Red Hat Enterprise Linux 5 Administration Unleashed

282CHAPTER 12Identity ManagementTABLE 12.1 ContinuedRestriction FlagsDescription-allow_proxiableDo not allow the principal to retrieve proxiable tickets.+allow_proxiable clears this preference.-allow_dup_skeyDo not allow user-to-user authentication for the principalby not allowing the principal to retrieve a session key fromanother user. +allow_dup_skey clears this preference.+requires_preauthPrincipal must preauthenticate before calling kinit.-requires_preauth clears this preference.+requires_hwauthPrincipal must preauthenticate using a hardware devicebefore calling kinit. -requires_hwauth clears this preference.-allow_svrDo not allow the principal to issue service tickets.+allow_svr clears this preference.-allow_tgs_reqDo not allow the principal to request a service ticket froma TGS. +allow_tgs_req clears this preference.-allow-tixDo not allow the principal to issue any tickets. +allowtixclears this preference.+needchangeForce a password for the principal. -needchange clearsthe preference.+password_changing_service Marks the principal as a password change service principal.-password_changing_service clears the preference.-randkeySet the key of the principal to a random value.-pw Set the key of the principal to and do notprompt for a password.-e Use the as : pairs to setthe key of the principal.To modify a principal, use the following command inside the kadmin or kadmin.localshell (the same options from Table 12.1 can be used):modify_principal To delete a principal, use the following command inside the kadmin or kadmin.local shell:delete_principal You must confirm the deletion unless the -force option is specified before the name ofthe principal.Setting Access Control Lists for KerberosThe Kerberos ACL file kadm5.acl is located in the /var/kerberos/krb5kdc/ directory. Atleast one Kerberos administrator must be added to this access control file, and all principalslisted must exist in the database. The order of the access control lines matters. Thefirst match takes precedence. Each line in the file uses the following format: