diff options
| author | Tom Yu <tlyu@mit.edu> | 2010-10-08 03:57:28 +0000 |
|---|---|---|
| committer | Tom Yu <tlyu@mit.edu> | 2010-10-08 03:57:28 +0000 |
| commit | 1cc59c12550c828d487c622990d83481e8bbb6c5 (patch) | |
| tree | a22d50f4041bfa23ad1001bfa6164626602885ac /src/kadmin/cli/kadmin.M | |
| parent | bd7b3a76ef6ca5485ec8a8b2de4a2a5170356f84 (diff) | |
| download | krb5-1cc59c12550c828d487c622990d83481e8bbb6c5.tar.gz krb5-1cc59c12550c828d487c622990d83481e8bbb6c5.tar.xz krb5-1cc59c12550c828d487c622990d83481e8bbb6c5.zip | |
Add a kadm5 RPC for purging old keys from the KDB (e.g., from
change_password -keepold), and add a kadmin CLI command for it.
Keeping ticket open because an automated test needs to be added.
Long-term future work includes start/expire dates on keys, or
not-yet-valid flags.
ticket: 1219
status: open
target_version: 1.9
git-svn-id: svn://anonsvn.mit.edu/krb5/trunk@24442 dc483132-0cff-0310-8789-dd5450dbe970
Diffstat (limited to 'src/kadmin/cli/kadmin.M')
| -rw-r--r-- | src/kadmin/cli/kadmin.M | 21 |
1 files changed, 13 insertions, 8 deletions
diff --git a/src/kadmin/cli/kadmin.M b/src/kadmin/cli/kadmin.M index d6f2df5224..7e6db2c61b 100644 --- a/src/kadmin/cli/kadmin.M +++ b/src/kadmin/cli/kadmin.M @@ -562,8 +562,7 @@ enctype\-salttype pairs. This will not function against kadmin daemons earlier than krb5\-1.2. .TP \fB\-keepold \fP -Keeps the previous kvno's keys around. There is no -easy way to delete the old keys, and this flag is usually not +Keeps the previous kvno's keys around. This flag is usually not necessary except perhaps for TGS keys. Don't use this flag unless you know what you're doing. This option is not supported for the LDAP database. .nf @@ -586,6 +585,18 @@ expired) .RE .fi .TP +\fBpurgekeys\fP [\fB-keepkvno\fP \fIoldest_kvno_to_keep\fP] \fIprincipal\fP +purges previously retained old keys (e.g., from +.B change_password +.BR -keepold ) +from +.IR principal . +If +.B -keepkvno +is specified, then only purges keys with kvnos lower than +.IR oldest_kvno_to_keep . +.fi +.TP \fBget_principal\fP [\fB-terse\fP] \fIprincipal\fP gets the attributes of .IR principal . @@ -922,9 +933,3 @@ OpenVision Kerberos administration program. .SH BUGS .PP Command output needs to be cleaned up. - -There is no way to delete a key kept around from a "\-keepold" option -to a password-changing command, other than to do a password change -without the "\-keepold" option, which will of course cause problems if -the key is a TGS key. There will be more powerful key-manipulation -commands in the future. |