Master key migration and the stash command

[Russ Allbery]

ghudson at MIT.EDU writes:

> Currently, "kdb5_util stash" does the following:
>
>   1. Open the database (or fail out)
>   2. (If there is an existing stash file, read in the master key and
>      forget about it; this is odd but unimportant)
>   3. Prompt for the master key
>   4. Verify the entered key against the database (or fail out)
>   5. Write out the stash file
>
> There are two issues here.  First, you can't stash the password before
> creating the database, which complicates the setup of slave DBs.
> Second, part of the master key migration project plan requires a "sync
> the stash" operation to update the stash file with all master keys.
> (http://k5wiki.kerberos.org/wiki/Projects/Master_Key_Migration)

RT #6345 is related and would probably be fixed by the same measures.

-- 
Russ Allbery (rra at stanford.edu)             <http://www.eyrie.org/~eagle/>