Changing Kerberos passwords

i5/OS^® PASE does not support a password server. To change a password for a principal stored on the Kerberos server, enter the PASE environment (call QP2TERM) and issue the kpasswd command.

During network authentication service configuration, you can specify that name of the password server. If one has not been specified during configuration, you can add a password server.

You may not change the password for a ticket-granting service principal (krbtgt/realm) using the kpasswd command.

• To change the password for the default principal:

  • On a Qshell command line, enter kpasswd

  • On a command line, enter call qsys/qkrbkpsswd

• To change the password for another principal:

  • On a Qshell command line, enter kpasswd jday@myco.com

• To change the password for another principal in i5/OS PASE:

  Using a character-based interface

  1. In a character-based interface, enter call QP2TERM. This command opens an interactive shell environment that allows you to work with i5/OS PASE applications.

  2. At the command line, enter export PATH=$PATH:/usr/krb5/sbin. This command points to the Kerberos scripts that are necessary to run the executable files.

  3. At the QSH prompt, enter kadmin -p admin/admin. Press Enter.

  4. Sign in with your administrator's username and password.

  5. Enter kpasswd jday@myco.com. You will be prompted to change the password for this principal.

  Using a command line

  1. On an command line, enter call qsys/qkrbkpsswd parm ('jday@myco.com')

For more details on the use of this command, see the passwd usage notes.

• kpasswd
  The Qshell command kpasswd changes a password for a Kerberos principal.

 

Parent topic:

Managing network authentication service