[\fB\-e\fP \fIkeysalts\fP]
.SH DESCRIPTION
.sp
-k5srvutil allows an administrator to list or change keys currently in
-a keytab or to add new keys to the keytab.
+k5srvutil allows an administrator to list keys currently in
+a keytab, to obtain new keys for a principal currently in a keytab,
+or to delete non\-current keys from a keytab.
.sp
\fIoperation\fP must be one of the following:
.INDENT 0.0
.TP
.B \fBlist\fP
-Lists the keys in a keytab showing version number and principal
+Lists the keys in a keytab, showing version number and principal
name.
.TP
.B \fBchange\fP
database to new randomly\-generated keys, and updates the keys in
the keytab to match. If a key\(aqs version number doesn\(aqt match the
version number stored in the Kerberos server\(aqs database, then the
-operation will fail. Old keys are retained in the keytab so that
-existing tickets continue to work. If the \fB\-i\fP flag is given,
-k5srvutil will prompt for confirmation before changing each key.
-If the \fB\-k\fP option is given, the old and new keys will be
-displayed. Ordinarily, keys will be generated with the default
-encryption types and key salts. This can be overridden with the
-\fB\-e\fP option.
+operation will fail. If the \fB\-i\fP flag is given, k5srvutil will
+prompt for confirmation before changing each key. If the \fB\-k\fP
+option is given, the old and new keys will be displayed.
+Ordinarily, keys will be generated with the default encryption
+types and key salts. This can be overridden with the \fB\-e\fP
+option. Old keys are retained in the keytab so that existing
+tickets continue to work, but \fBdelold\fP should be used after
+such tickets expire, to prevent attacks against the old keys.
.TP
.B \fBdelold\fP
Deletes keys that are not the most recent version from the keytab.
.SH AUTHOR
MIT
.SH COPYRIGHT
-1985-2016, MIT
+1985-2017, MIT
.\" Generated by docutils manpage writer.
.
.SH DESCRIPTION
.sp
kinit obtains and caches an initial ticket\-granting ticket for
-\fIprincipal\fP\&.
+\fIprincipal\fP\&. If \fIprincipal\fP is absent, kinit chooses an appropriate
+principal name based on existing credential cache contents or the
+local username of the user invoking kinit. Some options modify the
+choice of principal name.
.SH OPTIONS
.INDENT 0.0
.TP
.SH AUTHOR
MIT
.SH COPYRIGHT
-1985-2016, MIT
+1985-2017, MIT
.\" Generated by docutils manpage writer.
.