---
name: "ktutil"
section: "1"
platform: "linux"
package: "krb5"
version: "1.22.2-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux", "freebsd"]
url: "https://new.carta.tech/ktutil"
---

# ktutil(1)

Kerberos keytab file maintenance utility

## NAME

ktutil - Kerberos keytab file maintenance utility

## SYNOPSIS

**ktutil**

## DESCRIPTION

The ktutil command invokes a command interface from which an administrator can read, write, or edit entries in a keytab.  (Kerberos V4 srvtab files are no longer supported.)

## COMMANDS

### list

**list** \[**-t**\] \[**-k**\] \[**-e**\]

Displays the current keylist.  If **-t**, **-k**, and/or **-e** are specified, also display the timestamp, key contents, or enctype (respectively).

Alias: **l**

### read\_kt

**read\_kt** *keytab*

Read the Kerberos V5 keytab file *keytab* into the current keylist.

Alias: **rkt**

### write\_kt

**write\_kt** *keytab*

Write the current keylist into the Kerberos V5 keytab file *keytab*.

Alias: **wkt**

### clear\_list

**clear\_list**

Clear the current keylist.

Alias: **clear**

### delete\_entry

**delete\_entry** *slot*

Delete the entry in slot number *slot* from the current keylist.

Alias: **delent**

### add\_entry

**add\_entry** {**-key**\|**-password**} **-p** *principal* **-k** *kvno* \[**-e** *enctype*\] \[**-f**\|**-s** *salt*\]

Add *principal* to keylist using key or password.  If the **-f** flag is specified, salt information will be fetched from the KDC; in this case the **-e** flag may be omitted, or it may be supplied to force a particular enctype.  If the **-f** flag is not specified, the **-e** flag must be specified, and the default salt will be used unless overridden with the **-s** option.

Alias: **addent**

### list\_requests

**list\_requests**

Displays a listing of available commands.

Aliases: **lr**, **?**

### quit

**quit**

Quits ktutil.

Aliases: **exit**, **q**

## EXAMPLE

```
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes128-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  add_entry -password -p alice@BLEEP.COM -k 1 -e
    aes256-cts-hmac-sha1-96
Password for alice@BLEEP.COM:
ktutil:  write_kt alice.keytab
ktutil:
```

## ENVIRONMENT

See *kerberos* for a description of Kerberos environment variables.

## SEE ALSO

*kadmin*, *kdb5\_util*, *kerberos*

## AUTHOR

MIT

## COPYRIGHT

1985-2026, MIT