| blob | ed8770aa3e3914b12558eb1fc76476688c1448a9 |
1 .\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id$
33 .\"
34 .Dd April 25, 2006
35 .Dt KINIT 1
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm kinit
39 .Nd acquire initial tickets
40 .Sh SYNOPSIS
41 .Nm kinit
42 .Op Fl -afslog
43 .Oo Fl c Ar cachename \*(Ba Xo
44 .Fl -cache= Ns Ar cachename
45 .Xc
46 .Oc
47 .Op Fl f | Fl -no-forwardable
48 .Oo Fl t Ar keytabname \*(Ba Xo
49 .Fl -keytab= Ns Ar keytabname
50 .Xc
51 .Oc
52 .Oo Fl l Ar time \*(Ba Xo
53 .Fl -lifetime= Ns Ar time
54 .Xc
55 .Oc
56 .Op Fl p | Fl -proxiable
57 .Op Fl R | Fl -renew
58 .Op Fl -renewable
59 .Oo Fl r Ar time \*(Ba Xo
60 .Fl -renewable-life= Ns Ar time
61 .Xc
62 .Oc
63 .Oo Fl S Ar principal \*(Ba Xo
64 .Fl -server= Ns Ar principal
65 .Xc
66 .Oc
67 .Oo Fl s Ar time \*(Ba Xo
68 .Fl -start-time= Ns Ar time
69 .Xc
70 .Oc
71 .Op Fl k | Fl -use-keytab
72 .Op Fl v | Fl -validate
73 .Oo Fl e Ar enctypes \*(Ba Xo
74 .Fl -enctypes= Ns Ar enctypes
75 .Xc
76 .Oc
77 .Oo Fl a Ar addresses \*(Ba Xo
78 .Fl -extra-addresses= Ns Ar addresses
79 .Xc
80 .Oc
81 .Op Fl -password-file= Ns Ar filename
82 .Op Fl -fcache-version= Ns Ar version-number
83 .Op Fl A | Fl -no-addresses
84 .Op Fl -anonymous
85 .Op Fl -enterprise
86 .Op Fl -version
87 .Op Fl -help
88 .Op Ar principal Op Ar command
89 .Sh DESCRIPTION
90 .Nm
91 is used to authenticate to the Kerberos server as
92 .Ar principal ,
93 or if none is given, a system generated default (typically your login
94 name at the default realm), and acquire a ticket granting ticket that
95 can later be used to obtain tickets for other services.
96 .Pp
97 Supported options:
98 .Bl -tag -width Ds
99 .It Xo
100 .Fl c Ar cachename
101 .Fl -cache= Ns Ar cachename
102 .Xc
103 The credentials cache to put the acquired ticket in, if other than
104 default.
105 .It Xo
106 .Fl f
107 .Fl -no-forwardable
108 .Xc
109 Get ticket that can be forwarded to another host, or if the negative
110 flags use, don't get a forwardable flag.
111 .It Xo
112 .Fl t Ar keytabname ,
113 .Fl -keytab= Ns Ar keytabname
114 .Xc
115 Don't ask for a password, but instead get the key from the specified
116 keytab.
117 .It Xo
118 .Fl l Ar time ,
119 .Fl -lifetime= Ns Ar time
120 .Xc
121 Specifies the lifetime of the ticket.
122 The argument can either be in seconds, or a more human readable string
123 like
124 .Sq 1h .
125 .It Xo
126 .Fl p ,
127 .Fl -proxiable
128 .Xc
129 Request tickets with the proxiable flag set.
130 .It Xo
131 .Fl R ,
132 .Fl -renew
133 .Xc
134 Try to renew ticket.
135 The ticket must have the
136 .Sq renewable
137 flag set, and must not be expired.
138 .It Fl -renewable
139 The same as
140 .Fl -renewable-life ,
141 with an infinite time.
