Manual Administration Using kadmin

When you create a principal, the failed authentication count is automatically set to zero. The user associated with that principal increments the failed authentication count by one for each failed authentication attempt.

If the user has more consecutive authentication failures than allowed by the MaxFailAuthCnt parameter in the password policy file, the principal is locked. Before the user can attempt to authenticate again, the administrator must unlock the principal, which resets the fcnt to zero.

If the user successfully authenticates before the maximum failed authentication count value, fcnt is automatically reset to zero.

To modify the parameter type fcnt for the principal admin, you need to do the following:

 Command: mod
	 Name of Principal to Modify: admin
	 Parameter Type to be Modified (attr,fcnt,vno or quit) :fcnt
	 Failure Count (or quit): <enter count>
	 Principal modified.

Every principal password has an associated version number that identifies the number of times the password has been changed.

When a principal is created, its password version number is inherited from the default group template. Every time a password is changed, the version number is incremented by one. However, the key version number is a writable field in the database, and hence this cannot be considered an accurate counter for the number of password changes made to a principal.

If you change the password for the default group principal, the key version number will increment, and therefore every new principal added to the database will not begin with one. As this may be confusing, we recommend that you edit the version number for the default group principal to be one after you re-generate a key for the default principal.

To modify the parameter type vno of the principal admin, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :vno
Remote Administrator version Number (or quit): <enter count>
Principal modified.

The attributes indicate the properties that are associated with a principal. To view a list of attributes using the command line option, type the following and press the ENTER key:

The following sections discuss the various attributes associated with a principal.

The Allow Postdated attribute determines whether a principal is allowed ticket postdating. Postdating is a mechanism that allows a principal to obtain a ticket that is initially invalid but becomes valid in the future.

The Allow Postdated attribute applies to both user and service principals as indicated below:

To modify the parameter type attr for the principal admin, to set the Allow Postdated Attribute, you would need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {postdate|nopostdate}
Principal modified.

The Allow Renewable attribute determines whether a principal is allowed to request for renewable tickets. Renewable tickets are those that can be re-validated up to the maximum renewal time.

The maximum ticket lifetime and renewable time are stored in the principal database in krbtgt/REALM@REALM principal. Individual principal accounts can be limited using the Maximum Renew Time Setting on the General tab of the Administrator.

The Allow Renewable attribute applies to both user and service principals. If this attribute is set for a,

To modify the parameter type attr for the principal admin, to set the Allow Renewable Attribute, you would need to do the following:

Command: mod
Name of Principal to Modify: admin
P arameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {renew|norenew}
Principal modified.

The Allow Forwardable attribute determines whether a principal is allowed ticket forwarding. Forwarding is a mechanism to send a TGT to a remote system, from one network host to another. The forwarded TGT can be used to generate, on the principal's behalf, a new service ticket on the second host's system. This eliminates the need for the user to re-authenticate and re-enter the password on the second host.

The Allow Forwardable attribute applies to both user and service principals. If this attribute is set for a,

To modify the parameter type attr for the principal admin, to set the Allow Forwardable Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {forward|noforward}
Principal modified.

The Allow Proxy attribute determines whether a principal is allowed proxy tickets. Proxy tickets allow applications that a principal accesses with a TGT to request a special class of service ticket. This type of service ticket can be moved to another host on the network that acts on the principal's behalf. For example, a print service printing a file for a user.

	WARNING! The authorization fields of the ticket and authenticator can be used to hold restrictions on the proxy ticket.

The Allow Proxy attribute applies to both user and service principals. If this attribute is set for a,

	NOTE: Before the server issues a proxy service ticket, the requesting user must possess a proxy TGT

To modify the parameter type attr for the principal admin, to set the Allow Proxy Attribute, you need to do the following:

	 Command: mod
	 Name of Principal to Modify: admin
	 Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
	 Attribute (or quit): {proxy|noproxy}
	 Principal modified.

The Allow Duplicate Session Key attribute determines whether a principal is allowed to use a duplicate session key. A duplicate session key, applies to user-to-user authentication, determines which key is used to encrypt the requested service tickets.

This setting controls the security protocol between an initiator, typically a client application, and acceptor, typically a service. When a user performs an action that causes the initiator application to request for a duplicate session key:

This attribute is set by default, thereby allowing an initiator application to request for a duplicate session key for the acceptor's application. Principal accounts using duplicate session keys must be assigned the Allow as Service Attribute.

To modify the parameter type attr for the principal admin, to set the Allow Duplicate Session Key Attribute, you need to do the following:

	 Command: mod
	 Name of Principal to Modify: admin
	 P	arameter Type to be Modified (attr,fcnt,vno or quit) :attr
	 Attribute (or quit): {dskey|nodskey}
	 Principal modified.

The Require Preauthentication attribute determines whether a principal is required to preauthenticate when requesting for a TGT. Preauthentication implies that the client logon program attaches known encrypted data to a ticket request, providing additional security when the TGT is presented to gain access to a secured service.

The Require Preauthentication attribute applies to user and service principals. If this attribute is set for a,

	NOTE: Client applications require preauthentication by default; however, a client can override this setting.

To modify the parameter type attr for the principal admin, to set the Require Preauthentication Attribute, you need to do the following:

C ommand: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {preauth|nopreauth}
Principal modified.

