

kadmin.local [-r realm] [-p principal] [-q query] [-d dbname] [-e
enc:salt ...]  [-m] [-x db_args] [command args...]

---

✨ DESCRIPTION ✨

so kadmin and kadmin.local are both command-line interfaces to the Kerberos V5 administration system 🌸 They do nearly the same stuff — the one tiny difference is that kadmin.local goes straight at the KDC database itself, while kadmin does its thing through kadmind (see the kadmind page, section 8). Unless this page says otherwise out loud, "kadmin" means both of them, mmkay? 💖 What does it actually do? It maintains Kerberos principals, password policies, and service key tables (keytabs). Iconic, honestly.

The remote kadmin client uses Kerberos to authenticate to kadmind using the service principal kadmin/admin or kadmin/ADMINHOST (where ADMINHOST is the fully-qualified hostname of the admin server). If your credentials cache has a ticket for one of those principals, and you passed the -c credentials_cache option, then boom — that ticket is what authenticates you to kadmind 🎀 Otherwise, the -p and -k options are what specify the client Kerberos principal name used to authenticate. Once kadmin has figured out the principal name, it asks the KDC for a service ticket, and uses that service ticket to authenticate to kadmind. No cap.

And because kadmin.local goes straight at the KDC database, it usually has to be run directly on the primary KDC with enough permissions to read that database. Unless — plot twist — the KDC database uses the LDAP database module, in which case kadmin.local can be run on any host that can reach the LDAP server 🦋

---

✨ OPTIONS ✨

• -r realm — use realm as the default database realm 🌈
• -p principal — authenticate as principal. If you don't, kadmin will append /admin to the primary principal name of the default ccache, or to the value of the USER environment variable, or to the username as obtained with getpwuid — in that order of preference, bestie, it's a whole priority list 📋
• -k — use a keytab to decrypt the KDC response instead of getting asked for a password. In this case the default principal becomes host/hostname 🏠 If no keytab was specified with the -t option, the default keytab gets used.
• -t keytab — use keytab to decrypt the KDC response. Heads up: this one can only be used together with the -k option ⚠️
• -n — requests anonymous processing 🙈 Two flavors of anonymous principals are supported. For fully anonymous Kerberos, configure PKINIT on the KDC and set up pkinit_anchors in the client's krb5.conf (section 5). Then use -n with a principal shaped like @REALM (an empty principal name, then the at-sign, then a realm name). If the KDC allows it, you get an anonymous ticket. There's a second form too: these "realm-exposed" tickets hide who the client is but not which realm the client belongs to. For that mode, use kinit -n with a normal principal name — if the KDC supports it, the principal (but not the realm) gets replaced by the anonymous principal. As of release 1.8, the MIT Kerberos KDC only supports fully anonymous operation 💀
• -c credentials_cache — use credentials_cache as the credentials cache. That cache should hold a service ticket for the kadmin/admin or kadmin/ADMINHOST service (where ADMINHOST is the fully-qualified hostname of the admin server); you can grab one with the kinit program (section 1) ✨ If you skip this option, kadmin requests a fresh service ticket from the KDC and stores it in its own temporary ccache.
• -w password — use password instead of being prompted for one. Use this one with care, bestie — it may expose the password to other users on the system via the process list 😭
• -q query — perform the specified query and then exit. In and out, no small talk 💅
• -d dbname — specifies the name of the KDC database. This option does not apply to the LDAP database module 🚫
• -s admin_server[:port] — specifies the admin server that kadmin should contact 📞
• -m — if you're using kadmin.local, prompt for the database master password instead of reading it from a stash file 🔐
• -e "enc:salt ..." — sets the keysalt list used for any new keys created. Check out Keysalt lists in kdc.conf (section 5) for the possible values 🌟
• -O — force use of the old AUTH_GSSAPI authentication flavor 👴
• -N — prevent fallback to the AUTH_GSSAPI authentication flavor 🛑
• -x db_args — specifies the database-specific arguments. Peep the next section for the supported options 👀

---

Starting with release 1.14, if any command-line arguments are left over after the options, they get treated as a single query to be executed. This mode is made for scripts, and it behaves differently from interactive mode in a few ways:

• Query arguments are split by the shell, not by kadmin.
• Informational and warning messages are suppressed. Error messages and query output (like for get_principal) will still show up though 💬
• Confirmation prompts are disabled (as if -force was given). Password prompts will still be issued as required 🔑
• The exit status will be non-zero if the query fails.

