addprinc -randkey broken in 1.7?

Mike Friedman mikef at
Wed Sep 16 18:39:37 EDT 2009

Hash: SHA1

On Wed, 16 Sep 2009 at 13:13 (-0700), Russ Allbery wrote:

> "Leonard J. Peirce" <leonard.peirce at> writes:
>> When running (in kadmin)
>>   addprinc -randkey host/host.domain
>> I get a complaint about the password not containing enough character 
>> classes.  Did I miss something?  Not really a big deal since I can just 
>> specify a password.
>> It used to work in 1.6.
> addprinc -randkey hasn't worked for principals that have a password 
> policy set for somet time for me.  The way -randkey works under the hood 
> is that it adds the principal disabled with a fixed password (which is 
> indeed pretty bad except that it's very long), then randomizes the key, 
> and then enables the principal.


I'm running 1.6.3 and don't have this problem.  In fact, looking at the 
code in src/kadmin/cli/kadmin.c, it appears that when '-randkey' is used 
for addprinc, the password is set initially to a 256 character string 
containing all possible character values from 1 thru 255 plus a 
terminating 0 (and then randomized in a separate step).  This, I would 
think, should satisfy any password policy.

OK, so maybe I'm misinterpreting the code.  But the fact is that I add 
host principals with -randkey all the time with no problem.  I've been 
doing this for several releases up to and including our current 1.6.3. 
We may go to 1.7 soon, so possibly something's changed there, but in the 
meantime, could someone clarify all this?


Mike Friedman                        Information Services & Technology
mikef at                   2484 Shattuck Avenue
1-510-642-1410                       University of California at Berkeley  
Version: GnuPG v1.4.9 (FreeBSD)


More information about the Kerberos mailing list