summaryrefslogtreecommitdiff
path: root/doc/html/basic/rcache_def.html
diff options
context:
space:
mode:
authorCy Schubert <cy@FreeBSD.org>2025-03-19 22:12:25 +0000
committerCy Schubert <cy@FreeBSD.org>2025-03-19 22:12:25 +0000
commit8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/basic/rcache_def.html
parent1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)
Diffstat (limited to 'doc/html/basic/rcache_def.html')
-rw-r--r--doc/html/basic/rcache_def.html98
1 files changed, 46 insertions, 52 deletions
diff --git a/doc/html/basic/rcache_def.html b/doc/html/basic/rcache_def.html
index d3c61819c90c..3e8d53a4723c 100644
--- a/doc/html/basic/rcache_def.html
+++ b/doc/html/basic/rcache_def.html
@@ -1,35 +1,26 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"
- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<!DOCTYPE html>
-<html xmlns="http://www.w3.org/1999/xhtml">
+<html>
<head>
- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+ <meta charset="utf-8" />
+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
+
<title>replay cache &#8212; MIT Kerberos Documentation</title>
- <link rel="stylesheet" href="../_static/agogo.css" type="text/css" />
- <link rel="stylesheet" href="../_static/pygments.css" type="text/css" />
- <link rel="stylesheet" href="../_static/kerb.css" type="text/css" />
- <script type="text/javascript">
- var DOCUMENTATION_OPTIONS = {
- URL_ROOT: '../',
- VERSION: '1.21.2',
- COLLAPSE_INDEX: false,
- FILE_SUFFIX: '.html',
- HAS_SOURCE: true,
- SOURCELINK_SUFFIX: '.txt'
- };
- </script>
- <script type="text/javascript" src="../_static/jquery.js"></script>
- <script type="text/javascript" src="../_static/underscore.js"></script>
- <script type="text/javascript" src="../_static/doctools.js"></script>
+ <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
+ <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />
+ <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />
+ <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
+ <script src="../_static/jquery.js"></script>
+ <script src="../_static/underscore.js"></script>
+ <script src="../_static/doctools.js"></script>
<link rel="author" title="About these documents" href="../about.html" />
<link rel="index" title="Index" href="../genindex.html" />
<link rel="search" title="Search" href="../search.html" />
<link rel="copyright" title="Copyright" href="../copyright.html" />
<link rel="next" title="stash file" href="stash_file_def.html" />
<link rel="prev" title="keytab" href="keytab_def.html" />
- </head>
- <body>
+ </head><body>
<div class="header-wrapper">
<div class="header">
@@ -61,7 +52,7 @@
<div class="bodywrapper">
<div class="body" role="main">
- <div class="section" id="replay-cache">
+ <section id="replay-cache">
<span id="rcache-definition"></span><h1>replay cache<a class="headerlink" href="#replay-cache" title="Permalink to this headline">¶</a></h1>
<p>A replay cache (or “rcache”) keeps track of all authenticators
recently presented to a service. If a duplicate authentication
@@ -71,7 +62,7 @@ the application program.</p>
<a class="reference internal" href="keytab_def.html#keytab-definition"><span class="std std-ref">keytab</span></a> interfaces, uses <cite>type:residual</cite> strings to
indicate the type of replay cache and any associated cache naming
data to use.</p>
-<div class="section" id="background-information">
+<section id="background-information">
<h2>Background information<a class="headerlink" href="#background-information" title="Permalink to this headline">¶</a></h2>
<p>Some Kerberos or GSSAPI services use a simple authentication mechanism
where a message is sent containing an authenticator, which establishes
@@ -110,60 +101,62 @@ indicate a successful authentication before the client sends
additional messages), or if the simple act of presenting the
authenticator triggers some interesting action in the service being
attacked.</p>
-</div>
-<div class="section" id="replay-cache-types">
+</section>
+<section id="replay-cache-types">
<h2>Replay cache types<a class="headerlink" href="#replay-cache-types" title="Permalink to this headline">¶</a></h2>
<p>Unlike the credential cache and keytab interfaces, replay cache types
are in lowercase. The following types are defined:</p>
<ol class="arabic simple">
-<li><strong>none</strong> disables the replay cache. The residual value is ignored.</li>
-<li><strong>file2</strong> (new in release 1.18) uses a hash-based format to store
+<li><p><strong>none</strong> disables the replay cache. The residual value is ignored.</p></li>
+<li><p><strong>file2</strong> (new in release 1.18) uses a hash-based format to store
replay records. The file may grow to accommodate hash collisions.