The -q option does not carry these behavior differences; that query gets processed as if you typed it in interactively. And the -q option cannot be used in combination with a query in the remaining arguments — pick one, bestie, not both 🙅

---

✨ DATABASE OPTIONS ✨

Database options can be used to override database-specific defaults 🌈

🗄️ Supported options for the DB2 module

• -x dbname=filename — specifies the base filename of the DB2 database 📁
• -x lockiter — make iteration operations hold the lock for the duration of the entire operation, rather than temporarily releasing the lock while handling each principal. This is the default behavior, but the option exists so you can override a [dbmodules] setting from the command line. First introduced in release 1.13 🔒
• -x unlockiter — make iteration operations unlock the database for each principal, instead of holding the lock for the whole entire operation. First introduced in release 1.13 🔓

🗄️ Supported options for the LDAP module

• -x host=ldapuri — specifies the LDAP server to connect to by a LDAP URI 🌐
• -x binddn=bind_dn — specifies the DN used to bind to the LDAP server 🪪
• -x bindpwd=password — specifies the password or SASL secret used to bind to the LDAP server. Using this option may expose the password to other users on the system via the process list 😬 — to avoid that, stash the password with the stashsrvpw command of kdb5_ldap_util (section 8) instead.
• -x sasl_mech=mechanism — specifies the SASL mechanism used to bind to the LDAP server. The bind DN is ignored if a SASL mechanism is used. New in release 1.13 ✨
• -x sasl_authcid=name — specifies the authentication name used when binding to the LDAP server with a SASL mechanism, if the mechanism requires one. New in release 1.13 ✨
• -x sasl_authzid=name — specifies the authorization name used when binding to the LDAP server with a SASL mechanism. New in release 1.13 ✨
• -x sasl_realm=realm — specifies the realm used when binding to the LDAP server with a SASL mechanism, if the mechanism uses one. New in release 1.13 ✨
• -x debug=level — sets the OpenLDAP client library debug level. level is an integer to be interpreted by the library. Debugging messages get printed to standard error. New in release 1.12 🐛

---

✨ COMMANDS ✨

When you're using the remote client, the available commands may be restricted according to the privileges specified in the kadm5.acl file (section 5) on the admin server 🔐

👑 add_principal

add_principal [options] newprinc

Creates the principal newprinc, prompting you twice for a password 🔑 If no password policy is specified with the -policy option, and a policy named default exists, that default policy is assigned to the principal. But — important — creating a policy named default will not automatically assign this policy to principals that already exist 🙈 This policy assignment can be suppressed with the -clearpolicy option.

This command requires the add privilege 💅

Aliases: addprinc, ank

Options:

