xref: /freebsd/crypto/heimdal/kdc/hprop.8 (revision 195ebc7e9e4b129de810833791a19dfb4349d6a9)
1.\" Copyright (c) 2000 - 2004 Kungliga Tekniska H�gskolan
2.\" (Royal Institute of Technology, Stockholm, Sweden).
3.\" All rights reserved.
4.\"
5.\" Redistribution and use in source and binary forms, with or without
6.\" modification, are permitted provided that the following conditions
7.\" are met:
8.\"
9.\" 1. Redistributions of source code must retain the above copyright
10.\"    notice, this list of conditions and the following disclaimer.
11.\"
12.\" 2. Redistributions in binary form must reproduce the above copyright
13.\"    notice, this list of conditions and the following disclaimer in the
14.\"    documentation and/or other materials provided with the distribution.
15.\"
16.\" 3. Neither the name of the Institute nor the names of its contributors
17.\"    may be used to endorse or promote products derived from this software
18.\"    without specific prior written permission.
19.\"
20.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30.\" SUCH DAMAGE.
31.\"
32.\" $Id: hprop.8 20456 2007-04-19 20:29:42Z lha $
33.\"
34.Dd December  8, 2004
35.Dt HPROP 8
36.Os HEIMDAL
37.Sh NAME
38.Nm hprop
39.Nd propagate the KDC database
40.Sh SYNOPSIS
41.Nm
42.Bk -words
43.Oo Fl m Ar file \*(Ba Xo
44.Fl -master-key= Ns Pa file
45.Xc
46.Oc
47.Oo Fl d Ar file \*(Ba Xo
48.Fl -database= Ns Pa file
49.Xc
50.Oc
51.Op Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|kaserver
52.Oo Fl r Ar string \*(Ba Xo
53.Fl -v4-realm= Ns Ar string
54.Xc
55.Oc
56.Oo Fl c Ar cell \*(Ba Xo
57.Fl -cell= Ns Ar cell
58.Xc
59.Oc
60.Op Fl S | Fl -kaspecials
61.Oo Fl k Ar keytab \*(Ba Xo
62.Fl -keytab= Ns Ar keytab
63.Xc
64.Oc
65.Oo Fl R Ar string \*(Ba Xo
66.Fl -v5-realm= Ns Ar string
67.Xc
68.Oc
69.Op Fl D | Fl -decrypt
70.Op Fl E | Fl -encrypt
71.Op Fl n | Fl -stdout
72.Op Fl v | Fl -verbose
73.Op Fl -version
74.Op Fl h | Fl -help
75.Op Ar host Ns Op : Ns Ar port
76.Ar ...
77.Ek
78.Sh DESCRIPTION
79.Nm
80takes a principal database in a specified format and converts it into
81a stream of Heimdal database records. This stream can either be
82written to standard out, or (more commonly) be propagated to a
83.Xr hpropd 8
84server running on a different machine.
85.Pp
86If propagating, it connects to all
87.Ar hosts
88specified on the command by opening a TCP connection to port 754
89(service hprop) and sends the database in encrypted form.
90.Pp
91Supported options:
92.Bl -tag -width Ds
93.It Xo
94.Fl m Ar file ,
95.Fl -master-key= Ns Pa file
96.Xc
97Where to find the master key to encrypt or decrypt keys with.
98.It Xo
99.Fl d Ar file ,
100.Fl -database= Ns Pa file
101.Xc
102The database to be propagated.
103.It Xo
104.Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|kaserver
105.Xc
106Specifies the type of the source database. Alternatives include:
107.Pp
108.Bl -tag -width krb4-dump -compact -offset indent
109.It heimdal
110a Heimdal database
111.It mit-dump
112a MIT Kerberos 5 dump file
113.It krb4-dump
114a Kerberos 4 dump file
115.It kaserver
116an AFS kaserver database
117.El
118.It Xo
119.Fl k Ar keytab ,
120.Fl -keytab= Ns Ar keytab
121.Xc
122The keytab to use for fetching the key to be used for authenticating
123to the propagation daemon(s). The key
124.Pa kadmin/hprop
125is used from this keytab.  The default is to fetch the key from the
126KDC database.
127.It Xo
128.Fl R Ar string ,
129.Fl -v5-realm= Ns Ar string
130.Xc
131Local realm override.
132.It Xo
133.Fl D ,
134.Fl -decrypt
135.Xc
136The encryption keys in the database can either be in clear, or
137encrypted with a master key. This option transmits the database with
138unencrypted keys.
139.It Xo
140.Fl E ,
141.Fl -encrypt
142.Xc
143This option transmits the database with encrypted keys.
144.It Xo
145.Fl n ,
146.Fl -stdout
147.Xc
148Dump the database on stdout, in a format that can be fed to hpropd.
149.El
150.Pp
151The following options are only valid if
152.Nm hprop
153is compiled with support for Kerberos 4 (kaserver).
154.Bl -tag -width Ds
155.It Xo
156.Fl r Ar string ,
157.Fl -v4-realm= Ns Ar string
158.Xc
159v4 realm to use.
160.It Xo
161.Fl c Ar cell ,
162.Fl -cell= Ns Ar cell
163.Xc
164The AFS cell name, used if reading a kaserver database.
165.It Xo
166.Fl S ,
167.Fl -kaspecials
168.Xc
169Also dump the principals marked as special in the kaserver database.
170.It Xo
171.Fl K ,
172.Fl -ka-db
173.Xc
174Deprecated, identical to
175.Sq --source=kaserver .
176.El
177.Sh EXAMPLES
178The following will propagate a database to another machine (which
179should run
180.Xr hpropd 8 ):
181.Bd -literal -offset indent
182$ hprop slave-1 slave-2
183.Ed
184.Pp
185Convert a Kerberos 4 dump-file for use with a Heimdal KDC:
186.Bd -literal -offset indent
187$ hprop -n --source=krb4-dump -d /var/kerberos/principal.dump --master-key=/.k | hpropd -n
188.Ed
189.Sh SEE ALSO
190.Xr hpropd 8
191