Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How do you forcefully change a user's Kerberos password in Fedora? The only docs I could find mention kpasswd <username>, but this requires the user's current password, which the admin probably won't know. I found some BSD docs that use k5admin -l, but this doesn't appear to be available in Fedora.

share|improve this question
up vote 2 down vote accepted

You want kadmin.
Not quite sure where Fedora installs it. (Centos /usr/kerberos/sbin/kadmin)

You can use kadmin interactively or with a preset query.

$ kadmin
Authenticating as principal self/admin@DOMAIN.TLD with password.
Password for self/admin@DOMAIN.TLD: 
kadmin:  cpw
usage: change_password [-randkey] [-keepold] [-e keysaltlist] [-pw password] principal

kadmin -q "change_password -pw <newpassword> <username>"

Note: If using the MIT libraries, which I believe Fedora does, you will have to set the admin_server in the [realms] section of /etc/krb5.conf. (Your master server must also be running kadmind (the kadmin service).

[realms]
DOMAIN.TLD = {
    admin_server = krb5kdc-master.domain.tld
}
share|improve this answer
    
Thanks. I had to modify /var/kerberos/krb5kdc/kadm5.acl to give my user full admin rights, and then restart the krb5kdc and kadmin services, but otherwise kadmin change_password worked. – Cerin Jul 18 '12 at 18:46
    
I had to make an slight modification to make work the non interactive version of the command: kadmin -l cpw -p newpassword username – alfredocambera Mar 24 at 15:28
    
@alfredocambera Sounds like you are using heimdal rather than (mit-)krb5. – 84104 Mar 24 at 17:20
    
@84104 indeed. I'm pretty new to kerberos and it took me a while to find the correct command. Nevertheless this helped me a lot. Is mit's version better than heimdal's? I'd appreciate your opinion on this. – alfredocambera Mar 24 at 21:45

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.