| blob | 24d459fa5b4ef468081ad090bf42c65d613d4049 |
1 .\" Copyright (c) 1998 - 2003, 2006 Kungliga Tekniska Högskolan
2 .\" (Royal Institute of Technology, Stockholm, Sweden).
3 .\" All rights reserved.
4 .\"
5 .\" Redistribution and use in source and binary forms, with or without
6 .\" modification, are permitted provided that the following conditions
7 .\" are met:
8 .\"
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\"
12 .\" 2. Redistributions in binary form must reproduce the above copyright
13 .\" notice, this list of conditions and the following disclaimer in the
14 .\" documentation and/or other materials provided with the distribution.
15 .\"
16 .\" 3. Neither the name of the Institute nor the names of its contributors
17 .\" may be used to endorse or promote products derived from this software
18 .\" without specific prior written permission.
19 .\"
20 .\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND
21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE
24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 .\" SUCH DAMAGE.
31 .\"
32 .\" $Id$
33 .\"
34 .Dd April 25, 2006
35 .Dt KINIT 1
36 .Os HEIMDAL
37 .Sh NAME
38 .Nm kinit
39 .Nd acquire initial tickets
40 .Sh SYNOPSIS
41 .Nm kinit
42 .Op Fl -afslog
43 .Oo Fl c Ar cachename \*(Ba Xo
44 .Fl -cache= Ns Ar cachename
45 .Xc
46 .Oc
47 .Op Fl f | Fl -forwardable
48 .Oo Fl t Ar keytabname \*(Ba Xo
49 .Fl -keytab= Ns Ar keytabname
50 .Xc
51 .Oc
52 .Oo Fl l Ar time \*(Ba Xo
53 .Fl -lifetime= Ns Ar time
54 .Xc
55 .Oc
56 .Op Fl p | Fl -proxiable
57 .Op Fl R | Fl -renew
58 .Op Fl -renewable
59 .Oo Fl r Ar time \*(Ba Xo
60 .Fl -renewable-life= Ns Ar time
61 .Xc
62 .Oc
63 .Oo Fl S Ar principal \*(Ba Xo
64 .Fl -server= Ns Ar principal
65 .Xc
66 .Oc
67 .Oo Fl s Ar time \*(Ba Xo
68 .Fl -start-time= Ns Ar time
69 .Xc
70 .Oc
71 .Op Fl k | Fl -use-keytab
72 .Op Fl v | Fl -validate
73 .Oo Fl e Ar enctypes \*(Ba Xo
74 .Fl -enctypes= Ns Ar enctypes
75 .Xc
76 .Oc
77 .Oo Fl a Ar addresses \*(Ba Xo
78 .Fl -extra-addresses= Ns Ar addresses
79 .Xc
80 .Oc
81 .Op Fl -password-file= Ns Ar filename
82 .Op Fl -fcache-version= Ns Ar version-number
83 .Op Fl A | Fl -no-addresses
84 .Op Fl -anonymous
85 .Op Fl -enterprise
86 .Op Fl -version
87 .Op Fl -help
88 .Op Ar principal Op Ar command
89 .Sh DESCRIPTION
90 .Nm
91 is used to authenticate to the Kerberos server as
92 .Ar principal ,
93 or if none is given, a system generated default (typically your login
94 name at the default realm), and acquire a ticket granting ticket that
95 can later be used to obtain tickets for other services.
96 .Pp
97 Supported options:
98 .Bl -tag -width Ds
99 .It Xo
100 .Fl c Ar cachename
101 .Fl -cache= Ns Ar cachename
102 .Xc
103 The credentials cache to put the acquired ticket in, if other than
104 default.
105 .It Xo
106 .Fl f ,
107 .Fl -forwardable
108 .Xc
109 Get ticket that can be forwarded to another host.
110 .It Xo
111 .Fl t Ar keytabname ,
112 .Fl -keytab= Ns Ar keytabname
113 .Xc
114 Don't ask for a password, but instead get the key from the specified
115 keytab.
116 .It Xo
117 .Fl l Ar time ,
118 .Fl -lifetime= Ns Ar time
119 .Xc
120 Specifies the lifetime of the ticket.
121 The argument can either be in seconds, or a more human readable string
122 like
123 .Sq 1h .
124 .It Xo
125 .Fl p ,
126 .Fl -proxiable
127 .Xc
128 Request tickets with the proxiable flag set.
129 .It Xo
130 .Fl R ,
131 .Fl -renew
132 .Xc
133 Try to renew ticket.
134 The ticket must have the
135 .Sq renewable
136 flag set, and must not be expired.
