KSTASH(8)

✨ KSTASH — bestie edition ✨

okay so real talk, this is kstash from section 8 of the System Manager's Manual, and it's literally the little tool that tucks your Kerberos master key away safe. it's giving "vault keeper but make it a command". 💖

🌸 NAME 🌸

kstash — store the KDC master password in a file

🎀 SYNOPSIS 🎀

kstash [-e string | --enctype=string] [-k file | --key-file=file]
       [--convert-file] [--random-key] [--master-key-fd=fd]
       [--random-key] [-h | --help] [--version]

(yes bestie, --random-key really is in there twice, i did not do that, i am simply reporting the facts 💅)

💜 DESCRIPTION 💜

so what kstash does is read the Kerberos master key and stash it in a file — and that file is the one the KDC is gonna use. main character behaviour tbh. it's the handoff. the moment. 🫶

here's the options, and no i'm not skipping any of them:

• -e string, --enctype=string — the encryption type you wanna use. defaults to DES3-CBC-SHA1 if you don't say otherwise. pick your fighter ✨
• -k file, --key-file=file — the name of the master key file. that's the file it's stashing into, periodt.
• --convert-file — this one does not ask you for a new master key. instead it reads an old master key file and writes it back out in the new keyfile format. glow-up arc for your key file 💅
• --random-key — generates a random master key. let the universe decide 🌈
• --master-key-fd=fd — a filedescriptor to read the passphrase from. if you don't specify it, the passphrase gets read from the terminal instead. so basically: fd if you want, terminal if you don't 🍓

also chillin' in the synopsis up there are -h, --help, and --version — the page doesn't spell out what they do, so i'm not gonna make stuff up, i'm just letting you know they exist. no cap. 🙈

heads up bestie: that --random-key appearing twice in the synopsis is straight from the original page. i'm not editing the source material, i'm just here to make it cute.

🦋 FILES 🦋

• /var/heimdal/m-key is the default keyfile if you don't specify some other keyfile. it's the fallback bae. 💖

and here's a lil fun fact that's genuinely useful: the format of a Heimdal master key is the same as a keytab, which means you can literally use ktutil list to list the content of the file. iykyk. 👑

👑 SEE ALSO 👑

• kdc(8)

💀 SIGN-OFF 💀

this whole vibe check came to you from HEIMDAL, living in the System Manager's Manual, and it was dated April 10, 2007. iconic of it honestly. go stash that key, bestie, you got this 💅✨🎀