Re: Re-encrypt on change of master key
"Henry B (Hank) Hotz, CISSP" <[email protected]>
| Newsgroups | gmane.comp.encryption.kerberos.heimdal.general |
|---|---|
| Message-ID | <[email protected]> |
https://www.mail-archive.com/[email protected]/msg00334.html There’s also a long, historically-interesting, thread on migrating from MIT that includes an example. > On Mar 14, 2017, at 11:51 AM, Henry B (Hank) Hotz, CISSP <[email protected]> wrote: > >> On Mar 14, 2017, at 9:43 AM, Adam Lewenberg <[email protected]> wrote: >> >> How do I re-encrypt the entries of the Heimdal KDC database if I want to change its master key? > > Shut down all daemons on the master. > > hprop --decrypt --stdout | hpropd --stdin > > Restart all daemons. > > That’s from memory. I think some other options may be needed, like keytab files. I published this once in a presentation at one of the AFS&Kerb best practices workshops, but I don’t remember the year. > > Personal email. [email protected] Personal email. [email protected]