Specifies whether to create, destroy, dump, or load the
database, or to create a stash file.
You can specify the following commands:
create -s
Creates the database specified by the -d option.
You will be prompted for the database master password. If you specify
-s, a stash file is created as specified by the -f option. If
you did not specify -f, the default stash file name is
/var/krb5/.k5.realm. If you use the -f, -k, or -M
options when you create a database, then you must use the same options when
modifying or destroying the database.
destroy
Destroys the database specified by the -d
option.
stash
Creates a stash file. If -f was not specified, the
default stash file name is /var/krb5/.k5.realm. You will be prompted
for the master database password. This command is useful when you want to
generate the stash file from the password.
dump [-old] [-b6] [-b7]
[-ov] [-verbose] [-mkey_convert] [-new_mkey_file
mkey_file] [-rev] [-recurse] [filename
[principals...]]
Dumps the current Kerberos and KADM5 database into an
ASCII file. By default, the database is dumped in current format,
"
kdb5_util load_dumpversion 5". If
filename is not
specified or is the string "-", the dump is sent to standard output.
Options are as follows:
-old
Causes the dump to be in the Kerberos 5 Beta 5 and
earlier dump format ("kdb5_edit load_dump version
2.0").
-b6
Causes the dump to be in the Kerberos 5 Beta 6 format
("kdb5_edit load_dump version 3.0").
-b7
Causes the dump to be in the Kerberos 5 Beta 7 format
("kdb5_util load_dump version 4"). This was the dump
format produced on releases prior to 1.2.2.
-ov
Causes the dump to be in ovsec_adm_export
format.
-verbose
Causes the name of each principal and policy to be
displayed as it is dumped.
-mkey_convert
Prompts for a new master key. This new master key will be
used to re-encrypt the key data in the dumpfile. The key data in the database
will not be changed.
-new_mkey_file mkey_file
The filename of a stash file. The master key in this
stash file will be used to re-encrypt the key data in the dumpfile. The key
data in the database will not be changed.
-rev
Dumps in reverse order. This might recover principals
that do not dump normally, in cases where database corruption has
occurred.
-recurse
Causes the dump to walk the database recursively
(btree only). This might recover principals that do not dump normally,
in cases where database corruption has occurred. In cases of such corruption,
this option will probably retrieve more principals than will the -rev
option.
load [-old] [-b6] [-b7]
[-ov] [-hash] [-verbose] [-update]
filename dbname [admin_dbname]
Loads a database dump from
filename into
dbname. Unless the
-old or
-b6 option is specified, the
format of the dump file is detected automatically and handled appropriately.
Unless the
-update option is specified,
load creates a new
database containing only the principals in the dump file, overwriting the
contents of any existing database. The
-old option requires the
database to be in the Kerberos 5 Beta 5 or earlier format ("
kdb5_edit
load_dump version 2.0").
-b6
Requires the database to be in the Kerberos 5 Beta 6
format ("kdb5_edit load_dump version 3.0").
-b7
Requires the database to be in the Kerberos 5 Beta 7
format ("kdb5_util load_dump version 4").
-ov
Requires the database to be in ovsec_adm_import
format. Must be used with the -update option.
-hash
Requires the database to be stored as a hash. If this
option is not specified, the database will be stored as a btree. This
option is not recommended, as databases stored in hash format are known to
corrupt data and lose principals.
-verbose
Causes the name of each principal and policy to be
displayed as it is dumped.
-update
Records from the dump file are added to or updated in the
existing database. Otherwise, a new database is created containing only what
is in the dump file and the old one is destroyed upon successful
completion.
filename
Required argument that specifies a path to a file
containing database dump.
dbname
Required argument that overrides the value specified on
the command line or overrides the default.
admin_dbname
Optional argument that is derived from dbname if
not specified.