kadmin(8) on Solnix vs Linux and the BSDs
On Solnix, kadmin is the illumos (MIT-style) Kerberos admin client at /usr/sbin/kadmin, with a separate kadmin.local for the master KDC. The most important difference for BSD users is option meaning. On NetBSD (Heimdal-style), -k is the master key file, -c is a config file and local mode is -l. Solnix and FreeBSD use -k for a keytab and -c for a credentials cache.
The manual pages
- Solnix: kadmin(8) from
pkgs.solnix.illumos-world-man· illumos.org - FreeBSD: kadmin(1) 15.1-RELEASE
- NetBSD: kadmin(8) 11.0
What Solnix runs
A default Solnix system runs the illumos kadmin at /usr/sbin/kadmin. The same page also documents /usr/sbin/kadmin.local. No other variants are shipped. The bundle contains no Linux counterpart page, so no Linux claims are made.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| NetBSD | -k and -K meaning | On Solnix, -k means authenticate with a keytab, optionally with -t keytab. On NetBSD, -k file names the master key file and the keytab is -K. A Solnix keytab invocation does not work unchanged on NetBSD.Source: Solnix kadmin(8) -k, -t; NetBSD kadmin(8) -k, -K |
| NetBSD | -c and -s meaning | Solnix -c names a credentials cache and -s names the admin server with an optional :port. NetBSD -c names a config file, -s is a port number only, and the server is chosen with -a.Source: Solnix kadmin(8) -c, -s; NetBSD kadmin(8) -c, -s, -a |
| NetBSD | local mode | Solnix and FreeBSD use a separate kadmin.local program for direct database access. NetBSD documents no kadmin.local; its kadmin runs in local mode with -l or --local.Source: Solnix kadmin(8) SYNOPSIS; FreeBSD kadmin(1) SYNOPSIS; NetBSD kadmin(8) -l |
| NetBSD | running one query | Solnix and FreeBSD take a one-shot query with -q query. NetBSD has no -q in its synopsis; the command is given as the trailing [command] argument.Source: Solnix kadmin(8) -q; FreeBSD kadmin(1) -q; NetBSD kadmin(8) SYNOPSIS |
| FreeBSD | query as trailing arguments | FreeBSD (release 1.14 or later) treats leftover arguments as one script-mode query: no confirmation prompts, and a non-zero exit status if the query fails. -q does not get this behaviour. The Solnix page documents only -q and says nothing about its exit status.Source: FreeBSD kadmin(1) OPTIONS (final paragraphs); Solnix kadmin(8) SYNOPSIS, -q |
| FreeBSD | extra FreeBSD flags | FreeBSD kadmin has -n (anonymous processing), -O (force old AUTH_GSSAPI) and -N (prevent fallback to AUTH_GSSAPI). The Solnix page documents none of these. Solnix has -D (debug, local only), which the FreeBSD page does not.Source: FreeBSD kadmin(1) -n, -O, -N; Solnix kadmin(8) -D |
| FreeBSD | -x placement | On Solnix, -x db_args is in the kadmin synopsis (LDAP and Berkeley-db2 arguments listed) but not in kadmin.local. On FreeBSD it is the reverse: -x is in the kadmin.local synopsis only.Source: Solnix kadmin(8) SYNOPSIS, -x; FreeBSD kadmin(1) SYNOPSIS, -x |
| FreeBSD | admin service principal | Solnix kadmin authenticates to the service kadmin/fqdn. FreeBSD names kadmin/admin or kadmin/ADMINHOST, where ADMINHOST is the admin server's fully-qualified hostname. Source: Solnix kadmin(8) DESCRIPTION; FreeBSD kadmin(1) DESCRIPTION |
| FreeBSD | where kadmin.local may run | Solnix says kadmin.local runs only on the master KDC, with effective UID root, and reads the stash file /var/krb5/.k5.realm. FreeBSD says it usually runs on the primary KDC, or on any host that can reach an LDAP database. FreeBSD names no stash path.Source: Solnix kadmin(8) DESCRIPTION; FreeBSD kadmin(1) DESCRIPTION |
| NetBSD | -m and -w | Solnix -m prompts for the master password instead of using the stash file, and -w supplies a password on the command line. The NetBSD synopsis has neither; it has a -k master key file option and a keytab option (-K).Source: Solnix kadmin(8) -m, -w; NetBSD kadmin(8) SYNOPSIS |
| FreeBSD, NetBSD | environment variables | The Solnix page lists PAGER (default more(1)) as affecting kadmin. FreeBSD only refers to the kerberos page. The NetBSD text in the bundle has no environment section. Source: Solnix kadmin(8) ENVIRONMENT VARIABLES; FreeBSD kadmin(1) ENVIRONMENT |
| NetBSD | subcommand documentation | The NetBSD page lists its subcommands (add, modify, get, passwd, dump, load and others) with Heimdal-style long options. The Solnix text in the bundle does not describe subcommands, so their syntax is not comparable from these pages. Source: NetBSD kadmin(8) Commands include; Solnix kadmin(8) DESCRIPTION |
Everyday tasks
| Task | Solnix | FreeBSD | NetBSD |
|---|---|---|---|
| administer the database directly on the KDC | kadmin.local | kadmin.local | kadmin -l |
| run one query and exit | kadmin -q query | kadmin -q query, or kadmin command args | kadmin command |
| authenticate with a keytab | kadmin -k -t keytab | kadmin -k -t keytab | kadmin -K keytab |
Standards
- POSIX: kadmin is not a POSIX.1-2024 utility.
- Solnix: Interface Stability: Committed.
Writing portable scripts
- Do not share kadmin option strings between Solnix and NetBSD:
-k,-cand-smean different things. Branch on the platform, or use the NetBSD long options. - Avoid
-wpassword in scripts. The Solnix page warns that the password may be readable through ps(1), and FreeBSD gives the same warning. Prefer a keytab.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.