1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
|
.TH "KADM5.ACL" "5" " " "1.12" "MIT Kerberos"
.SH NAME
kadm5.acl \- Kerberos ACL file
.
.nr rst2man-indent-level 0
.
.de1 rstReportMargin
\\$1 \\n[an-margin]
level \\n[rst2man-indent-level]
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
-
\\n[rst2man-indent0]
\\n[rst2man-indent1]
\\n[rst2man-indent2]
..
.de1 INDENT
.\" .rstReportMargin pre:
. RS \\$1
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
. nr rst2man-indent-level +1
.\" .rstReportMargin post:
..
.de UNINDENT
. RE
.\" indent \\n[an-margin]
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
.nr rst2man-indent-level -1
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
..
.\" Man page generated from reStructuredText.
.
.SH DESCRIPTION
.sp
The Kerberos \fIkadmind(8)\fP daemon uses an Access Control List
(ACL) file to manage access rights to the Kerberos database.
For operations that affect principals, the ACL file also controls
which principals can operate on which other principals.
.sp
The default location of the Kerberos ACL file is
\fB@LOCALSTATEDIR@\fP\fB/krb5kdc\fP\fB/kadm5.acl\fP unless this is overridden by the \fIacl_file\fP
variable in \fIkdc.conf(5)\fP.
.SH SYNTAX
.sp
Empty lines and lines starting with the sharp sign (\fB#\fP) are
ignored. Lines containing ACL entries have the format:
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
principal permissions [target_principal [restrictions] ]
.ft P
.fi
.UNINDENT
.UNINDENT
.IP Note
Line order in the ACL file is important. The first matching entry
will control access for an actor principal on a target principal.
.RE
.INDENT 0.0
.TP
.B \fIprincipal\fP
(Partially or fully qualified Kerberos principal name.) Specifies
the principal whose permissions are to be set.
.sp
Each component of the name may be wildcarded using the \fB*\fP
character.
.TP
.B \fIpermissions\fP
Specifies what operations may or may not be performed by a
\fIprincipal\fP matching a particular entry. This is a string of one or
more of the following list of characters or their upper\-case
counterparts. If the character is \fIupper\-case\fP, then the operation
is disallowed. If the character is \fIlower\-case\fP, then the operation
is permitted.
.TS
center;
|l|l|.
_
T{
a
T} T{
[Dis]allows the addition of principals or policies
T}
_
T{
c
T} T{
[Dis]allows the changing of passwords for principals
T}
_
T{
d
T} T{
[Dis]allows the deletion of principals or policies
T}
_
T{
i
T} T{
[Dis]allows inquiries about principals or policies
T}
_
T{
l
T} T{
[Dis]allows the listing of principals or policies
T}
_
T{
m
T} T{
[Dis]allows the modification of principals or policies
T}
_
T{
p
T} T{
[Dis]allows the propagation of the principal database (used in \fIincr_db_prop\fP)
T}
_
T{
s
T} T{
[Dis]allows the explicit setting of the key for a principal
T}
_
T{
x
T} T{
Short for admcil. All privileges
T}
_
T{
*
T} T{
Same as x.
T}
_
.TE
.TP
.B \fItarget_principal\fP
(Optional. Partially or fully qualified Kerberos principal name.)
Specifies the principal on which \fIpermissions\fP may be applied.
Each component of the name may be wildcarded using the \fB*\fP
character.
.sp
\fItarget_principal\fP can also include back\-references to \fIprincipal\fP,
in which \fB*number\fP matches the component number in \fIprincipal\fP.
.TP
.B \fIrestrictions\fP
(Optional) A string of flags. Allowed restrictions are:
.INDENT 7.0
.INDENT 3.5
.INDENT 0.0
.TP
.B {+|\-}\fIflagname\fP
flag is forced to the indicated value. The permissible flags
are the same as the + and \- flags for the kadmin
\fIadd_principal\fP and \fImodify_principal\fP commands.
.TP
.B \fI\-clearpolicy\fP
policy is forced to be empty.
.TP
.B \fI\-policy pol\fP
policy is forced to be \fIpol\fP.
.TP
.B \-{\fIexpire, pwexpire, maxlife, maxrenewlife\fP} \fItime\fP
(\fIgetdate\fP string) associated value will be forced to
MIN(\fItime\fP, requested value).
.UNINDENT
.UNINDENT
.UNINDENT
.sp
The above flags act as restrictions on any add or modify operation
which is allowed due to that ACL line.
.UNINDENT
.IP Warning
If the kadmind ACL file is modified, the kadmind daemon needs to be
restarted for changes to take effect.
.RE
.SH EXAMPLE
.sp
Here is an example of a kadm5.acl file.
.INDENT 0.0
.INDENT 3.5
.sp
.nf
.ft C
*/admin@ATHENA.MIT.EDU * # line 1
joeadmin@ATHENA.MIT.EDU ADMCIL # line 2
joeadmin/*@ATHENA.MIT.EDU il */root@ATHENA.MIT.EDU # line 3
*/root@ATHENA.MIT.EDU cil *1@ATHENA.MIT.EDU # line 4
*/*@ATHENA.MIT.EDU i # line 5
*/admin@EXAMPLE.COM x * \-maxlife 9h \-postdateable # line 6
.ft P
.fi
.UNINDENT
.UNINDENT
.sp
(line 1) Any principal in the \fBATHENA.MIT.EDU\fP realm with
an \fBadmin\fP instance has all administrative privileges.
.sp
(lines 1\-3) The user \fBjoeadmin\fP has all permissions with his
\fBadmin\fP instance, \fBjoeadmin/admin@ATHENA.MIT.EDU\fP (matches line
1). He has no permissions at all with his null instance,
\fBjoeadmin@ATHENA.MIT.EDU\fP (matches line 2). His \fBroot\fP and other
non\-\fBadmin\fP, non\-null instances (e.g., \fBextra\fP or \fBdbadmin\fP) have
inquire and list permissions with any principal that has the
instance \fBroot\fP (matches line 3).
.sp
(line 4) Any \fBroot\fP principal in \fBATHENA.MIT.EDU\fP can inquire, list,
or change the password of their null instance, but not any other
null instance. (Here, "*1" denotes a back\-reference to the first
component of the actor principal.)
.sp
(line 5) Any principal in the realm \fBATHENA.MIT.EDU\fP (except for
\fBjoeadmin@ATHENA.MIT.EDU\fP, as mentioned above) has inquire
privileges.
.sp
(line 6) Finally, any principal with an \fBadmin\fP instance in \fBEXAMPLE.COM\fP
has all permissions, but any principal that they create or modify will
not be able to get postdateable tickets or tickets with a life of
longer than 9 hours.
.SH SEE ALSO
.sp
\fIkdc.conf(5)\fP, \fIkadmind(8)\fP
.SH AUTHOR
MIT
.SH COPYRIGHT
1985-2013, MIT
.\" Generated by docutils manpage writer.
.
|