• -expire expdate — (a getdate time string) the expiration date of the principal ⏰
• -pwexpire pwexpdate — (a getdate time string) the password expiration date 🔑
• -maxlife maxlife — (a Time duration or a getdate time string) the maximum ticket life for the principal ⏳
• -maxrenewlife maxrenewlife — (a Time duration or a getdate time string) the maximum renewable life of tickets for the principal 🔁
• -kvno kvno — the initial key version number 🔢
• -policy policy — the password policy used by this principal. If not specified, the policy default is used if it exists (unless -clearpolicy is specified) 📜
• -clearpolicy — prevents any policy from being assigned when -policy is not specified 🚫
• {-|+}allow_postdated — -allow_postdated prohibits this principal from obtaining postdated tickets. +allow_postdated clears this flag 🎟️
• {-|+}allow_forwardable — -allow_forwardable prohibits this principal from obtaining forwardable tickets. +allow_forwardable clears this flag 📨
• {-|+}allow_renewable — -allow_renewable prohibits this principal from obtaining renewable tickets. +allow_renewable clears this flag ♻️
• {-|+}allow_proxiable — -allow_proxiable prohibits this principal from obtaining proxiable tickets. +allow_proxiable clears this flag 🧳
• {-|+}allow_dup_skey — -allow_dup_skey disables user-to-user authentication for this principal by prohibiting others from obtaining a service ticket encrypted in this principal's TGT session key. +allow_dup_skey clears this flag 🔐
• +requires_preauth, -requires_preauth — okay so +requires_preauth means this principal has to preauthenticate before it's allowed to kinit. -requires_preauth clears that flag. And when +requires_preauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client's initial auth was done using preauthentication. periodt. 💅
• +requires_hwauth, -requires_hwauth — +requires_hwauth says this principal has to preauthenticate with a hardware device before it can kinit. -requires_hwauth clears that flag. When +requires_hwauth is set on a service principal, the KDC will only issue service tickets for that service principal if the client's initial auth was done using a hardware device to preauthenticate. slay. 🔐
• +ok_as_delegate, -ok_as_delegate — +ok_as_delegate sets the okay as delegate flag on tickets issued with this principal as the service. Clients may use this flag as a hint that credentials should be delegated when authenticating to the service. -ok_as_delegate clears this flag. vibe check passed. 🎀
• -allow_svr, +allow_svr — -allow_svr prohibits the issuance of service tickets for this principal. In release 1.17 and later, user-to-user service tickets are still allowed unless the -allow_dup_skey flag is also set. +allow_svr clears this flag. no cap. ✨
• -allow_tgs_req, +allow_tgs_req — -allow_tgs_req specifies that a Ticket-Granting Service (TGS) request for a service ticket for this principal is not permitted. +allow_tgs_req clears this flag. big yikes if you try. 😭
• -allow_tix, +allow_tix — -allow_tix forbids the issuance of any tickets for this principal. +allow_tix clears this flag. literally locked out. 💀
• +needchange, -needchange — +needchange forces a password change on the next initial authentication to this principal. -needchange clears this flag. glow up time. 🦋
• +password_changing_service — marks this principal as a password change service principal. iconic. 👑
• +ok_to_auth_as_delegate — allows this principal to acquire forwardable tickets to itself from arbitrary users, for use with constrained delegation. main character energy. 🌈
• +no_auth_data_required — prevents PAC or AD-SIGNEDPATH data from being added to service tickets for the principal. no extra baggage. 🎀
• +lockdown_keys — prevents keys for this principal from leaving the KDC via kadmind. The chpass and extract operations are denied for a principal with this attribute. The chrand operation is allowed, but will not return the new keys. The delete and rename operations are also denied if this attribute is set, in order to prevent a malicious administrator from replacing principals like krbtgt/* or kadmin/* with new principals without the attribute. This attribute can be set via the network protocol, but can only be removed using kadmin.local. so serious. 🔒
• -randkey — sets the key of the principal to a random value. randomize it bestie. 🎲
• -nokey — causes the principal to be created with no key. New in release 1.12. no key, no problem. ✨
• -pw password — sets the password of the principal to the specified string and does not prompt for a password. Note: using this option in a shell script may expose the password to other users on the system via the process list. be careful, fr fr. 🙈
• -e enc:salt,... — uses the specified keysalt list for setting the keys of the principal. See Keysalt lists <#keysalt-lists> in kdc.conf <#kdc-conf-5> for a list of possible values. key glow up. 🔑
• -x db_princ_args — indicates database-specific options. The options for the LDAP database module are:
  • -x dn=dn — specifies the LDAP object that will contain the Kerberos principal being created.
  • -x linkdn=dn — specifies the LDAP object to which the newly created Kerberos principal object will point.
  • -x containerdn=container_dn — specifies the container object under which the Kerberos principal is to be created.
  • -x tktpolicy=policy — associates a ticket policy to the Kerberos principal.

Note: listen up bestie: - The containerdn and linkdn options cannot be specified with the dn option. - If the dn or containerdn options are not specified while adding the principal, the principals are created under the principal container configured in the realm or the realm container. - dn and containerdn should be within the subtrees or principal container configured in the realm.

Example:

kadmin: addprinc jennifer
No policy specified for "jennifer@ATHENA.MIT.EDU";
defaulting to no policy.
Enter password for principal jennifer@ATHENA.MIT.EDU:
Re-enter password for principal jennifer@ATHENA.MIT.EDU:
Principal "jennifer@ATHENA.MIT.EDU" created.
kadmin:

---

modify_principal

modify_principal [options] principal

Modifies the specified principal, changing the fields as specified. The options to add_principal also apply to this command, except for the -randkey, -pw, and -e options. In addition, the option -clearpolicy will clear the current policy of a principal. glow up that principal. ✨

This command requires the modify privilege.

