KPASSWDD(8)

💖 KPASSWDD(8) 💖

okay so bestie, gather round, because we're talking about kpasswdd — the Kerberos 5 password changing server. yes she's a whole 8th-section system manager situation, and yes she's iconic, let's get into it 🎀

✨ SYNOPSIS ✨

kpasswdd [--addresses=address] [--check-library=library]
         [--check-function=function] [-k kspec | --keytab=kspec] [-r
         realm | --realm=realm] [-p string | --port=string] [--version]
         [--help]

🌸 DESCRIPTION 🌸

so kpasswdd is literally the girl who serves requests for password changes. that's her job, that's her whole vibe. she listens on UDP port 464 (the service is called kpasswd, iykyk) and she processes requests the second they arrive. no waiting around, no queue drama. 💅

and here's the thing — she changes the database directly. like, straight in. which means she should only ever run on the master KDC, periodt. do not run her anywhere else, that is not the move. 🙈

here are the supported options, let's go:

• --addresses=address — for each time this argument shows up, add that address to the list of what kpasswdd should be listening to. stack them up, bestie 🦋
• --check-library=library — if your system supports dynamically loading shared libraries (some do, some don't, vibe check your system first), you can bring in an outside function to check password quality. this option says which library to load. ✨
• --check-function=function — and this is the function to call inside that loaded library. she should look exactly like this:

const char * passwd_check(krb5_context context, krb5_principal principal, krb5_data *password)

so, breaking it down: context is an initialized context, principal is the one who's trying to change passwords, and password is the new password. 🫶 and listen — the password (in password->data) is not zero terminated. not it being sneaky like that 😭

• -k kspec, --keytab=kspec — the keytab to get the authentication key from. that's where the key lives 🔑
• -r realm, --realm=realm — the default realm. setting the scene, love that for her 🌈
• -p string, --port=string — the port to listen on. default is the service kpasswd, which is 464 ⭐

🩺 DIAGNOSTICS 🩺

if something goes wrong, the error message gets returned to the user and/or logged to syslog. so like, the tea gets spilled either way 💀

🐛 BUGS 🐛

the default password quality checks are too basic. that's it, that's the bug. highkey underwhelming, we said what we said 🙈

👀 SEE ALSO 👀

• kpasswd(1)
• kdc(8)

and that's the whole page, bestie!! 🎀 this one's from the HEIMDAL crew, dated April 19, 1999 — yeah she's an elder but she still ate 💖 stay safe out there, and remember: master KDC only, no cap 👑