Master key migration and the stash command

Russ Allbery rra at
Wed Jan 28 14:10:50 EST 2009

ghudson at MIT.EDU writes:

> Currently, "kdb5_util stash" does the following:
>   1. Open the database (or fail out)
>   2. (If there is an existing stash file, read in the master key and
>      forget about it; this is odd but unimportant)
>   3. Prompt for the master key
>   4. Verify the entered key against the database (or fail out)
>   5. Write out the stash file
> There are two issues here.  First, you can't stash the password before
> creating the database, which complicates the setup of slave DBs.
> Second, part of the master key migration project plan requires a "sync
> the stash" operation to update the stash file with all master keys.
> (

RT #6345 is related and would probably be fixed by the same measures.

Russ Allbery (rra at             <>

More information about the krbdev mailing list