137 .It Fl -renewable
138 The same as
139 .Fl -renewable-life ,
140 with an infinite time.
141 .It Xo
142 .Fl r Ar time ,
143 .Fl -renewable-life= Ns Ar time
144 .Xc
145 The max renewable ticket life.
146 .It Xo
147 .Fl S Ar principal ,
148 .Fl -server= Ns Ar principal
149 .Xc
150 Get a ticket for a service other than krbtgt/LOCAL.REALM.
151 .It Xo
152 .Fl s Ar time ,
153 .Fl -start-time= Ns Ar time
154 .Xc
155 Obtain a ticket that starts to be valid
156 .Ar time
157 (which can really be a generic time specification, like
158 .Sq 1h )
159 seconds into the future.
160 .It Xo
161 .Fl k ,
162 .Fl -use-keytab
163 .Xc
164 The same as
165 .Fl -keytab ,
166 but with the default keytab name (normally
167 .Ar FILE:/etc/krb5.keytab ) .
168 .It Xo
169 .Fl v ,
170 .Fl -validate
171 .Xc
172 Try to validate an invalid ticket.
173 .It Xo
174 .Fl e ,
175 .Fl -enctypes= Ns Ar enctypes
176 .Xc
177 Request tickets with this particular enctype.
178 .It Xo
179 .Fl -password-file= Ns Ar filename
180 .Xc
181 read the password from the first line of
182 .Ar filename .
183 If the
184 .Ar filename
185 is
186 .Ar STDIN ,
187 the password will be read from the standard input.
188 .It Xo
189 .Fl -fcache-version= Ns Ar version-number
190 .Xc
191 Create a credentials cache of version
192 .Ar version-number .
193 .It Xo
194 .Fl a ,
195 .Fl -extra-addresses= Ns Ar enctypes
196 .Xc
197 Adds a set of addresses that will, in addition to the systems local
198 addresses, be put in the ticket.
199 This can be useful if all addresses a client can use can't be
200 automatically figured out.
201 One such example is if the client is behind a firewall.
202 Also settable via
203 .Li libdefaults/extra_addresses
204 in
205 .Xr krb5.conf 5 .
206 .It Xo
207 .Fl A ,
208 .Fl -no-addresses
209 .Xc
210 Request a ticket with no addresses.
211 .It Xo
212 .Fl -anonymous
213 .Xc
214 Request an anonymous ticket (which means that the ticket will be
215 issued to an anonymous principal, typically
216 .Dq anonymous@REALM ) .
217 .It Xo
218 .Fl -enterprise
219 .Xc
220 Parse principal as a enterprise (KRB5-NT-ENTERPRISE) name. Enterprise
221 names are email like principals that are stored in the name part of
222 the principal, and since there are two @ characters the parser needs
223 to know that the first is not a realm.
224 An example of an enterprise name is
225 .Dq lha@e.kth.se@KTH.SE ,
226 and this option is usually used with canonicalize so that the
227 principal returned from the KDC will typically be the real principal
228 name.
229 .It Fl -afslog
230 Gets AFS tickets, converts them to version 4 format, and stores them
231 in the kernel.
232 Only useful if you have AFS.
233 .El
234 .Pp
235 The
236 .Ar forwardable ,
237 .Ar proxiable ,
238 .Ar ticket_life ,
239 and
240 .Ar renewable_life
241 options can be set to a default value from the
242 .Dv appdefaults
243 section in krb5.conf, see
244 .Xr krb5_appdefault 3 .
245 .Pp
246 If a
247 .Ar command
248 is given,
249 .Nm
250 will set up new credentials caches, and AFS PAG, and then run the given
251 command.
252 When it finishes the credentials will be removed.
253 .Sh ENVIRONMENT
254 .Bl -tag -width Ds
255 .It Ev KRB5CCNAME
256 Specifies the default credentials cache.
257 .It Ev KRB5_CONFIG
258 The file name of
259 .Pa krb5.conf ,
260 the default being
261 .Pa /etc/krb5.conf .
262 .It Ev KRBTKFILE
263 Specifies the Kerberos 4 ticket file to store version 4 tickets in.
264 .El
265 .\".Sh FILES
266 .\".Sh EXAMPLES
267 .\".Sh DIAGNOSTICS
268 .Sh SEE ALSO
269 .Xr kdestroy 1 ,
270 .Xr klist 1 ,
271 .Xr krb5_appdefault 3 ,
272 .Xr krb5.conf 5
273 .\".Sh STANDARDS
274 .\".Sh HISTORY
275 .\".Sh AUTHORS
276 .\".Sh BUGS