| blob | 559eeda0a5c93e31c751a2e6f59a7eea1c36f5bd |
1 .\" Copyright (c) 1998 - 2003 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id$
33 .\"
34 .Dd May 29, 1998
35 .Dt KINIT 1
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm kinit
39 .Nm kauth
40 .Nd acquire initial tickets
41 .Sh SYNOPSIS
42 .Nm kinit
43 .Op Fl 4 | Fl -524init
44 .Op Fl 9 | Fl -524convert
45 .Op Fl -afslog
46 .Oo Fl c Ar cachename \*(Ba Xo
47 .Fl -cache= Ns Ar cachename
48 .Xc
49 .Oc
50 .Op Fl f | Fl -forwardable
51 .Oo Fl t Ar keytabname \*(Ba Xo
52 .Fl -keytab= Ns Ar keytabname
53 .Xc
54 .Oc
55 .Oo Fl l Ar time \*(Ba Xo
56 .Fl -lifetime= Ns Ar time
57 .Xc
58 .Oc
59 .Op Fl p | Fl -proxiable
60 .Op Fl R | Fl -renew
61 .Op Fl -renewable
62 .Oo Fl r Ar time \*(Ba Xo
63 .Fl -renewable-life= Ns Ar time
64 .Xc
65 .Oc
66 .Oo Fl S Ar principal \*(Ba Xo
67 .Fl -server= Ns Ar principal
68 .Xc
69 .Oc
70 .Oo Fl s Ar time \*(Ba Xo
71 .Fl -start-time= Ns Ar time
72 .Xc
73 .Oc
74 .Op Fl k | Fl -use-keytab
75 .Op Fl v | Fl -validate
76 .Oo Fl e Ar enctypes \*(Ba Xo
77 .Fl -enctypes= Ns Ar enctypes
78 .Xc
79 .Oc
80 .Oo Fl a Ar addresses \*(Ba Xo
81 .Fl -extra-addresses= Ns Ar addresses
82 .Xc
83 .Oc
84 .Op Fl -fcache-version= Ns Ar integer
85 .Op Fl A | Fl -no-addresses
86 .Op Fl -anonymous
87 .Op Fl -version
88 .Op Fl -help
89 .Op Ar principal Op Ar command
90 .Sh DESCRIPTION
91 .Nm
92 is used to authenticate to the Kerberos server as
93 .Ar principal ,
94 or if none is given, a system generated default (typically your login
95 name at the default realm), and acquire a ticket granting ticket that
96 can later be used to obtain tickets for other services.
97 .Pp
98 If you have compiled
99 .Nm kinit
100 with Kerberos 4 support and you have a
101 Kerberos 4 server,
102 .Nm
103 will detect this and get you Kerberos 4 tickets.
104 .Pp
105 Supported options:
106 .Bl -tag -width Ds
107 .It Xo
108 .Fl c Ar cachename
109 .Fl -cache= Ns Ar cachename
110 .Xc
111 The credentials cache to put the acquired ticket in, if other than
112 default.
113 .It Xo
114 .Fl f ,
115 .Fl -forwardable
116 .Xc
117 Get ticket that can be forwarded to another host.
118 .It Xo
119 .Fl t Ar keytabname ,
120 .Fl -keytab= Ns Ar keytabname
121 .Xc
122 Don't ask for a password, but instead get the key from the specified
123 keytab.
124 .It Xo
125 .Fl l Ar time ,
126 .Fl -lifetime= Ns Ar time
127 .Xc
128 Specifies the lifetime of the ticket.
129 The argument can either be in seconds, or a more human readable string
130 like
131 .Sq 1h .
132 .It Xo
133 .Fl p ,
134 .Fl -proxiable
135 .Xc
136 Request tickets with the proxiable flag set.
137 .It Xo
138 .Fl R ,
139 .Fl -renew
140 .Xc
141 Try to renew ticket.
142 The ticket must have the
143 .Sq renewable
144 flag set, and must not be expired.
145 .It Fl -renewable
146 The same as
147 .Fl -renewable-life ,
148 with an infinite time.
