1.\" Copyright (c) 2000 - 2003 Kungliga Tekniska H�gskolan 2.\" (Royal Institute of Technology, Stockholm, Sweden). 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" 3. Neither the name of the Institute nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" $Id: hprop.8,v 1.18 2003/02/16 21:10:19 lha Exp $ 33.\" 34.Dd June 19, 2000 35.Dt HPROP 8 36.Os HEIMDAL 37.Sh NAME 38.Nm hprop 39.Nd propagate the KDC database 40.Sh SYNOPSIS 41.Nm 42.Oo Fl m Ar file \*(Ba Xo 43.Fl -master-key= Ns Pa file 44.Xc 45.Oc 46.Oo Fl d Ar file \*(Ba Xo 47.Fl -database= Ns Pa file 48.Xc 49.Oc 50.Op Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|krb4-db|kaserver 51.Oo Fl r Ar string \*(Ba Xo 52.Fl -v4-realm= Ns Ar string 53.Xc 54.Oc 55.Oo Fl c Ar cell \*(Ba Xo 56.Fl -cell= Ns Ar cell 57.Xc 58.Oc 59.Op Fl S | Fl -kaspecials 60.Oo Fl k Ar keytab \*(Ba Xo 61.Fl -keytab= Ns Ar keytab 62.Xc 63.Oc 64.Oo Fl R Ar string \*(Ba Xo 65.Fl -v5-realm= Ns Ar string 66.Xc 67.Oc 68.Op Fl D | Fl -decrypt 69.Op Fl E | Fl -encrypt 70.Op Fl n | Fl -stdout 71.Op Fl v | Fl -verbose 72.Op Fl -version 73.Op Fl h | Fl -help 74.Op Ar host Ns Op : Ns Ar port 75.Ar ... 76.Sh DESCRIPTION 77.Nm 78takes a principal database in a specified format and converts it into 79a stream of Heimdal database records. This stream can either be 80written to standard out, or (more commonly) be propagated to a 81.Xr hpropd 8 82server running on a different machine. 83.Pp 84If propagating, it connects to all 85.Ar hosts 86specified on the command by opening a TCP connection to port 754 87(service hprop) and sends the database in encrypted form. 88.Pp 89Supported options: 90.Bl -tag -width Ds 91.It Xo 92.Fl m Ar file , 93.Fl -master-key= Ns Pa file 94.Xc 95Where to find the master key to encrypt or decrypt keys with. 96.It Xo 97.Fl d Ar file , 98.Fl -database= Ns Pa file 99.Xc 100The database to be propagated. 101.It Xo 102.Fl -source= Ns Ar heimdal|mit-dump|krb4-dump|krb4-db|kaserver 103.Xc 104Specifies the type of the source database. Alternatives include: 105.Pp 106.Bl -tag -width krb4-dump -compact -offset indent 107.It heimdal 108a Heimdal database 109.It mit-dump 110a MIT Kerberos 5 dump file 111.It krb4-db 112a Kerberos 4 database 113.It krb4-dump 114a Kerberos 4 dump file 115.It kaserver 116an AFS kaserver database 117.El 118.It Xo 119.Fl k Ar keytab , 120.Fl -keytab= Ns Ar keytab 121.Xc 122The keytab to use for fetching the key to be used for authenticating 123to the propagation daemon(s). The key 124.Pa kadmin/hprop 125is used from this keytab. The default is to fetch the key from the 126KDC database. 127.It Xo 128.Fl R Ar string , 129.Fl -v5-realm= Ns Ar string 130.Xc 131Local realm override. 132.It Xo 133.Fl D , 134.Fl -decrypt 135.Xc 136The encryption keys in the database can either be in clear, or 137encrypted with a master key. This option transmits the database with 138unencrypted keys. 139.It Xo 140.Fl E , 141.Fl -encrypt 142.Xc 143This option transmits the database with encrypted keys. 144.It Xo 145.Fl n , 146.Fl -stdout 147.Xc 148Dump the database on stdout, in a format that can be fed to hpropd. 149.El 150.Pp 151The following options are only valid if 152.Nm hprop 153is compiled with support for Kerberos 4 (kaserver). 154.Bl -tag -width Ds 155.It Xo 156.Fl r Ar string , 157.Fl -v4-realm= Ns Ar string 158.Xc 159v4 realm to use. 160.It Xo 161.Fl c Ar cell , 162.Fl -cell= Ns Ar cell 163.Xc 164The AFS cell name, used if reading a kaserver database. 165.It Xo 166.Fl S , 167.Fl -kaspecials 168.Xc 169Also dump the principals marked as special in the kaserver database. 170.It Xo 171.Fl 4 , 172.Fl -v4-db 173.Xc 174Deprecated, identical to 175.Sq --source=krb4-db . 176.It Xo 177.Fl K , 178.Fl -ka-db 179.Xc 180Deprecated, identical to 181.Sq --source=kaserver . 182.El 183.Sh EXAMPLES 184The following will propagate a database to another machine (which 185should run 186.Xr hpropd 8): 187.Bd -literal -offset indent 188$ hprop slave-1 slave-2 189.Ed 190.Pp 191Copy a Kerberos 4 database to a Kerberos 5 slave: 192.Bd -literal -offset indent 193$ hprop --source=krb4-db -E krb5-slave 194.Ed 195.Pp 196Convert a Kerberos 4 dump-file for use with a Heimdal KDC: 197.Bd -literal -offset indent 198$ hprop -n --source=krb4-dump -d /var/kerberos/principal.dump --master-key=/.k | hpropd -n 199.Ed 200.Sh SEE ALSO 201.Xr hpropd 8 202