KTUTIL(1) MIT Kerberos KTUTIL(1)

# [NAME](#NAME)

ktutil - Kerberos keytab file maintenance utility

# [SYNOPSIS](#SYNOPSIS)

**ktutil**

# [DESCRIPTION](#DESCRIPTION)

The ktutil command invokes a command interface from which an administrator can read, write, or edit entries in a keytab. (Kerberos V4 srvtab files are no longer supported.)

# [COMMANDS](#COMMANDS)

## [list](#list)

**list** \[**-t**] \[**-k**] \[**-e**]

Displays the current keylist. If **-t**, **-k**, and/or **-e** are specified, also display the timestamp, key contents, or enctype (respectively).

Alias: **l**

## [read\_kt](#read_kt)

**read\_kt** *keytab*

Read the Kerberos V5 keytab file *keytab* into the current keylist.

Alias: **rkt**

## [write\_kt](#write_kt)

**write\_kt** *keytab*

Write the current keylist into the Kerberos V5 keytab file *keytab*.

Alias: **wkt**

## [clear\_list](#clear_list)

**clear\_list**

Clear the current keylist.

Alias: **clear**

## [delete\_entry](#delete_entry)

**delete\_entry** *slot*

Delete the entry in slot number *slot* from the current keylist.

Alias: **delent**

## [add\_entry](#add_entry)

**add\_entry** {**-key**|**-password**} **-p** *principal* **-k** *kvno* \[**-e** *enctype*] \[**-f**|**-s** *salt*]

Add *principal* to keylist using key or password. If the **-f** flag is specified, salt information will be fetched from the KDC; in this case the **-e** flag may be omitted, or it may be supplied to force a particular enctype. If the **-f** flag is not specified, the **-e** flag must be specified, and the default salt will be used unless overridden with the **-s** option.

Alias: **addent**

## [list\_requests](#list_requests)

**list\_requests**

Displays a listing of available commands.

Aliases: **lr**, **?**

## [quit](#quit)

**quit**

Quits ktutil.

Aliases: **exit**, **q**

# [EXAMPLE](#EXAMPLE)

```
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e


    aes128-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e


    aes256-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  write_kt alice.keytab
ktutil:
```

# [ENVIRONMENT](#ENVIRONMENT)

See *kerberos* for a description of Kerberos environment variables.

# [SEE ALSO](#SEE_ALSO)

*kadmin*, *kdb5\_util*, *kerberos*

# [AUTHOR](#AUTHOR)

MIT

# [COPYRIGHT](#COPYRIGHT)

1985-2026, MIT

1.22.2

---

Document: ktutil(1) from krb5 1.22.2-r5 (Chainguard OS)
Source: https://github.com/krb5/krb5.git