149 .It Xo
150 .Fl r Ar time ,
151 .Fl -renewable-life= Ns Ar time
152 .Xc
153 The max renewable ticket life.
154 .It Xo
155 .Fl S Ar principal ,
156 .Fl -server= Ns Ar principal
157 .Xc
158 Get a ticket for a service other than krbtgt/LOCAL.REALM.
159 .It Xo
160 .Fl s Ar time ,
161 .Fl -start-time= Ns Ar time
162 .Xc
163 Obtain a ticket that starts to be valid
164 .Ar time
165 (which can really be a generic time specification, like
166 .Sq 1h )
167 seconds into the future.
168 .It Xo
169 .Fl k ,
170 .Fl -use-keytab
171 .Xc
172 The same as
173 .Fl -keytab ,
174 but with the default keytab name (normally
175 .Ar FILE:/etc/krb5.keytab ) .
176 .It Xo
177 .Fl v ,
178 .Fl -validate
179 .Xc
180 Try to validate an invalid ticket.
181 .It Xo
182 .Fl e ,
183 .Fl -enctypes= Ns Ar enctypes
184 .Xc
185 Request tickets with this particular enctype.
186 .It Xo
187 .Fl -fcache-version= Ns Ar version
188 .Xc
189 Create a credentials cache of version
190 .Nm version .
191 .It Xo
192 .Fl a ,
193 .Fl -extra-addresses= Ns Ar enctypes
194 .Xc
195 Adds a set of addresses that will, in addition to the systems local
196 addresses, be put in the ticket.
197 This can be useful if all addresses a client can use can't be
198 automatically figured out.
199 One such example is if the client is behind a firewall.
200 Also settable via
201 .Li libdefaults/extra_addresses
202 in
203 .Xr krb5.conf 5 .
204 .It Xo
205 .Fl A ,
206 .Fl -no-addresses
207 .Xc
208 Request a ticket with no addresses.
209 .It Xo
210 .Fl -anonymous
211 .Xc
212 Request an anonymous ticket (which means that the ticket will be
213 issued to an anonymous principal, typically
214 .Dq anonymous@REALM ) .
215 .El
216 .Pp
217 The following options are only available if
218 .Nm
219 has been compiled with support for Kerberos 4.
220 .Bl -tag -width Ds
221 .It Xo
222 .Fl 4 ,
223 .Fl -524init
224 .Xc
225 Try to convert the obtained Kerberos 5 krbtgt to a version 4
226 compatible ticket.
227 It will store this ticket in the default Kerberos 4 ticket file.
228 .It Xo
229 .Fl 9 ,
230 .Fl -524convert
231 .Xc
232 only convert ticket to version 4
233 .It Fl -afslog
234 Gets AFS tickets, converts them to version 4 format, and stores them
235 in the kernel.
236 Only useful if you have AFS.
237 .El
238 .Pp
239 The
240 .Ar forwardable ,
241 .Ar proxiable ,
242 .Ar ticket_life ,
243 and
244 .Ar renewable_life
245 options can be set to a default value from the
246 .Dv appdefaults
247 section in krb5.conf, see
248 .Xr krb5_appdefault 3 .
249 .Pp
250 If a
251 .Ar command
252 is given,
253 .Nm kinit
254 will set up new credentials caches, and AFS PAG, and then run the given
255 command.
256 When it finishes the credentials will be removed.
257 .Sh ENVIRONMENT
258 .Bl -tag -width Ds
259 .It Ev KRB5CCNAME
260 Specifies the default credentials cache.
261 .It Ev KRB5_CONFIG
262 The file name of
263 .Pa krb5.conf ,
264 the default being
265 .Pa /etc/krb5.conf .
266 .It Ev KRBTKFILE
267 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
268 .El
269 .\".Sh FILES
270 .\".Sh EXAMPLES
271 .\".Sh DIAGNOSTICS
272 .Sh SEE ALSO
273 .Xr kdestroy 1 ,
274 .Xr klist 1 ,
275 .Xr krb5_appdefault 3 ,
276 .Xr krb5.conf 5
277 .\".Sh STANDARDS
278 .\".Sh HISTORY
279 .\".Sh AUTHORS
280 .\".Sh BUGS