1  /*
  2   * Copyright (c) 2004 - 2007 Kungliga Tekniska Högskolan
  3   * (Royal Institute of Technology, Stockholm, Sweden). 
  4   * All rights reserved. 
  5   *
  6   * Redistribution and use in source and binary forms, with or without 
  7   * modification, are permitted provided that the following conditions 
  8   * are met: 
  9   *
 10   * 1. Redistributions of source code must retain the above copyright 
 11   *    notice, this list of conditions and the following disclaimer. 
 12   *
 13   * 2. Redistributions in binary form must reproduce the above copyright 
 14   *    notice, this list of conditions and the following disclaimer in the 
 15   *    documentation and/or other materials provided with the distribution. 
 16   *
 17   * 3. Neither the name of the Institute nor the names of its contributors 
 18   *    may be used to endorse or promote products derived from this software 
 19   *    without specific prior written permission. 
 20   *
 21   * THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 
 22   * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 
 23   * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 
 24   * ARE DISCLAIMED.  IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 
 25   * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 
 26   * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 
 27   * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 
 28   * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 
 29   * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 
 30   * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 
 31   * SUCH DAMAGE. 
 32   */
 33  /* $Id$ */
 34  
 35  command = {
 36  	name = "stash"
 37  	name = "kstash"
 38  	option = {
 39  		long = "enctype"
 40  		short = "e"
 41  		type = "string"
 42  		help = "encryption type"
 43  		default = "des3-cbc-sha1"
 44  	}
 45  	option = {
 46  		long = "key-file"
 47  		short = "k"
 48  		type = "string"
 49  		argument = "file"
 50  		help = "master key file"
 51  	}
 52  	option = {
 53  		long = "convert-file"
 54  		type = "flag"
 55  		help = "just convert keyfile to new format"
 56  	}
 57  	option = {
 58  		long = "random-password"
 59  		type = "flag"
 60  		help = "use a random password (and print the password to stdout)"
 61  	}
 62  	option = {
 63  		long = "print-password"
 64  		type = "-flag"
 65  		help = "dont print the random password to stdout"
 66  	}
 67  	option = {
 68  		long = "master-key-fd"
 69  		type = "integer"
 70  		argument = "fd"
 71  		help = "filedescriptor to read passphrase from"
 72  		default = "-1"
 73  	}
 74  	help = "Writes the Kerberos master key to a file used by the KDC. \nLocal (-l) mode only."
 75  }
 76  command = {
 77  	name = "dump"
 78  	option = {
 79  		long = "decrypt"
 80  		short = "d"
 81  		type = "flag"
 82  		help = "decrypt keys"
 83  	}
 84  	option = {
 85  		long = "format"
 86  		type = "string"
 87  		help = "dump format, default heimdal"
 88  	}
 89  	option = {
 90  		long = "mit-dump-file"
 91  		type = "string"
 92  		help = "mit dump file"
 93  	}
 94  	argument = "[dump-file]"
 95  	min_args = "0"
 96  	max_args = "1"
 97  	help = "Dumps the database or a dump file in a human readable format to the specified file, \nor the standard out. Local (-l) mode only."
 98  }
 99  command = {
100  	name = "od-dump"
101  	option = {
102  		long = "decrypt"
103  		short = "d"
104  		type = "flag"
105  		help = "decrypt keys"
106  	}
107  	argument = "[dump-file]"
108  	min_args = "0"
109  	max_args = "1"
110  	help = "Command to be removed."
111  }
112  command = {
113  	name = "init"
114  	option = {
115  		long = "realm-max-ticket-life"
116  		type = "string"
117  		help = "realm max ticket lifetime"
118  	}
119  	option = {
120  		long = "realm-max-renewable-life"
121  		type = "string"
122  		help = "realm max renewable lifetime"
123  	}
124  	option = {
125  		long = "bare"
126  		type = "flag"
127  		help = "only create krbtgt for realm"
128  	}
129  	argument = "realm..."
130  	min_args = "1"
131  	help = "Initializes the default principals for a realm. Creates the database\nif necessary. Local (-l) mode only."
132  }
133  command = {
134  	name = "load"
135  	option = {
136  		long = "fix-salts"
137  		type = "flag"
138  		help = "Fixup salts for principals from a different realm name."
139  	}
140  	argument = "file"
141  	min_args = "1"
142  	max_args = "2"
143  	help = "Loads a previously dumped file. Local (-l) mode only."
144  }
145  command = {
146  	name = "merge"
147  	option = {
148  		long = "fix-salts"
149  		type = "flag"
150  		help = "Fixup salts for principals from a different realm name."
151  	}
152  	argument = "file"
153  	min_args = "1"
154  	max_args = "2"
155  	help = "Merges the contents of a dump file into the database. Local (-l) mode only."
