Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

How do you forcefully change a user's Kerberos password in Fedora? The only docs I could find mention kpasswd <username>, but this requires the user's current password, which the admin probably won't know. I found some BSD docs that use k5admin -l, but this doesn't appear to be available in Fedora.

share|improve this question
add comment

1 Answer

up vote 0 down vote accepted

You want kadmin.
Not quite sure where Fedora installs it. (Centos /usr/kerberos/sbin/kadmin)

You can use kadmin interactively or with a preset query.

$ kadmin
Authenticating as principal self/admin@DOMAIN.TLD with password.
Password for self/admin@DOMAIN.TLD: 
kadmin:  cpw
usage: change_password [-randkey] [-keepold] [-e keysaltlist] [-pw password] principal

kadmin -q "change_password -pw <newpassword> <username>"

Note: If using the MIT libraries, which I believe Fedora does, you will have to set the admin_server in the [realms] section of /etc/krb5.conf. (Your master server must also be running kadmind (the kadmin service).

[realms]
DOMAIN.TLD = {
    admin_server = krb5kdc-master.domain.tld
}
share|improve this answer
    
Thanks. I had to modify /var/kerberos/krb5kdc/kadm5.acl to give my user full admin rights, and then restart the krb5kdc and kadmin services, but otherwise kadmin change_password worked. –  Cerin Jul 18 '12 at 18:46
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.