krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/user/user_config/kerberos.html
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/user/user_config/kerberos.html')

-rw-r--r--

doc/html/user/user_config/kerberos.html

173

1 files changed, 83 insertions, 90 deletions

diff --git a/doc/html/user/user_config/kerberos.html b/doc/html/user/user_config/kerberos.html
index ac625d8d03cc..fcc718c8ddd6 100644
--- a/doc/html/user/user_config/kerberos.html
+++ b/doc/html/user/user_config/kerberos.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>kerberos — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,9 +52,9 @@

- <div class="section" id="kerberos">

+ <section id="kerberos">

<span id="kerberos-7"></span><h1>kerberos<a class="headerlink" href="#kerberos" title="Permalink to this headline">¶</a></h1>

-<div class="section" id="description">

+<section id="description">

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

<p>The Kerberos system authenticates individual users in a network

environment. After authenticating yourself to Kerberos, you can use

@@ -77,8 +68,8 @@ administrator.</p>

<p>A Kerberos name usually contains three parts. The first is the

<strong>primary</strong>, which is usually a user’s or service’s name. The second

is the <strong>instance</strong>, which in the case of a user is usually null.

-Some users may have privileged instances, however, such as <code class="docutils literal"><span class="pre">root</span></code> or

-<code class="docutils literal"><span class="pre">admin</span></code>. In the case of a service, the instance is the fully

+Some users may have privileged instances, however, such as <code class="docutils literal notranslate"><span class="pre">root</span></code> or

+<code class="docutils literal notranslate"><span class="pre">admin</span></code>. In the case of a service, the instance is the fully

qualified name of the machine on which it runs; i.e. there can be an

ssh service running on the machine ABC (<a class="reference external" href="mailto:ssh/ABC%40REALM">ssh/ABC<span>@</span>REALM</a>), which is

different from the ssh service running on the machine XYZ

@@ -91,7 +82,7 @@ might be in realm EXAMPLE.COM).</p>

instance (if not null) by a slash, and the realm (if not the local

realm) follows, preceded by an “@” sign. The following are examples

of valid Kerberos names:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">david</span>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">david</span>

<span class="n">jennifer</span><span class="o">/</span><span class="n">admin</span>

<span class="n">joeuser</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

<span class="n">cbrown</span><span class="o">/</span><span class="n">root</span><span class="nd">@FUBAR</span><span class="o">.</span><span class="n">ORG</span>

@@ -103,14 +94,14 @@ message that provides authentication.) Kerberos uses this ticket for

network utilities such as ssh. The ticket transactions are done

transparently, so you don’t have to worry about their management.</p>

<p>Note, however, that tickets expire. Administrators may configure more

-privileged tickets, such as those with service or instance of <code class="docutils literal"><span class="pre">root</span></code>

-or <code class="docutils literal"><span class="pre">admin</span></code>, to expire in a few minutes, while tickets that carry

+privileged tickets, such as those with service or instance of <code class="docutils literal notranslate"><span class="pre">root</span></code>

+or <code class="docutils literal notranslate"><span class="pre">admin</span></code>, to expire in a few minutes, while tickets that carry

more ordinary privileges may be good for several hours or a day. If

your login session extends beyond the time limit, you will have to

re-authenticate yourself to Kerberos to get new tickets using the

<a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> command.</p>

<p>Some tickets are <strong>renewable</strong> beyond their initial lifetime. This

-means that <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-R</span></code> can extend their lifetime without requiring

+means that <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-R</span></code> can extend their lifetime without requiring

you to re-authenticate.</p>

<p>If you wish to delete your local tickets, use the <a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>

command.</p>

@@ -121,87 +112,86 @@ to forward them to the remote host. This can be useful for, e.g.,

running kinit on your local machine and then sshing into another to do

work. Note that this should not be done on untrusted machines since

they will then have your tickets.</p>

-</div>

-<div class="section" id="environment-variables">

+</section>

+<section id="environment-variables">

<h2>ENVIRONMENT VARIABLES<a class="headerlink" href="#environment-variables" title="Permalink to this headline">¶</a></h2>

<p>Several environment variables affect the operation of Kerberos-enabled

programs. These include:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd><p class="first">Default name for the credentials cache file, in the form

+<dl>

+<dt><strong>KRB5CCNAME</strong></dt><dd><p>Default name for the credentials cache file, in the form

<em>TYPE</em>:<em>residual</em>. The type of the default cache may determine

-the availability of a cache collection. <code class="docutils literal"><span class="pre">FILE</span></code> is not a

-collection type; <code class="docutils literal"><span class="pre">KEYRING</span></code>, <code class="docutils literal"><span class="pre">DIR</span></code>, and <code class="docutils literal"><span class="pre">KCM</span></code> are.</p>

-<p class="last">If not set, the value of <strong>default_ccache_name</strong> from

+the availability of a cache collection. <code class="docutils literal notranslate"><span class="pre">FILE</span></code> is not a

+collection type; <code class="docutils literal notranslate"><span class="pre">KEYRING</span></code>, <code class="docutils literal notranslate"><span class="pre">DIR</span></code>, and <code class="docutils literal notranslate"><span class="pre">KCM</span></code> are.</p>

+<p>If not set, the value of <strong>default_ccache_name</strong> from

configuration files (see <strong>KRB5_CONFIG</strong>) will be used. If that

-is also not set, the default <em>type</em> is <code class="docutils literal"><span class="pre">FILE</span></code>, and the

