NAME

       kadmind - KADM5 administration server

SYNOPSIS

       kadmind  [-x  db_args]  [-r  realm]  [-m]  [-nofork] [-port port-number] [-P pid_file] [-p
       kdb5_util_path] [-K kprop_path] [-F dump_file]

DESCRIPTION

       kadmind starts the Kerberos administration server.  kadmind typically runs on  the  master
       Kerberos server, which stores the KDC database.  If the KDC database uses the LDAP module,
       the administration server and the KDC server need not run on the  same  machine.   kadmind
       accepts  remote  requests from programs such as kadmin(1) and kpasswd(1) to administer the
       information in these database.

       kadmind requires a number of configuration files to be set up in order for it to work:

       kdc.conf(5)
              The KDC configuration file contains configuration information for the KDC and admin
              servers.   kadmind  uses settings in this file to locate the Kerberos database, and
              is also affected  by  the  acl_file,  dict_file,  kadmind_port,  and  iprop-related
              settings.

       kadm5.acl(5)
              kadmind's  ACL  (access  control  list)  tells  it  which principals are allowed to
              perform administration actions.  The pathname to the ACL file can be specified with
              the acl_file kdc.conf(5) variable; by default, it is /etc/krb5kdc/kadm5.acl.

       After the server begins running, it puts itself in the background and disassociates itself
       from its controlling terminal.

       kadmind can be configured for incremental database propagation.   Incremental  propagation
       allows  slave KDC servers to receive principal and policy updates incrementally instead of
       receiving full dumps of the database.  This facility can be  enabled  in  the  kdc.conf(5)
       file  with  the  iprop_enable  option.   Incremental  propagation  requires  the principal
       kiprop/MASTER\@REALM (where MASTER is the master KDC's canonical host name, and REALM  the
       realm name) to be registered in the database.

OPTIONS

       -r realm
              specifies  the  realm  that kadmind will serve; if it is not specified, the default
              realm of the host is used.

       -m     causes the master database password to be fetched from  the  keyboard  (before  the
              server  puts  itself  in  the  background,  if not invoked with the -nofork option)
              rather than from a file on disk.

       -nofork
              causes the server to  remain  in  the  foreground  and  remain  associated  to  the
              terminal.   In normal operation, you should allow the server to place itself in the
              background.

       -port port-number
              specifies the port on which the administration server listens for connections.  The
              default   port   is  determined  by  the  kadmind_port  configuration  variable  in
              kdc.conf(5).

       -P pid_file
              specifies the file to which the PID of kadmind process should be written  after  it
              starts  up.  This file can be used to identify whether kadmind is still running and
              to allow init scripts to stop the correct process.

       -p kdb5_util_path
              specifies the path to the kdb5_util command to use when dumping the KDB in response
              to full resync requests when iprop is enabled.

       -K kprop_path
              specifies  the  path  to  the  kprop command to use to send full dumps to slaves in
              response to full resync requests.

       -F dump_file
              specifies the file path to be used for dumping the KDB in response to  full  resync
              requests when iprop is enabled.

       -x db_args
              specifies database-specific arguments.

              Options supported for LDAP database are:

                 -x nconns=number_of_connections
                        specifies the number of connections to be maintained per LDAP server.

                 -x host=ldapuri
                        specifies the LDAP server to connect to by URI.

                 -x binddn=binddn
                        specifies  the DN of the object used by the administration server to bind
                        to the LDAP server.  This object should have read and write privileges on
                        the  realm  container,  the  principal container, and the subtree that is
                        referenced by the realm.

                 -x bindpwd=bind_password
                        specifies the password for the above mentioned binddn.  Using this option
                        may  expose  the  password  to  other users on the system via the process
                        list; to avoid this, instead stash  the  password  using  the  stashsrvpw
                        command of kdb5_ldap_util(8).

                 -x debug=level
                        sets  the OpenLDAP client library debug level.  level is an integer to be
                        interpreted by the library.  Debugging messages are printed  to  standard
                        error,  so this option must be used with the -nofork option to be useful.
                        New in release 1.12.

SEE ALSO

       kpasswd(1), kadmin(1), kdb5_util(8), kdb5_ldap_util(8), kadm5.acl(5)

AUTHOR

       MIT

COPYRIGHT

       1985-2013, MIT