| blob | 127c6bd754ff4d8bd46a9e147266544e53d12d2a |
1 .\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id$
33 .\"
34 .Dd April 25, 2006
35 .Dt KINIT 1
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm kinit
39 .Nd acquire initial tickets
40 .Sh SYNOPSIS
41 .Nm kinit
42 .Op Fl -afslog
43 .Oo Fl c Ar cachename \*(Ba Xo
44 .Fl -cache= Ns Ar cachename
45 .Xc
46 .Oc
47 .Op Fl f | Fl -forwardable
48 .Oo Fl t Ar keytabname \*(Ba Xo
49 .Fl -keytab= Ns Ar keytabname
50 .Xc
51 .Oc
52 .Oo Fl l Ar time \*(Ba Xo
53 .Fl -lifetime= Ns Ar time
54 .Xc
55 .Oc
56 .Op Fl p | Fl -proxiable
57 .Op Fl R | Fl -renew
58 .Op Fl -renewable
59 .Oo Fl r Ar time \*(Ba Xo
60 .Fl -renewable-life= Ns Ar time
61 .Xc
62 .Oc
63 .Oo Fl S Ar principal \*(Ba Xo
64 .Fl -server= Ns Ar principal
65 .Xc
66 .Oc
67 .Oo Fl s Ar time \*(Ba Xo
68 .Fl -start-time= Ns Ar time
69 .Xc
70 .Oc
71 .Op Fl k | Fl -use-keytab
72 .Op Fl v | Fl -validate
73 .Oo Fl e Ar enctypes \*(Ba Xo
74 .Fl -enctypes= Ns Ar enctypes
75 .Xc
76 .Oc
77 .Oo Fl a Ar addresses \*(Ba Xo
78 .Fl -extra-addresses= Ns Ar addresses
79 .Xc
80 .Oc
81 .Op Fl -password-file= Ns Ar filename
82 .Op Fl -fcache-version= Ns Ar version-number
83 .Op Fl A | Fl -no-addresses
84 .Op Fl -anonymous
85 .Op Fl -version
86 .Op Fl -help
87 .Op Ar principal Op Ar command
88 .Sh DESCRIPTION
89 .Nm
90 is used to authenticate to the Kerberos server as
91 .Ar principal ,
92 or if none is given, a system generated default (typically your login
93 name at the default realm), and acquire a ticket granting ticket that
94 can later be used to obtain tickets for other services.
95 .Pp
96 Supported options:
97 .Bl -tag -width Ds
98 .It Xo
99 .Fl c Ar cachename
100 .Fl -cache= Ns Ar cachename
101 .Xc
102 The credentials cache to put the acquired ticket in, if other than
103 default.
104 .It Xo
105 .Fl f ,
106 .Fl -forwardable
107 .Xc
108 Get ticket that can be forwarded to another host.
109 .It Xo
110 .Fl t Ar keytabname ,
111 .Fl -keytab= Ns Ar keytabname
112 .Xc
113 Don't ask for a password, but instead get the key from the specified
114 keytab.
115 .It Xo
116 .Fl l Ar time ,
117 .Fl -lifetime= Ns Ar time
118 .Xc
119 Specifies the lifetime of the ticket.
120 The argument can either be in seconds, or a more human readable string
121 like
122 .Sq 1h .
123 .It Xo
124 .Fl p ,
125 .Fl -proxiable
126 .Xc
127 Request tickets with the proxiable flag set.
128 .It Xo
129 .Fl R ,
130 .Fl -renew
131 .Xc
132 Try to renew ticket.
133 The ticket must have the
134 .Sq renewable
135 flag set, and must not be expired.
136 .It Fl -renewable
137 The same as
138 .Fl -renewable-life ,
139 with an infinite time.
140 .It Xo
141 .Fl r Ar time ,
142 .Fl -renewable-life= Ns Ar time
143 .Xc
144 The max renewable ticket life.
145 .It Xo
146 .Fl S Ar principal ,
147 .Fl -server= Ns Ar principal
148 .Xc
149 Get a ticket for a service other than krbtgt/LOCAL.REALM.
150 .It Xo
151 .Fl s Ar time ,
152 .Fl -start-time= Ns Ar time
153 .Xc
154 Obtain a ticket that starts to be valid
155 .Ar time
156 (which can really be a generic time specification, like
157 .Sq 1h )
158 seconds into the future.
159 .It Xo
160 .Fl k ,
161 .Fl -use-keytab
162 .Xc
163 The same as
164 .Fl -keytab ,
165 but with the default keytab name (normally
166 .Ar FILE:/etc/krb5.keytab ) .
167 .It Xo
168 .Fl v ,
169 .Fl -validate
170 .Xc
171 Try to validate an invalid ticket.
172 .It Xo
173 .Fl e ,
174 .Fl -enctypes= Ns Ar enctypes
175 .Xc
176 Request tickets with this particular enctype.
177 .It Xo
178 .Fl -password-file= Ns Ar filename
179 .Xc
180 read the password from the first line of
181 .Ar filename .
182 If the
183 .Ar filename
184 is
185 .Ar STDIN ,
186 the password will be read from the standard input.
187 .It Xo
188 .Fl -fcache-version= Ns Ar version-number
189 .Xc
190 Create a credentials cache of version
191 .Ar version-number .
192 .It Xo
193 .Fl a ,
194 .Fl -extra-addresses= Ns Ar enctypes
195 .Xc
196 Adds a set of addresses that will, in addition to the systems local
197 addresses, be put in the ticket.
198 This can be useful if all addresses a client can use can't be
199 automatically figured out.
200 One such example is if the client is behind a firewall.
201 Also settable via
202 .Li libdefaults/extra_addresses
203 in
204 .Xr krb5.conf 5 .
205 .It Xo
206 .Fl A ,
207 .Fl -no-addresses
208 .Xc
209 Request a ticket with no addresses.
210 .It Xo
211 .Fl -anonymous
212 .Xc
213 Request an anonymous ticket (which means that the ticket will be
214 issued to an anonymous principal, typically
215 .Dq anonymous@REALM ) .
216 .It Fl -afslog
217 Gets AFS tickets, converts them to version 4 format, and stores them
218 in the kernel.
219 Only useful if you have AFS.
220 .El
221 .Pp
222 The
223 .Ar forwardable ,
224 .Ar proxiable ,
225 .Ar ticket_life ,
226 and
227 .Ar renewable_life
228 options can be set to a default value from the
229 .Dv appdefaults
230 section in krb5.conf, see
231 .Xr krb5_appdefault 3 .
232 .Pp
233 If a
234 .Ar command
235 is given,
236 .Nm
237 will set up new credentials caches, and AFS PAG, and then run the given
238 command.
239 When it finishes the credentials will be removed.
240 .Sh ENVIRONMENT
241 .Bl -tag -width Ds
242 .It Ev KRB5CCNAME
243 Specifies the default credentials cache.
244 .It Ev KRB5_CONFIG
245 The file name of
246 .Pa krb5.conf ,
247 the default being
248 .Pa /etc/krb5.conf .
249 .It Ev KRBTKFILE
250 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
251 .El
252 .\".Sh FILES
253 .\".Sh EXAMPLES
254 .\".Sh DIAGNOSTICS
255 .Sh SEE ALSO
256 .Xr kdestroy 1 ,
257 .Xr klist 1 ,
258 .Xr krb5_appdefault 3 ,
259 .Xr krb5.conf 5
260 .\".Sh STANDARDS
261 .\".Sh HISTORY
262 .\".Sh AUTHORS
263 .\".Sh BUGS