Alias: modprinc

Options (in addition to the addprinc options):

• -unlock — unlocks a locked principal (one which has received too many failed authentication attempts without enough time between them according to its password policy) so that it can successfully authenticate. free them from jail. 🔓

---

rename_principal

rename_principal [-force] old_principal new_principal

Renames the specified old_principal to new_principal. This command prompts for confirmation, unless the -force option is given. no take-backs. 🎀

This command requires the add and delete privileges.

Alias: renprinc

---

add_alias

add_alias alias_princ target_princ

Create an alias alias_princ pointing to target_princ. Aliases may be chained (that is, target_princ may itself be an alias) up to a depth of 10. chain them like friendship bracelets. 🧚

This command requires the add privilege for alias_princ and the modify privilege for target_princ.

(New in release 1.22.) fresh drop! 🌟

Aliases: alias

---

delete_principal

delete_principal [-force] principal

Deletes the specified principal or alias from the database. This command prompts for deletion, unless the -force option is given. gone, bye. 💀

This command requires the delete privilege.

Alias: delprinc

---

change_password

change_password [options] principal

Changes the password of principal. Prompts for a new password if neither -randkey or -pw is specified. new password, who dis? 🔑

This command requires the changepw privilege, or that the principal running the program is the same as the principal being changed.

Alias: cpw

The following options are available:

• -randkey — sets the key of the principal to a random value. 🎲
• -pw password — set the password to the specified string. Using this option in a script may expose the password to other users on the system via the process list. careful! 🙈
• -e enc:salt,... — uses the specified keysalt list for setting the keys of the principal. See Keysalt lists <#keysalt-lists> in kdc.conf <#kdc-conf-5> for a list of possible values. 🔑
• -keepold — keeps the existing keys in the database. This flag is usually not necessary except perhaps for krbtgt principals. hoard those keys. 🎀

Example:

kadmin: cpw systest
Enter password for principal systest@BLEEP.COM:
Re-enter password for principal systest@BLEEP.COM:
Password for systest@BLEEP.COM changed.
kadmin:

---

purgekeys

purgekeys [-all|-keepkvno oldest_kvno_to_keep] principal

Purges previously retained old keys (e.g., from change_password -keepold) from principal. If -keepkvno is specified, then only purges keys with kvnos lower than oldest_kvno_to_keep. If -all is specified, then all keys are purged. The -all option is new in release 1.12. clean slate. 🧹

This command requires the modify privilege.

---

get_principal

get_principal [-terse] principal

Gets the attributes of principal. With the -terse option, outputs fields as quoted tab-separated strings. spill the tea. ☕

This command requires the inquire privilege, or that the principal running the program to be the same as the one being listed.

Alias: getprinc

Examples:

kadmin: getprinc tlyu/admin
Principal: tlyu/admin@BLEEP.COM
Expiration date: [never]
Last password change: Mon Aug 12 14:16:47 EDT 1996
Password expiration date: [never]
Maximum ticket life: 0 days 10:00:00
Maximum renewable life: 7 days 00:00:00
Last modified: Mon Aug 12 14:16:47 EDT 1996 (bjaspan/admin@BLEEP.COM)
Last successful authentication: [never]
Last failed authentication: [never]
Failed password attempts: 0
Number of keys: 1
Key: vno 1, aes256-cts-hmac-sha384-192
MKey: vno 1
Attributes:
Policy: [none]

kadmin: getprinc -terse systest
systest@BLEEP.COM   3    86400     604800    1
785926535 753241234 785900000
tlyu/admin@BLEEP.COM     786100034 0    0
kadmin:

---

list_principals

list_principals [expression]

Retrieves all or some principal names. expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []. All principal names matching the expression are printed. If no expression is provided, all principal names are printed. If the expression does not contain an @ character, an @ character followed by the local realm is appended to the expression. find your people. 🫶

This command requires the list privilege.

Alias: listprincs, get_principals, getprincs

Example:

kadmin:  listprincs test*
test3@SECURE-TEST.OV.COM
test2@SECURE-TEST.OV.COM
test1@SECURE-TEST.OV.COM
testuser@SECURE-TEST.OV.COM
kadmin:

---

get_strings

get_strings principal

Displays string attributes on principal. string theory but make it kerberos. 🧵

This command requires the inquire privilege.

