|
Packit |
fd8b60 |
.\" Man page generated from reStructuredText.
|
|
Packit |
fd8b60 |
.
|
|
Packit |
fd8b60 |
.TH "KINIT" "1" " " "1.18.2" "MIT Kerberos"
|
|
Packit |
fd8b60 |
.SH NAME
|
|
Packit |
fd8b60 |
kinit \- obtain and cache Kerberos ticket-granting ticket
|
|
Packit |
fd8b60 |
.
|
|
Packit |
fd8b60 |
.nr rst2man-indent-level 0
|
|
Packit |
fd8b60 |
.
|
|
Packit |
fd8b60 |
.de1 rstReportMargin
|
|
Packit |
fd8b60 |
\\$1 \\n[an-margin]
|
|
Packit |
fd8b60 |
level \\n[rst2man-indent-level]
|
|
Packit |
fd8b60 |
level margin: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
Packit |
fd8b60 |
-
|
|
Packit |
fd8b60 |
\\n[rst2man-indent0]
|
|
Packit |
fd8b60 |
\\n[rst2man-indent1]
|
|
Packit |
fd8b60 |
\\n[rst2man-indent2]
|
|
Packit |
fd8b60 |
..
|
|
Packit |
fd8b60 |
.de1 INDENT
|
|
Packit |
fd8b60 |
.\" .rstReportMargin pre:
|
|
Packit |
fd8b60 |
. RS \\$1
|
|
Packit |
fd8b60 |
. nr rst2man-indent\\n[rst2man-indent-level] \\n[an-margin]
|
|
Packit |
fd8b60 |
. nr rst2man-indent-level +1
|
|
Packit |
fd8b60 |
.\" .rstReportMargin post:
|
|
Packit |
fd8b60 |
..
|
|
Packit |
fd8b60 |
.de UNINDENT
|
|
Packit |
fd8b60 |
. RE
|
|
Packit |
fd8b60 |
.\" indent \\n[an-margin]
|
|
Packit |
fd8b60 |
.\" old: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
Packit |
fd8b60 |
.nr rst2man-indent-level -1
|
|
Packit |
fd8b60 |
.\" new: \\n[rst2man-indent\\n[rst2man-indent-level]]
|
|
Packit |
fd8b60 |
.in \\n[rst2man-indent\\n[rst2man-indent-level]]u
|
|
Packit |
fd8b60 |
..
|
|
Packit |
fd8b60 |
.SH SYNOPSIS
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
\fBkinit\fP
|
|
Packit |
fd8b60 |
[\fB\-V\fP]
|
|
Packit |
fd8b60 |
[\fB\-l\fP \fIlifetime\fP]
|
|
Packit |
fd8b60 |
[\fB\-s\fP \fIstart_time\fP]
|
|
Packit |
fd8b60 |
[\fB\-r\fP \fIrenewable_life\fP]
|
|
Packit |
fd8b60 |
[\fB\-p\fP | \-\fBP\fP]
|
|
Packit |
fd8b60 |
[\fB\-f\fP | \-\fBF\fP]
|
|
Packit |
fd8b60 |
[\fB\-a\fP]
|
|
Packit |
fd8b60 |
[\fB\-A\fP]
|
|
Packit |
fd8b60 |
[\fB\-C\fP]
|
|
Packit |
fd8b60 |
[\fB\-E\fP]
|
|
Packit |
fd8b60 |
[\fB\-v\fP]
|
|
Packit |
fd8b60 |
[\fB\-R\fP]
|
|
Packit |
fd8b60 |
[\fB\-k\fP [\-\fBt\fP \fIkeytab_file\fP]]
|
|
Packit |
fd8b60 |
[\fB\-c\fP \fIcache_name\fP]
|
|
Packit |
fd8b60 |
[\fB\-n\fP]
|
|
Packit |
fd8b60 |
[\fB\-S\fP \fIservice_name\fP]
|
|
Packit |
fd8b60 |
[\fB\-I\fP \fIinput_ccache\fP]
|
|
Packit |
fd8b60 |
[\fB\-T\fP \fIarmor_ccache\fP]
|
|
Packit |
fd8b60 |
[\fB\-X\fP \fIattribute\fP[=\fIvalue\fP]]
|
|
Packit |
fd8b60 |
[\fIprincipal\fP]
|
|
Packit |
fd8b60 |
.SH DESCRIPTION
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
kinit obtains and caches an initial ticket\-granting ticket for
|
|
Packit |
fd8b60 |
\fIprincipal\fP\&. If \fIprincipal\fP is absent, kinit chooses an appropriate
|
|
Packit |
fd8b60 |
principal name based on existing credential cache contents or the
|
|
Packit |
fd8b60 |
local username of the user invoking kinit. Some options modify the
|
|
Packit |
fd8b60 |
choice of principal name.
|
|
Packit |
fd8b60 |
.SH OPTIONS
|
|
Packit |
fd8b60 |
.INDENT 0.0
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-V\fP
|
|
Packit |
fd8b60 |
display verbose output.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-l\fP \fIlifetime\fP
|
|
Packit |
fd8b60 |
(duration string.) Requests a ticket with the lifetime
|
|
Packit |
fd8b60 |
\fIlifetime\fP\&.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
For example, \fBkinit \-l 5:30\fP or \fBkinit \-l 5h30m\fP\&.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
If the \fB\-l\fP option is not specified, the default ticket lifetime
|
|
Packit |
fd8b60 |
(configured by each site) is used. Specifying a ticket lifetime
|
|
Packit |
fd8b60 |
longer than the maximum ticket lifetime (configured by each site)
|
|
Packit |
fd8b60 |
will not override the configured maximum ticket lifetime.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-s\fP \fIstart_time\fP
|
|
Packit |
fd8b60 |
(duration string.) Requests a postdated ticket. Postdated
|
|
Packit |
fd8b60 |
tickets are issued with the \fBinvalid\fP flag set, and need to be
|
|
Packit |
fd8b60 |
resubmitted to the KDC for validation before use.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
\fIstart_time\fP specifies the duration of the delay before the ticket
|
|
Packit |
fd8b60 |
can become valid.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-r\fP \fIrenewable_life\fP
|
|
Packit |
fd8b60 |
(duration string.) Requests renewable tickets, with a total
|
|
Packit |
fd8b60 |
lifetime of \fIrenewable_life\fP\&.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-f\fP
|
|
Packit |
fd8b60 |
requests forwardable tickets.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-F\fP
|
|
Packit |
fd8b60 |
requests non\-forwardable tickets.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-p\fP
|
|
Packit |
fd8b60 |
requests proxiable tickets.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-P\fP
|
|
Packit |
fd8b60 |
requests non\-proxiable tickets.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-a\fP
|
|
Packit |
fd8b60 |
requests tickets restricted to the host\(aqs local address[es].
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-A\fP
|
|
Packit |
fd8b60 |
requests tickets not restricted by address.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-C\fP
|
|
Packit |
fd8b60 |
requests canonicalization of the principal name, and allows the
|
|
Packit |
fd8b60 |
KDC to reply with a different client principal from the one
|
|
Packit |
fd8b60 |
requested.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-E\fP
|
|
Packit |
fd8b60 |
treats the principal name as an enterprise name.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-v\fP
|
|
Packit |
fd8b60 |
requests that the ticket\-granting ticket in the cache (with the
|
|
Packit |
fd8b60 |
\fBinvalid\fP flag set) be passed to the KDC for validation. If the
|
|
Packit |
fd8b60 |
ticket is within its requested time range, the cache is replaced
|
|
Packit |
fd8b60 |
with the validated ticket.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-R\fP
|
|
Packit |
fd8b60 |
requests renewal of the ticket\-granting ticket. Note that an
|
|
Packit |
fd8b60 |
expired ticket cannot be renewed, even if the ticket is still
|
|
Packit |
fd8b60 |
within its renewable life.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
Note that renewable tickets that have expired as reported by
|
|
Packit |
fd8b60 |
klist(1) may sometimes be renewed using this option,
|
|
Packit |
fd8b60 |
because the KDC applies a grace period to account for client\-KDC
|
|
Packit |
fd8b60 |
clock skew. See krb5.conf(5) \fBclockskew\fP setting.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-k\fP [\fB\-i\fP | \fB\-t\fP \fIkeytab_file\fP]
|
|
Packit |
fd8b60 |
requests a ticket, obtained from a key in the local host\(aqs keytab.