-The residual value is the filename.</li>
-<li><strong>dfl</strong> is the default type if no environment variable or
+The residual value is the filename.</p></li>
+<li><p><strong>dfl</strong> is the default type if no environment variable or
configuration specifies a different type. It stores replay data in
a file2 replay cache with a filename based on the effective uid.
-The residual value is ignored.</li>
+The residual value is ignored.</p></li>
</ol>
<p>For the dfl type, the location of the replay cache file is determined
as follows:</p>
<ol class="arabic simple">
-<li>The directory is taken from the <strong>KRB5RCACHEDIR</strong> environment
+<li><p>The directory is taken from the <strong>KRB5RCACHEDIR</strong> environment
variable, or the <strong>TMPDIR</strong> environment variable, or a temporary
-directory determined at configuration time such as <code class="docutils literal"><span class="pre">/var/tmp</span></code>, in
-descending order of preference.</li>
-<li>The filename is <code class="docutils literal"><span class="pre">krb5_EUID.rcache2</span></code> where EUID is the effective
-uid of the process.</li>
-<li>The file is opened without following symbolic links, and ownership
-of the file is verified to match the effective uid.</li>
+directory determined at configuration time such as <code class="docutils literal notranslate"><span class="pre">/var/tmp</span></code>, in
+descending order of preference.</p></li>
+<li><p>The filename is <code class="docutils literal notranslate"><span class="pre">krb5_EUID.rcache2</span></code> where EUID is the effective
+uid of the process.</p></li>
+<li><p>The file is opened without following symbolic links, and ownership
+of the file is verified to match the effective uid.</p></li>
</ol>
<p>On Windows, the directory for the dfl type is the local appdata
directory, unless overridden by the <strong>KRB5RCACHEDIR</strong> environment
-variable. The filename on Windows is <code class="docutils literal"><span class="pre">krb5.rcache2</span></code>, and the file
+variable. The filename on Windows is <code class="docutils literal notranslate"><span class="pre">krb5.rcache2</span></code>, and the file
is opened normally.</p>
-</div>
-<div class="section" id="default-replay-cache-name">
+</section>
+<section id="default-replay-cache-name">
<h2>Default replay cache name<a class="headerlink" href="#default-replay-cache-name" title="Permalink to this headline">¶</a></h2>
<p>The default replay cache name is determined by the following, in
descending order of priority:</p>
<ol class="arabic simple">
-<li>The <strong>KRB5RCACHENAME</strong> environment variable (new in release 1.18).</li>
-<li>The <strong>KRB5RCACHETYPE</strong> environment variable. If this variable is
-set, the residual value is empty.</li>
-<li>The <strong>default_rcache_name</strong> profile variable in <a class="reference internal" href="../admin/conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a>
-(new in release 1.18).</li>
-<li>If none of the above are set, the default replay cache name is
-<code class="docutils literal"><span class="pre">dfl:</span></code>.</li>
+<li><p>The <strong>KRB5RCACHENAME</strong> environment variable (new in release 1.18).</p></li>
+<li><p>The <strong>KRB5RCACHETYPE</strong> environment variable. If this variable is
+set, the residual value is empty.</p></li>
+<li><p>The <strong>default_rcache_name</strong> profile variable in <a class="reference internal" href="../admin/conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a>
+(new in release 1.18).</p></li>
+<li><p>If none of the above are set, the default replay cache name is
+<code class="docutils literal notranslate"><span class="pre">dfl:</span></code>.</p></li>
</ol>
-</div>
-</div>
+</section>
+</section>
+ <div class="clearer"></div>
</div>
</div>
</div>
</div>
<div class="sidebar">
+
<h2>On this page</h2>
<ul>
<li><a class="reference internal" href="#">replay cache</a><ul>
@@ -206,6 +199,7 @@ set, the residual value is empty.</li>
<input type="hidden" name="check_keywords" value="yes" />
<input type="hidden" name="area" value="default" />
</form>
+
</div>
<div class="clearer"></div>
</div>
@@ -213,8 +207,8 @@ set, the residual value is empty.</li>
<div class="footer-wrapper">
<div class="footer" >
- <div class="right" ><i>Release: 1.21.2</i><br />
- &copy; <a href="../copyright.html">Copyright</a> 1985-2023, MIT.
+ <div class="right" ><i>Release: 1.21.3</i><br />
+ &copy; <a href="../copyright.html">Copyright</a> 1985-2024, MIT.
</div>
<div class="left">
generated by cgit v1.3 (git 2.53.0) at 2026-04-29 19:54:14 +0000