Alias: getstrs

---

set_string

set_string principal name value

Sets a string attribute on principal. String attributes are used to supply per-principal configuration to the KDC and some KDC plugin modules. The following string attribute names are recognized by the KDC:

• require_auth — names an authentication indicator that's required to authenticate to this principal as a service. You can stack several, separated by spaces, and then any of them will do the trick. (new in release 1.14 ✨)
• session_enctypes — sets which encryption types are supported for session keys when this principal is authenticated to as a server. Peep Encryption types in kdc.conf for the full list of values that are accepted, bestie.
• otp — turns on One Time Passwords (OTP) preauthentication for a client principal. The value is a JSON string that represents an array of objects, each with optional type and username fields.
• pkinit_cert_match — a matching expression that defines which certificate attributes are required for the client certificate this principal uses during PKINIT authentication. Same format as the pkinit_cert_match option in krb5.conf. (new in release 1.16 💖)
• pac_privsvr_enctype — forces the encryption type of the PAC KDC checksum buffers to the one you name, for tickets issued to this server, by deriving a key from the local krbtgt key if that key is a different encryption type. You might need to set this to "aes256-sha1" on the cross-realm krbtgt entry for an Active Directory realm when you're using aes-sha2 keys on the local krbtgt entry.
• optional_pac_tkt_chksum — a boolean that defines how the KDC behaves when an expected ticket checksum signed with one of this principal's keys just isn't in the PAC. That's typically the case for TGS or cross-realm TGS principals when they're processing S4U2Proxy requests.

This command requires the modify privilege.

Alias: setstr

Example:

set_string host/foo.mit.edu session_enctypes aes128-cts
set_string user@FOO.COM otp "[{""type"":""hotp"",""username"":""al""}]"

🗑️ del_string

del_string principal key

Deletes a string attribute from principal.

This command requires the delete privilege.

Alias: delstr

---

📜 add_policy

add_policy [options] policy

Adds a password policy named policy to the database. slay

This command requires the add privilege.

Alias: addpol

The following options are available:

• -maxlife time — (Time duration or getdate time string) sets the maximum lifetime of a password.
• -minlife time — (Time duration or getdate time string) sets the minimum lifetime of a password.
• -minlength length — sets the minimum length of a password.
• -minclasses number — sets the minimum number of character classes a password needs. The five character classes are: lower case, upper case, numbers, punctuation, and whitespace/unprintable characters.
• -history number — sets how many past keys get kept for a principal. Heads up: this option is not supported with the LDAP KDC database module.
• -maxfailure maxnumber — sets how many authentication failures happen before the principal gets locked. Authentication failures are only tracked for principals that require preauthentication. The failed-attempt counter resets to 0 after a successful authentication attempt. A maxnumber value of 0 (the default) disables lockout entirely.
• -failurecountinterval failuretime — (Time duration or getdate time string) sets the allowable time between authentication failures. If a failure happens after failuretime has elapsed since the previous failure, the number of authentication failures resets to 1. A failuretime value of 0 (the default) means forever.
• -lockoutduration lockouttime — (Time duration or getdate time string) sets how long the principal is locked out of authenticating if too many authentication failures pile up without the specified failure count interval elapsing. A duration of 0 (the default) means the principal stays locked out until someone administratively unlocks it with modprinc -unlock.
• -allowedkeysalts — specifies the key/salt tuples supported for long-term keys when setting or changing a principal's password/keys. Peep Keysalt lists in kdc.conf for the accepted values, but note that key/salt tuples must be separated with commas (',') only. To clear the allowed key/salt policy, use a value of '-'.

Example:

kadmin: add_policy -maxlife "2 days" -minlength 5 guests
kadmin:

---

✏️ modify_policy

modify_policy [options] policy

Modifies the password policy named policy. The options are exactly as described for add_policy.

This command requires the modify privilege.

Alias: modpol

---

💀 delete_policy

delete_policy [-force] policy

Deletes the password policy named policy. It prompts for confirmation before deleting, bestie — no accidental deletions here. The command will fail if the policy is in use by any principals.

This command requires the delete privilege.