|
|
Packit |
fd8b60 |
The location of the keytab may be specified with the \fB\-t\fP
|
|
Packit |
fd8b60 |
\fIkeytab_file\fP option, or with the \fB\-i\fP option to specify the use
|
|
Packit |
fd8b60 |
of the default client keytab; otherwise the default keytab will be
|
|
Packit |
fd8b60 |
used. By default, a host ticket for the local host is requested,
|
|
Packit |
fd8b60 |
but any principal may be specified. On a KDC, the special keytab
|
|
Packit |
fd8b60 |
location \fBKDB:\fP can be used to indicate that kinit should open
|
|
Packit |
fd8b60 |
the KDC database and look up the key directly. This permits an
|
|
Packit |
fd8b60 |
administrator to obtain tickets as any principal that supports
|
|
Packit |
fd8b60 |
authentication based on the key.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-n\fP
|
|
Packit |
fd8b60 |
Requests anonymous processing. Two types of anonymous principals
|
|
Packit |
fd8b60 |
are supported.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
For fully anonymous Kerberos, configure pkinit on the KDC and
|
|
Packit |
fd8b60 |
configure \fBpkinit_anchors\fP in the client\(aqs krb5.conf(5)\&.
|
|
Packit |
fd8b60 |
Then use the \fB\-n\fP option with a principal of the form \fB@REALM\fP
|
|
Packit |
fd8b60 |
(an empty principal name followed by the at\-sign and a realm
|
|
Packit |
fd8b60 |
name). If permitted by the KDC, an anonymous ticket will be
|
|
Packit |
fd8b60 |
returned.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
A second form of anonymous tickets is supported; these
|
|
Packit |
fd8b60 |
realm\-exposed tickets hide the identity of the client but not the
|
|
Packit |
fd8b60 |
client\(aqs realm. For this mode, use \fBkinit \-n\fP with a normal
|
|
Packit |
fd8b60 |
principal name. If supported by the KDC, the principal (but not
|
|
Packit |
fd8b60 |
realm) will be replaced by the anonymous principal.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
As of release 1.8, the MIT Kerberos KDC only supports fully
|
|
Packit |
fd8b60 |
anonymous operation.
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
\fB\-I\fP \fIinput_ccache\fP
|
|
Packit |
fd8b60 |
.INDENT 0.0
|
|
Packit |
fd8b60 |
.INDENT 3.5
|
|
Packit |
fd8b60 |
Specifies the name of a credentials cache that already contains a
|
|
Packit |
fd8b60 |
ticket. When obtaining that ticket, if information about how that
|
|
Packit |
fd8b60 |
ticket was obtained was also stored to the cache, that information
|
|
Packit |
fd8b60 |
will be used to affect how new credentials are obtained, including
|
|
Packit |
fd8b60 |
preselecting the same methods of authenticating to the KDC.
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.INDENT 0.0
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-T\fP \fIarmor_ccache\fP
|
|
Packit |
fd8b60 |
Specifies the name of a credentials cache that already contains a
|
|
Packit |
fd8b60 |
ticket. If supported by the KDC, this cache will be used to armor
|
|
Packit |
fd8b60 |
the request, preventing offline dictionary attacks and allowing
|
|
Packit |
fd8b60 |
the use of additional preauthentication mechanisms. Armoring also
|
|
Packit |
fd8b60 |
makes sure that the response from the KDC is not modified in
|
|
Packit |
fd8b60 |
transit.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-c\fP \fIcache_name\fP
|
|
Packit |
fd8b60 |
use \fIcache_name\fP as the Kerberos 5 credentials (ticket) cache
|
|
Packit |
fd8b60 |
location. If this option is not used, the default cache location
|
|
Packit |
fd8b60 |
is used.
