Node: Administrating the Kerberos Database, Next: Application Servers, Previous: Using DNS, Up: Top

## Administrating the Kerberos Database

Your Kerberos database contains all of your realm's Kerberos principals, their passwords, and other administrative information about each principal. For the most part, you will use the `kdb5_util` program to manipulate the Kerberos database as a whole, and the `kadmin` program to make changes to the entries in the database. (One notable exception is that users will use the `kpasswd` program to change their own passwords.) The `kadmin` program has its own command-line interface, to which you type the database administrating commands.

`Kdb5_util` provides a means to create, delete, load, or dump a Kerberos database. It also includes a command to stash a copy of the master database key in a file on a KDC, so that the KDC can authenticate itself to the `kadmind` and `krb5kdc` daemons at boot time.

`Kadmin` provides for the maintenance of Kerberos principals, KADM5 policies, and service key tables (keytabs). It exists as both a Kerberos client, `kadmin`, using Kerberos authentication and an RPC, to operate securely from anywhere on the network, and as a local client, `kadmin.local`, intended to run directly on the KDC without Kerberos authentication. Other than the fact that the remote client uses Kerberos to authenticate the person using it, the functionalities of the two versions are identical. The local version is necessary to enable you to set up enough of the database to be able to use the remote version. It replaces the now obsolete `kdb5_edit` (except for database dump and load, which are provided by `kdb5_util`).

The remote version authenticates to the KADM5 server using the service principal `kadmin/admin`. If the credentials cache contains a ticket for the `kadmin/admin` principal, and the `-c ccache` option is specified, that ticket is used to authenticate to KADM5. Otherwise, the `-p` and `-k` options are used to specify the client Kerberos principal name used to authenticate. Once kadmin has determined the principal name, it requests a `kadmin/admin` Kerberos service ticket from the KDC, and uses that service ticket to authenticate to KADM5.