1.\" Copyright (c) 2000 - 2004 Kungliga Tekniska H�gskolan 2.\" (Royal Institute of Technology, Stockholm, Sweden). 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" 3. Neither the name of the Institute nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" $Id: hprop.8 20456 2007-04-19 20:29:42Z lha $ 33.\" 34.Dd December 8, 2004 35.Dt HPROP 8 36.Os HEIMDAL 37.Sh NAME 38.Nm hprop 39.Nd propagate the KDC database 40.Sh SYNOPSIS 41.Nm 42.Bk -words 43.Oo Fl m Ar file \*(Ba Xo 44.Fl -master-key= Ns Pa file 45.Xc 46.Oc 47.Oo Fl d Ar file \*(Ba Xo 48.Fl -database= Ns Pa file 49.Xc 50.Oc 51.Op Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|kaserver 52.Oo Fl r Ar string \*(Ba Xo 53.Fl -v4-realm= Ns Ar string 54.Xc 55.Oc 56.Oo Fl c Ar cell \*(Ba Xo 57.Fl -cell= Ns Ar cell 58.Xc 59.Oc 60.Op Fl S | Fl -kaspecials 61.Oo Fl k Ar keytab \*(Ba Xo 62.Fl -keytab= Ns Ar keytab 63.Xc 64.Oc 65.Oo Fl R Ar string \*(Ba Xo 66.Fl -v5-realm= Ns Ar string 67.Xc 68.Oc 69.Op Fl D | Fl -decrypt 70.Op Fl E | Fl -encrypt 71.Op Fl n | Fl -stdout 72.Op Fl v | Fl -verbose 73.Op Fl -version 74.Op Fl h | Fl -help 75.Op Ar host Ns Op : Ns Ar port 76.Ar ... 77.Ek 78.Sh DESCRIPTION 79.Nm 80takes a principal database in a specified format and converts it into 81a stream of Heimdal database records. This stream can either be 82written to standard out, or (more commonly) be propagated to a 83.Xr hpropd 8 84server running on a different machine. 85.Pp 86If propagating, it connects to all 87.Ar hosts 88specified on the command by opening a TCP connection to port 754 89(service hprop) and sends the database in encrypted form. 90.Pp 91Supported options: 92.Bl -tag -width Ds 93.It Xo 94.Fl m Ar file , 95.Fl -master-key= Ns Pa file 96.Xc 97Where to find the master key to encrypt or decrypt keys with. 98.It Xo 99.Fl d Ar file , 100.Fl -database= Ns Pa file 101.Xc 102The database to be propagated. 103.It Xo 104.Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|kaserver 105.Xc 106Specifies the type of the source database. Alternatives include: 107.Pp 108.Bl -tag -width krb4-dump -compact -offset indent 109.It heimdal 110a Heimdal database 111.It mit-dump 112a MIT Kerberos 5 dump file 113.It krb4-dump 114a Kerberos 4 dump file 115.It kaserver 116an AFS kaserver database 117.El 118.It Xo 119.Fl k Ar keytab , 120.Fl -keytab= Ns Ar keytab 121.Xc 122The keytab to use for fetching the key to be used for authenticating 123to the propagation daemon(s). The key 124.Pa kadmin/hprop 125is used from this keytab. The default is to fetch the key from the 126KDC database. 127.It Xo 128.Fl R Ar string , 129.Fl -v5-realm= Ns Ar string 130.Xc 131Local realm override. 132.It Xo 133.Fl D , 134.Fl -decrypt 135.Xc 136The encryption keys in the database can either be in clear, or 137encrypted with a master key. This option transmits the database with 138unencrypted keys. 139.It Xo 140.Fl E , 141.Fl -encrypt 142.Xc 143This option transmits the database with encrypted keys. 144.It Xo 145.Fl n , 146.Fl -stdout 147.Xc 148Dump the database on stdout, in a format that can be fed to hpropd. 149.El 150.Pp 151The following options are only valid if 152.Nm hprop 153is compiled with support for Kerberos 4 (kaserver). 154.Bl -tag -width Ds 155.It Xo 156.Fl r Ar string , 157.Fl -v4-realm= Ns Ar string 158.Xc 159v4 realm to use. 160.It Xo 161.Fl c Ar cell , 162.Fl -cell= Ns Ar cell 163.Xc 164The AFS cell name, used if reading a kaserver database. 165.It Xo 166.Fl S , 167.Fl -kaspecials 168.Xc 169Also dump the principals marked as special in the kaserver database. 170.It Xo 171.Fl K , 172.Fl -ka-db 173.Xc 174Deprecated, identical to 175.Sq --source=kaserver . 176.El 177.Sh EXAMPLES 178The following will propagate a database to another machine (which 179should run 180.Xr hpropd 8 ): 181.Bd -literal -offset indent 182$ hprop slave-1 slave-2 183.Ed 184.Pp 185Convert a Kerberos 4 dump-file for use with a Heimdal KDC: 186.Bd -literal -offset indent 187$ hprop -n --source=krb4-dump -d /var/kerberos/principal.dump --master-key=/.k | hpropd -n 188.Ed 189.Sh SEE ALSO 190.Xr hpropd 8 191