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
The default cache location may vary between systems. If the
|
|
Packit |
fd8b60 |
\fBKRB5CCNAME\fP environment variable is set, its value is used to
|
|
Packit |
fd8b60 |
locate the default cache. If a principal name is specified and
|
|
Packit |
fd8b60 |
the type of the default cache supports a collection (such as the
|
|
Packit |
fd8b60 |
DIR type), an existing cache containing credentials for the
|
|
Packit |
fd8b60 |
principal is selected or a new one is created and becomes the new
|
|
Packit |
fd8b60 |
primary cache. Otherwise, any existing contents of the default
|
|
Packit |
fd8b60 |
cache are destroyed by kinit.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-S\fP \fIservice_name\fP
|
|
Packit |
fd8b60 |
specify an alternate service name to use when getting initial
|
|
Packit |
fd8b60 |
tickets.
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fB\-X\fP \fIattribute\fP[=\fIvalue\fP]
|
|
Packit |
fd8b60 |
specify a pre\-authentication \fIattribute\fP and \fIvalue\fP to be
|
|
Packit |
fd8b60 |
interpreted by pre\-authentication modules. The acceptable
|
|
Packit |
fd8b60 |
attribute and value values vary from module to module. This
|
|
Packit |
fd8b60 |
option may be specified multiple times to specify multiple
|
|
Packit |
fd8b60 |
attributes. If no value is specified, it is assumed to be "yes".
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
The following attributes are recognized by the PKINIT
|
|
Packit |
fd8b60 |
pre\-authentication mechanism:
|
|
Packit |
fd8b60 |
.INDENT 7.0
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fBX509_user_identity\fP=\fIvalue\fP
|
|
Packit |
fd8b60 |
specify where to find user\(aqs X509 identity information
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fBX509_anchors\fP=\fIvalue\fP
|
|
Packit |
fd8b60 |
specify where to find trusted X509 anchor information
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fBflag_RSA_PROTOCOL\fP[\fB=yes\fP]
|
|
Packit |
fd8b60 |
specify use of RSA, rather than the default Diffie\-Hellman
|
|
Packit |
fd8b60 |
protocol
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
\fBdisable_freshness\fP[\fB=yes\fP]
|
|
Packit |
fd8b60 |
disable sending freshness tokens (for testing purposes only)
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.SH ENVIRONMENT
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
See kerberos(7) for a description of Kerberos environment
|
|
Packit |
fd8b60 |
variables.
|
|
Packit |
fd8b60 |
.SH FILES
|
|
Packit |
fd8b60 |
.INDENT 0.0
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
.B \fB@CCNAME@\fP
|
|
Packit |
fd8b60 |
default location of Kerberos 5 credentials cache
|
|
Packit |
fd8b60 |
.TP
|
|
Packit |
fd8b60 |
.B \fB@KTNAME@\fP
|
|
Packit |
fd8b60 |
default location for the local host\(aqs keytab.
|
|
Packit |
fd8b60 |
.UNINDENT
|
|
Packit |
fd8b60 |
.SH SEE ALSO
|
|
Packit |
fd8b60 |
.sp
|
|
Packit |
fd8b60 |
klist(1), kdestroy(1), kerberos(7)
|
|
Packit |
fd8b60 |
.SH AUTHOR
|
|
Packit |
fd8b60 |
MIT
|
|
Packit |
fd8b60 |
.SH COPYRIGHT
|
|
Packit |
fd8b60 |
1985-2020, MIT
|
|
Packit |
fd8b60 |
.\" Generated by docutils manpage writer.
|
|
Packit |
fd8b60 |
.
|