Alias: delpol

Example:

kadmin: del_policy guests
Are you sure you want to delete the policy "guests"?
(yes/no): yes
kadmin:

---

🔍 get_policy

get_policy [ -terse ] policy

Displays the values of the password policy named policy. With the -terse flag, it outputs the fields as quoted strings separated by tabs.

This command requires the inquire privilege.

Alias: getpol

Examples:

kadmin: get_policy admin
Policy: admin
Maximum password life: 180 days 00:00:00
Minimum password life: 00:00:00
Minimum password length: 6
Minimum number of password character classes: 2
Number of old keys kept: 5
Reference count: 17

kadmin: get_policy -terse admin
admin     15552000  0    6    2    5    17
kadmin:

The "Reference count" is the number of principals using that policy. Heads up though — with the LDAP KDC database module, the reference count field is not meaningful.

---

🗂️ list_policies

list_policies [expression]

Retrieves all or some policy names. expression is a shell-style glob expression that can contain the wild-card characters ?, *, and []. All policy names matching the expression are printed. If no expression is provided, every existing policy name gets printed.

This command requires the list privilege.

Aliases: listpols, get_policies, getpols.

Examples:

kadmin:  listpols
test-pol
dict-only
once-a-min
test-pol-nopw

kadmin:  listpols t*
test-pol
test-pol-nopw
kadmin:

---

🔑 ktadd

ktadd [options] principal
ktadd [options] -glob princ-exp

Adds a principal — or all principals matching princ-exp — to a keytab file. Each principal's keys get randomized in the process. The rules for princ-exp are described over in the list_principals command.

This command requires the inquire and changepw privileges. With the -glob form, it also needs the list privilege.

The options are:

• -k[eytab] keytab — use keytab as the keytab file. Otherwise, the default keytab is used.
• -e enc:salt,... — uses the specified keysalt list for setting the new keys of the principal. Peep Keysalt lists in kdc.conf for a list of possible values.
• -q — display less verbose information.
• -norandkey — do not randomize the keys. The keys and their version numbers stay unchanged. This option cannot be specified in combination with the -e option.

An entry for each of the principal's unique encryption types is added, ignoring multiple keys with the same encryption type but different salt types.

Alias: xst

Example:

kadmin: ktadd -k /tmp/foo-new-keytab host/foo.mit.edu
Entry for principal host/foo.mit.edu@ATHENA.MIT.EDU with kvno 3,
     encryption type aes256-cts-hmac-sha1-96 added to keytab
     FILE:/tmp/foo-new-keytab
kadmin:

---

🧹 ktremove

ktremove [options] principal [kvno | all | old]

Removes entries for the specified principal from a keytab. Requires no permissions, since this doesn't require database access. we love a low-maintenance icon

If the string "all" is specified, all entries for that principal are removed; if the string "old" is specified, all entries for that principal except those with the highest kvno are removed. Otherwise, the value specified is parsed as an integer, and all entries whose kvno match that integer are removed.

The options are:

• -k[eytab] keytab — use keytab as the keytab file. Otherwise, the default keytab is used.
• -q — display less verbose information.

Alias: ktrem

Example:

kadmin: ktremove kadmin/admin all
Entry for principal kadmin/admin with kvno 3 removed from keytab
     FILE:/etc/krb5.keytab
kadmin:

---

🔒 lock

Lock database exclusively. Use with extreme caution! 🚨 This command only works with the DB2 KDC database module.

---

🔓 unlock

Release the exclusive database lock. freedom ✨

---

📋 list_requests

Lists available for kadmin requests.

Aliases: lr, ?

---

🚪 quit

Exit program. If the database was locked, the lock is released.

Aliases: exit, q

---

📖 HISTORY

The kadmin program was originally written by Tom Yu at MIT, as an interface to the OpenVision Kerberos administration program.

---

🌍 ENVIRONMENT

See kerberos for a description of Kerberos environment variables.

---

👀 SEE ALSO

kpasswd, kadmind, kerberos

---

💜 Author

MIT

©️ Copyright

1985-2026, MIT

---

and that's the whole page, bestie 🫶 you made it to the end. this one's kadmin from MIT Kerberos 1.22.2 — yeah, version 1.22.2, dated under the KADMIN(1) section of the manual. now go forth and administer some principals, you absolute main character 👑💅