142 .It Xo
143 .Fl r Ar time ,
144 .Fl -renewable-life= Ns Ar time
145 .Xc
146 The max renewable ticket life.
147 .It Xo
148 .Fl S Ar principal ,
149 .Fl -server= Ns Ar principal
150 .Xc
151 Get a ticket for a service other than krbtgt/LOCAL.REALM.
152 .It Xo
153 .Fl s Ar time ,
154 .Fl -start-time= Ns Ar time
155 .Xc
156 Obtain a ticket that starts to be valid
157 .Ar time
158 (which can really be a generic time specification, like
159 .Sq 1h )
160 seconds into the future.
161 .It Xo
162 .Fl k ,
163 .Fl -use-keytab
164 .Xc
165 The same as
166 .Fl -keytab ,
167 but with the default keytab name (normally
168 .Ar FILE:/etc/krb5.keytab ) .
169 .It Xo
170 .Fl v ,
171 .Fl -validate
172 .Xc
173 Try to validate an invalid ticket.
174 .It Xo
175 .Fl e ,
176 .Fl -enctypes= Ns Ar enctypes
177 .Xc
178 Request tickets with this particular enctype.
179 .It Xo
180 .Fl -password-file= Ns Ar filename
181 .Xc
182 read the password from the first line of
183 .Ar filename .
184 If the
185 .Ar filename
186 is
187 .Ar STDIN ,
188 the password will be read from the standard input.
189 .It Xo
190 .Fl -fcache-version= Ns Ar version-number
191 .Xc
192 Create a credentials cache of version
193 .Ar version-number .
194 .It Xo
195 .Fl a ,
196 .Fl -extra-addresses= Ns Ar enctypes
197 .Xc
198 Adds a set of addresses that will, in addition to the systems local
199 addresses, be put in the ticket.
200 This can be useful if all addresses a client can use can't be
201 automatically figured out.
202 One such example is if the client is behind a firewall.
203 Also settable via
204 .Li libdefaults/extra_addresses
205 in
206 .Xr krb5.conf 5 .
207 .It Xo
208 .Fl A ,
209 .Fl -no-addresses
210 .Xc
211 Request a ticket with no addresses.
212 .It Xo
213 .Fl -anonymous
214 .Xc
215 Request an anonymous ticket (which means that the ticket will be
216 issued to an anonymous principal, typically
217 .Dq anonymous@REALM ) .
218 .It Xo
219 .Fl -enterprise
220 .Xc
221 Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise
222 names are email like principals that are stored in the name part of
223 the principal, and since there are two @ characters the parser needs
224 to know that the first is not a realm.
225 An example of an enterprise name is
226 .Dq lha@e.kth.se@KTH.SE ,
227 and this option is usually used with canonicalize so that the
228 principal returned from the KDC will typically be the real principal
229 name.
230 .It Fl -afslog
231 Gets AFS tickets, converts them to version 4 format, and stores them
232 in the kernel.
233 Only useful if you have AFS.
234 .El
235 .Pp
236 The
237 .Ar forwardable ,
238 .Ar proxiable ,
239 .Ar ticket_life ,
240 and
241 .Ar renewable_life
242 options can be set to a default value from the
243 .Dv appdefaults
244 section in krb5.conf, see
245 .Xr krb5_appdefault 3 .
246 .Pp
247 If a
248 .Ar command
249 is given,
250 .Nm
251 will set up new credentials caches, and AFS PAG, and then run the given
252 command.
253 When it finishes the credentials will be removed.
254 .Sh ENVIRONMENT
255 .Bl -tag -width Ds
256 .It Ev KRB5CCNAME
257 Specifies the default credentials cache.
258 .It Ev KRB5_CONFIG
259 The file name of
260 .Pa krb5.conf ,
261 the default being
262 .Pa /etc/krb5.conf .
263 .It Ev KRBTKFILE
264 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
265 .El
266 .\".Sh FILES
267 .\".Sh EXAMPLES
268 .\".Sh DIAGNOSTICS
269 .Sh SEE ALSO
270 .Xr kdestroy 1 ,
271 .Xr klist 1 ,
272 .Xr krb5_appdefault 3 ,
273 .Xr krb5.conf 5
274 .\".Sh STANDARDS
275 .\".Sh HISTORY
276 .\".Sh AUTHORS
277 .\".Sh BUGS