kadmind(8) on Solnix vs Linux and the BSDs
On Solnix, kadmind is the illumos Kerberos administration daemon at /usr/lib/krb5/kadmind, not on PATH, and it is managed by SMF. Its options differ from both counterparts: -d keeps it in the foreground, -p is the port, and the config lives under /etc/krb5.
The manual pages
- Solnix: kadmind(8) from
pkgs.solnix.illumos-world-man· illumos.org - FreeBSD: kadmind(8) 15.1-RELEASE
- NetBSD: kadmind(8) 11.0
What Solnix runs
A default Solnix system runs the illumos kadmind at /usr/lib/krb5/kadmind. No other variants are shipped. It is managed by SMF as svc:/network/security/kadmin. Use svcadm(8) to act on the service and svcs(1) to query it. The bundle has no Linux counterpart page.
Differences
| Compared with | Topic | What differs |
|---|---|---|
| FreeBSD | stay in foreground | Solnix uses -d to keep kadmind in the foreground and attached to the terminal. FreeBSD uses -nofork for this. FreeBSD documents no -d option.Source: Solnix kadmind(8) -d; FreeBSD kadmind(8) -nofork |
| NetBSD | -d meaning | On Solnix, -d means do not background. On NetBSD, -d (--debug) makes kadmind accept exactly one connection for debugging. A script using -d to stay in the foreground gets a different effect on NetBSD.Source: Solnix kadmind(8) -d; NetBSD kadmind(8) DESCRIPTION, -d, --debug |
| FreeBSD, NetBSD | -p meaning | Solnix -p sets the listening port. On FreeBSD, -p is the path to kdb5_util and the port option is -port. On NetBSD, -p (--ports) takes a whitespace-separated port list, and the default port is 749.Source: Solnix kadmind(8) -p; FreeBSD kadmind(8) -p, -port; NetBSD kadmind(8) -p, --ports |
| FreeBSD, NetBSD | -k meaning | Solnix kadmind has no -k. On FreeBSD, -k sets the kprop port used for full resync. On NetBSD, -k (--key-file) names the master key file.Source: Solnix kadmind(8) SYNOPSIS; FreeBSD kadmind(8) -k; NetBSD kadmind(8) -k, --key-file |
| NetBSD | implementation and option set | NetBSD kadmind has long options (--config-file, --key-file, --keytab, --realm, --debug, --ports) and no -m or -x. Solnix and FreeBSD accept -m and -x db_args. Only -r realm is shared by all three.Source: NetBSD kadmind(8) SYNOPSIS, options; Solnix kadmind(8) OPTIONS; FreeBSD kadmind(8) OPTIONS |
| FreeBSD, NetBSD | ACL and config file locations | Solnix reads /etc/krb5/kdc.conf, /etc/krb5/kadm5.keytab and /etc/krb5/kadm5.acl. FreeBSD's default ACL path is @LOCALSTATEDIR@/krb5kdc/kadm5.acl. NetBSD uses /var/heimdal/kadmind.acl, with a different rights syntax.Source: Solnix kadmind(8) DESCRIPTION; FreeBSD kadmind(8) kadm5.acl; NetBSD kadmind(8) DESCRIPTION |
| FreeBSD, NetBSD | service management and reload | On Solnix, restart the SMF service to reread kadm5.acl: svcadm restart svc:/network/security/kadmin:default. The FreeBSD page mentions init scripts and a -P pid file. NetBSD describes inetd(8) startup when stdin is a socket.Source: Solnix kadmind(8) kadm5.acl, NOTES; FreeBSD kadmind(8) -P; NetBSD kadmind(8) DESCRIPTION |
| FreeBSD | incremental propagation settings | Solnix enables it with sunw_dbprop_enable (default false) and sets log size with sunw_dbprop_master_ulogsize (default 1000, maximum 2500). FreeBSD uses iprop_enable in kdc.conf. Solnix requires kiprop/<hostname>@<REALM> in kadm5.keytab. FreeBSD says release 1.13 creates it automatically. Source: Solnix kadmind(8) sunw_dbprop_enable, sunw_dbprop_master_ulogsize; FreeBSD kadmind(8) DESCRIPTION (iprop_enable, kiprop) |
| FreeBSD | propagation-only and resync options | FreeBSD has -proponly, -K, -F and -P for propagation and PID handling. The Solnix page documents none of them.Source: FreeBSD kadmind(8) -proponly, -K, -F, -P; Solnix kadmind(8) OPTIONS |
| FreeBSD | socket activation | FreeBSD kadmind supports systemd-style socket activation via LISTEN_PID and LISTEN_FDS as of release 1.22. The Solnix page documents no environment variables for this. Source: FreeBSD kadmind(8) ENVIRONMENT; Solnix kadmind(8) (no ENVIRONMENT section) |
| FreeBSD, NetBSD | password migration via PAM | On Solnix, the u privilege in kadm5.acl makes kadmind validate passwords through PAM service k5migrate, for pam_krb5_migrate. The FreeBSD and NetBSD pages do not describe this. Source: Solnix kadmind(8) DESCRIPTION (k5migrate); FreeBSD kadmind(8); NetBSD kadmind(8) |
Standards
- POSIX: kadmind is not a POSIX.1-2024 utility.
- Solnix: Interface Stability: Evolving. kadmind complies with the change-password standard in RFC 3244.
Writing portable scripts
- Do not script kadmind flags across systems:
-d,-pand-kmean different things on Solnix, FreeBSD and NetBSD. Use the service manager or the platform's own start script. - Locate the ACL and keytab per platform. Solnix uses
/etc/krb5/kadm5.acl, and NetBSD uses/var/heimdal/kadmind.acl.
Every difference here is taken from the manual pages linked above: Solnix's published page, Linux (man-pages and the GNU and util-linux manuals), FreeBSD, OpenBSD and NetBSD. Each row names its source. Where a manual is silent, this page is too. Compiled 2026-10-26. Found a mistake? Mail hackers@lists.solnix.io.