156  }
157  command = {
158  	name = "add"
159  	name = "ank"
160  	name = "add_new_key"
161  	function = "add_new_key"
162  	option = {
163  		long = "random-key"
164  		short = "r"
165  		type = "flag"
166  		help = "set random key"
167  	}
168  	option = {
169  		long = "random-password"
170  		type = "flag"
171  		help = "set random password"
172  	}
173  	option = {
174  		long = "password"
175  		short = "p"
176  		type = "string"
177  		help = "principal's password"
178  	}
179  	option = {
180  		long = "key"
181  		type = "string"
182  		help = "DES-key in hex"
183  	}
184  	option = {
185  		long = "max-ticket-life"
186  		type = "string"
187  		argument ="lifetime"
188  		help = "max ticket lifetime"
189  	}
190  	option = {
191  		long = "max-renewable-life"
192  		type = "string"
193  		argument = "lifetime"
194  		help = "max renewable life"
195  	}
196  	option = {
197  		long = "attributes"
198  		type = "string"
199  		argument = "attributes"
200  		help = "principal attributes"
201  	}
202  	option = {
203  		long = "expiration-time"
204  		type = "string"
205  		argument = "time"
206  		help = "principal expiration time"
207  	}
208  	option = {
209  		long = "pw-expiration-time"
210  		type = "string"
211  		argument = "time"
212  		help = "password expiration time"
213  	}
214  	option = {
215  		long = "hist-kvno-diff-clnt"
216  		type = "integer"
217  		argument = "kvno diff"
218  		help = "historic keys allowed for client"
219  		default = "-1"
220  	}
221  	option = {
222  		long = "hist-kvno-diff-svc"
223  		type = "integer"
224  		argument = "kvno diff"
225  		help = "historic keys allowed for service"
226  		default = "-1"
227  	}
228  	option = {
229  		long = "use-defaults"
230  		type = "flag"
231  		help = "use default values"
232  	}
233  	option = {
234  		long = "verbose"
235  		type = "flag"
236  		help = "verbose output"
237  	}
238  	option = {
239  		long = "policy"
240  		type = "string"
241  		argument = "policy"
242  		help = "policy name"
243  	}
244  	argument = "principal..."
245  	min_args = "1"
246  	help = "Adds a principal to the database."
247  }
248  command = {
249  	name = "passwd"
250  	name = "cpw"
251  	name = "change_password"
252  	function = "cpw_entry"
253  	option = {
254  		long = "random-key"
255  		short = "r"
256  		type = "flag"
257  		help = "set random key"
258  	}
259  	option = {
260  		long = "random-password"
261  		type = "flag"
262  		help = "set random password"
263  	}
264  	option = {
265  		long = "password"
266  		short = "p"
267  		type = "string"
268  		help = "princial's password"
269  	}
270  	option = {
271  		long = "key"
272  		type = "string"
273  		help = "DES key in hex"
274  	}
275  	option = {
276  		long = "keepold"
277  		type = "flag"
278  		help = "keep old keys/password"
279  	}
280  	argument = "principal..."
281  	min_args = "1"
282  	help = "Changes the password of one or more principals matching the expressions."
283  }
284  command = {
285  	name = "delete"
286  	name = "del"
287  	name = "del_entry"
288  	function = "del_entry"
289  	argument = "principal..."
290  	min_args = "1"
291  	help = "Deletes all principals matching the expressions."
292  }
293  command = {
294  	name = "del_enctype"
295  	argument = "principal enctype..."
296  	min_args = "2"
297  	help = "Delete all the mentioned enctypes for principal."
298  }
299  command = {
300  	name = "add_enctype"
301  	option = {
302  		long = "random-key"
303  		short = "r"
304  		type = "flag"
305  		help = "set random key"
306  	}
307  	argument = "principal enctype..."
308  	min_args = "2"
309  	help = "Add new enctypes for principal."
310  }
311  command = {
312  	name = "ext_keytab"
313  	option = {
314  		long = "keytab"
315  		short = "k"
316  		type = "string"
317  		help = "keytab to use"
318  	}
319  	argument = "principal..."
320  	min_args = "1"
321  	help = "Extracts the keys of all principals matching the expressions, and stores them in a keytab." 
322  }
323  command = {
324  	name = "get"
325  	name = "get_entry"
326  	function = "get_entry"
327  	/* XXX sync options with "list" */
328  	option = {
329  		long = "long"
330  		short = "l"
331  		type = "flag"
332  		help = "long format"
333  		default = "-1"
334  	}
335  	option = {
336  		long = "short"
337  		short = "s"
338  		type = "flag"
339  		help = "short format"
340  	}
341  	option = {
342  		long = "terse"
343  		short = "t"
344  		type = "flag"
345  		help = "terse format"
346  	}
347  	option = {
348  		long = "column-info"
349  		short = "o"
350  		type = "string"
351  		help = "columns to print for short output"
352  	}
353  	argument = "principal..."