The Require Password Change attribute determines whether a principal must change the user's password during the next authentication attempt. When this attribute is set, users are required to change their passwords.

When a new principal is added to the database or when a principal's password is changed, this attribute is controlled by the NoReqChangePwd setting in the principal's password policy file. By default, NoReqChangePwd is set to zero, meaning the user must change their password at first logon.

If a random key is designated for a principal using Administrator or the kadmin addrnd command, the Require Change Password attribute is not set by default. As a result, a service principal with an extracted key is not required to have a new key extracted at the next authentication attempt.

To modify the parameter type attr for the principal admin, to set the Require Password Change Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {pwchg|nopwchg}
Principal modified.

The Lock Principal attribute determines whether a principal account is usable. A locked principal exists in the principal database but is unable to use or provide security network services.

The Lock Principal attribute applies to both user and service principals. If this attribute is set for a,

This attribute is set automatically when a principal exceeds the maximum number of failed authentication attempts specified in the password policy file. The default maximum number of failed authentication attempts allowed is five (5). If a principal account is locked, a principal with the required administrative permissions must unlock the principal account before the user can authenticate again.

To modify the parameter type attr for the principal admin, to set the Lock Principal Attribute, you need to do the following:

	 Command: mod
	 Name of Principal to Modify: admin
	 Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
	 Attribute (or quit): {lock|nolock}
	 Principal modified.

The Allow As Service attribute should be selected for any principal that will be used as a service.

This attribute can be applied to all principal types, both user and service. Selecting this attribute does not necessarily mean that the principal account is being used by a network service application. Select this attribute for user principals who run programs that require user-to-user authentication.

When this attribute is set, the principal's name appears in the server field of the service ticket. If this attribute is not set, the security server cannot issue a service ticket for that principal because the principal's name cannot appear in the server field of the service ticket.

This attribute is set by default, allowing principals to act as a service and enabling user-to-user authentication for user principals.

To modify the parameter type attr of the principal admin, to set the Allow as Service Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
A ttribute (or quit): {svr|nosvr}
Principal modified.

The Require Initial Authentication attribute specifies whether the server is allowed to issue service tickets to a service principal on behalf of a user principal using an existing TGT.

The Require Initial Authentication attribute applies only to service principals,

	NOTE: In Administrator, when the Require Initial Authentication attribute is selected, the Allow as Service Attribute is automatically selected.

Do not enable this setting for user principal accounts. This attribute is applicable to selected service principals.

To modify the parameter type attr of the principal admin, to set the Require Initial Authentication Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {tgt|notgt}
Principal modified.

The notgt command in kadmin is equivalent to selecting the Require Initial Authentication on the Attributes tab of the Administrator; the tgt command in the kadmin is equivalent to clearing the Require Initial Authentication check-box on the Attributes tab.

You can use the kadmin inq command to view this principal's attribute. With Require Initial Authentication selected (tgt), the inquire command shows TGT_BASED in the attributes field. Without the Require Initial Authentication setting (notgt) no text appears in the attributes field.

Table 6-4 “Require Initial Authentication Attribute Settings” equates the Administrator Attributes tab check-box setting with the kadmin command setting. It also indicates the attribute text that shows if you view a principal's settings using the kadmin inq command.

The Set As Password Change Service attribute determines whether a service principal can act as a change password service. Setting this attribute allows a service principal to receive initial tickets for user principals whose passwords have expired.

	NOTE: When the Set as Password Change Service attribute is selected, the Require Initial Authentication Attribute is automatically selected.

Normally, you would select the Set As Password Change Service attribute for only the service principal defined as a change password service. You can add other Change Password service principals to the principal database if you have created custom applications that require different password service principals.

To modify the parameter type attr of the principal admin, to set the Set As Password Change Service Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
P arameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {cpwsrv|nocpwsrv}
Principal modified.

A principal password can have either a finite or an infinite lifetime. Expiration time is controlled by several factors, including the principal type:

As the expiration time is calculated from the time a new principal is added to the database, the password change load on the server is distributed over time. Therefore, you can select to require a password expiration in the default group principal template without concern for the administrative load, provided you add new principals over a period of time.

To modify the parameter type attr of the principal admin, to set the Password Expiration Attribute, you need to do the following:

Command: mod
Name of Principal to Modify: admin
Parameter Type to be Modified (attr,fcnt,vno or quit) :attr
Attribute (or quit): {cpwexp|nocpwexp}
Principal modified.

The Principal Expiration setting determines when a principal account will expire. This can be set to a definite time or never. An expired principal account is essentially locked; it can no longer be used to access the security network. However, it is not removed from the principal database, and the account can be re-enabled by resetting the expiration time.

Setting a principal expiration time may be useful for temporary employees. However, if you choose an expiration date for the default group principal, all principals added using that template setting will expire at the same time. You should consider the administrative requirements of expiring all principal accounts on the same day.

This attribute cannot be set with Command-Line-Administrator.

The key type used to generate a secret key is an important security decision.

Each principal can be associated with two different secret keys. These are called the primary and secondary keys. Each key is associated with an encryption type. The encryption type designates the encryption algorithm used to generate the secret key. The three supported encryption types are:

This attribute cannot be set with Command-Line-Administrator.