Node:Dumping a Kerberos Database to a File, Next:, Previous:Global Operations on the Kerberos Database, Up:Global Operations on the Kerberos Database



Dumping a Kerberos Database to a File

To dump a Kerberos database into a file, use the kdb5_util dump command on one of the KDCs. The syntax is:

     kdb5_util dump [-old] [-b6] [-b7] [-ov]
     [-verbose] [-mkey_convert] [-new_mkey_file] [filename
     [principals...]]
     

The kdb5_util dump command takes the following options:

-old
causes the dump to be in the Kerberos 5 Beta 5 and earlier dump format ("kdb5_edit load_dump version 2.0").
-b6
causes the dump to be in the Kerberos 5 Beta 6 format ("kdb5_edit load_dump version 3.0").
-b7
causes the dump to be in the Kerberos 5 Beta 7 format ("kdbt_edit load_dump version 4").
-ov
causes the dump to be in ovsec_adm_export format. Currently, the only way to preserve per-principal policy information is to use this in conjunction with a normal dump.
-verbose
causes the name of each principal and policy to be printed as it is dumped.
-mkey_convert
prompts for a new master password, and then dumps the database with all keys reencrypted in this new master key
-new_mkey_file
reads a new key from the default keytab and then dumps the database with all keys reencrypted in this new master key

For example:

     shell% kdb5_util dump dumpfile
     shell%
     
     shell% kbd5_util dump -verbose dumpfile
     kadmin/admin@ATHENA.MIT.EDU
     krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU
     kadmin/history@ATHENA.MIT.EDU
     K/M@ATHENA.MIT.EDU
     kadmin/changepw@ATHENA.MIT.EDU
     shell%
     

If you specify which principals to dump, you must use the full principal, as in the following example. (The line beginning with => is a continuation of the previous line.):

     shell% kdb5_util dump -verbose dumpfile K/M@ATHENA.MIT.EDU
     => kadmin/admin@ATHENA.MIT.EDU
     kadmin/admin@ATHENA.MIT.EDU
     K/M@ATHENA.MIT.EDU
     shell%
     

Otherwise, the principals will not match those in the database and will not be dumped:

     shell% kdb5_util dump -verbose dumpfile K/M kadmin/admin
     shell%
     

If you do not specify a dump file, kdb5_util will dump the database to the standard output.

There is currently a bug where the default dump format omits the per-principal policy information. In order to dump all the data contained in the Kerberos database, you must perform a normal dump (with no option flags) and an additional dump using the "-ov" flag to a different file.