354  	min_args = "1"
355  	help = "Shows information about principals matching the expressions."
356  }
357  command = {
358  	name = "rename"
359  	function = "rename_entry"
360  	argument = "from to"
361  	min_args = "2"
362  	max_args = "2"
363  	help = "Renames a principal."
364  }
365  command = {
366  	name = "modify"
367  	function = "mod_entry"
368  	option = {
369  		long = "max-ticket-life"
370  		type = "string"
371  		argument ="lifetime"
372  		help = "max ticket lifetime"
373  	}
374  	option = {
375  		long = "max-renewable-life"
376  		type = "string"
377  		argument = "lifetime"
378  		help = "max renewable life"
379  	}
380  	option = {
381  		long = "attributes"
382  		short = "a"
383  		type = "string"
384  		argument = "attributes"
385  		help = "principal attributes"
386  	}
387  	option = {
388  		long = "expiration-time"
389  		type = "string"
390  		argument = "time"
391  		help = "principal expiration time"
392  	}
393  	option = {
394  		long = "pw-expiration-time"
395  		type = "string"
396  		argument = "time"
397  		help = "password expiration time"
398  	}
399  	option = {
400  		long = "kvno"
401  		type = "integer"
402  		help = "key version number"
403  		default = "-1"
404  	}
405  	option = {
406  		long = "constrained-delegation"
407  		type = "strings"
408  		argument = "principal"
409  		help = "allowed target principals"
410  	}
411  	option = {
412  		long = "alias"
413  		type = "strings"
414  		argument = "principal"
415  		help = "aliases"
416  	}
417  	option = {
418  		long = "pkinit-acl"
419  		type = "strings"
420  		argument = "subject dn"
421  		help = "aliases"
422  	}
423  	option = {
424  		long = "policy"
425  		type = "string"
426  		argument = "policy"
427  		help = "policy name"
428  	}
429  	option = {
430  		long = "hist-kvno-diff-clnt"
431  		type = "integer"
432  		argument = "kvno diff"
433  		help = "historic keys allowed for client"
434  		default = "-1"
435  	}
436  	option = {
437  		long = "hist-kvno-diff-svc"
438  		type = "integer"
439  		argument = "kvno diff"
440  		help = "historic keys allowed for service"
441  		default = "-1"
442  	}
443  	argument = "principal"
444  	min_args = "1"
445  	max_args = "1"
446  	help = "Modifies some attributes of the specified principal."
447  }
448  command = {
449  	name = "privileges"
450  	name = "privs"
451  	function = "get_privs"
452  	help = "Shows which operations you are allowed to perform."
453  }
454  command = {
455  	name = "list"
456  	function = "list_princs"
457  	/* XXX sync options with "get" */
458  	option = {
459  		long = "long"
460  		short = "l"
461  		type = "flag"
462  		help = "long format"
463  	}
464  	option = {
465  		long = "short"
466  		short = "s"
467  		type = "flag"
468  		help = "short format"
469  	}
470  	option = {
471  		long = "terse"
472  		short = "t"
473  		type = "flag"
474  		help = "terse format"
475  		default = "-1"
476  	}
477  	option = {
478  		long = "column-info"
479  		short = "o"
480  		type = "string"
481  		help = "columns to print for short output"
482  	}
483  	argument = "principal..."
484  	min_args = "1"
485  	help = "Lists principals in a terse format. Equivalent to \"get -t\"." 
486  }
487  command = {
488  	name = "verify-password-quality"
489  	name = "pwq"
490  	function = "password_quality"
491  	argument = "principal password"
492  	min_args = "2"
493  	max_args = "2"
494  	help = "Try run the password quality function locally (not doing RPC out to server)."
495  }
496  command = {
497  	name = "check"
498  	function = "check"
499  	option = {
500  		long = "ds-local"
501  		type = "flag"
502  		help = "Only perform local checks."
503  	}
504  	argument = "[realm]"
505  	min_args = "0"
506  	max_args = "1"
507  	help = "Check the realm (if not given, the default realm) for configuration errors."
508  }
509  command = {
510  	name = "lock"
511  	function = "lock"
512  	argument = ""
513  	min_args = "0"
514  	max_args = "0"
515  	help = "Lock the database for writing (use with care)."
516  }
517  command = {
518  	name = "unlock"
519  	function = "unlock"
520  	argument = ""
521  	min_args = "0"
522  	max_args = "0"
523  	help = "Unlock the database."
524  }
525  command = {
526  	name = "help"
527  	name = "?"
528  	argument = "[command]"
529  	min_args = "0"
530  	max_args = "1"
531  	help = "Help! I need somebody."
532  }
533  command = {
534  	name = "exit"
535  	name = "quit"
536  	function = "exit_kadmin"
537  	help = "Quits."
538  }