+is also not set, the default <em>type</em> is <code class="docutils literal notranslate"><span class="pre">FILE</span></code>, and the

<em>residual</em> is the path /tmp/krb5cc_*uid*, where <em>uid</em> is the

decimal user ID of the user.</p>

</dd>

-<dt><strong>KRB5_KTNAME</strong></dt>

-<dd>Specifies the location of the default keytab file, in the form

+<dt><strong>KRB5_KTNAME</strong></dt><dd><p>Specifies the location of the default keytab file, in the form

<em>TYPE</em>:<em>residual</em>. If no <em>type</em> is present, the <strong>FILE</strong> type is

assumed and <em>residual</em> is the pathname of the keytab file. If

-unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a> will be used.</dd>

-<dt><strong>KRB5_CONFIG</strong></dt>

-<dd>Specifies the location of the Kerberos configuration file. The

-default is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/krb5.conf</span></code>. Multiple filenames can

+unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a> will be used.</p>

+</dd>

+<dt><strong>KRB5_CONFIG</strong></dt><dd><p>Specifies the location of the Kerberos configuration file. The

+default is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/krb5.conf</span></code>. Multiple filenames can

be specified, separated by a colon; all files which are present

-will be read.</dd>

-<dt><strong>KRB5_KDC_PROFILE</strong></dt>

-<dd>Specifies the location of the KDC configuration file, which

+will be read.</p>

+</dd>

+<dt><strong>KRB5_KDC_PROFILE</strong></dt><dd><p>Specifies the location of the KDC configuration file, which

contains additional configuration directives for the Key

Distribution Center daemon and associated programs. The default

-is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal"><span class="pre">/krb5kdc</span></code><code class="docutils literal"><span class="pre">/kdc.conf</span></code>.</dd>

-<dt><strong>KRB5RCACHENAME</strong></dt>

-<dd>(New in release 1.18) Specifies the location of the default replay

-cache, in the form <em>type</em>:<em>residual</em>. The <code class="docutils literal"><span class="pre">file2</span></code> type with a

+is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal notranslate"><span class="pre">/krb5kdc</span></code><code class="docutils literal notranslate"><span class="pre">/kdc.conf</span></code>.</p>

+</dd>

+<dt><strong>KRB5RCACHENAME</strong></dt><dd><p>(New in release 1.18) Specifies the location of the default replay

+cache, in the form <em>type</em>:<em>residual</em>. The <code class="docutils literal notranslate"><span class="pre">file2</span></code> type with a

pathname residual specifies a replay cache file in the version-2

-format in the specified location. The <code class="docutils literal"><span class="pre">none</span></code> type (residual is

-ignored) disables the replay cache. The <code class="docutils literal"><span class="pre">dfl</span></code> type (residual is

+format in the specified location. The <code class="docutils literal notranslate"><span class="pre">none</span></code> type (residual is

+ignored) disables the replay cache. The <code class="docutils literal notranslate"><span class="pre">dfl</span></code> type (residual is

ignored) indicates the default, which uses a file2 replay cache in

-a temporary directory. The default is <code class="docutils literal"><span class="pre">dfl:</span></code>.</dd>

-<dt><strong>KRB5RCACHETYPE</strong></dt>

-<dd>Specifies the type of the default replay cache, if

+a temporary directory. The default is <code class="docutils literal notranslate"><span class="pre">dfl:</span></code>.</p>

+</dd>

+<dt><strong>KRB5RCACHETYPE</strong></dt><dd><p>Specifies the type of the default replay cache, if

<strong>KRB5RCACHENAME</strong> is unspecified. No residual can be specified,

-so <code class="docutils literal"><span class="pre">none</span></code> and <code class="docutils literal"><span class="pre">dfl</span></code> are the only useful types.</dd>

-<dt><strong>KRB5RCACHEDIR</strong></dt>

-<dd>Specifies the directory used by the <code class="docutils literal"><span class="pre">dfl</span></code> replay cache type.

+so <code class="docutils literal notranslate"><span class="pre">none</span></code> and <code class="docutils literal notranslate"><span class="pre">dfl</span></code> are the only useful types.</p>

+</dd>

+<dt><strong>KRB5RCACHEDIR</strong></dt><dd><p>Specifies the directory used by the <code class="docutils literal notranslate"><span class="pre">dfl</span></code> replay cache type.

The default is the value of the <strong>TMPDIR</strong> environment variable,

-or <code class="docutils literal"><span class="pre">/var/tmp</span></code> if <strong>TMPDIR</strong> is not set.</dd>

-<dt><strong>KRB5_TRACE</strong></dt>

-<dd>Specifies a filename to write trace log output to. Trace logs can

+or <code class="docutils literal notranslate"><span class="pre">/var/tmp</span></code> if <strong>TMPDIR</strong> is not set.</p>

+</dd>

+<dt><strong>KRB5_TRACE</strong></dt><dd><p>Specifies a filename to write trace log output to. Trace logs can

help illuminate decisions made internally by the Kerberos

-libraries. For example, <code class="docutils literal"><span class="pre">env</span> <span class="pre">KRB5_TRACE=/dev/stderr</span> <span class="pre">kinit</span></code>

+libraries. For example, <code class="docutils literal notranslate"><span class="pre">env</span> <span class="pre">KRB5_TRACE=/dev/stderr</span> <span class="pre">kinit</span></code>

would send tracing information for <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> to

-<code class="docutils literal"><span class="pre">/dev/stderr</span></code>. The default is not to write trace log output

-anywhere.</dd>

-<dt><strong>KRB5_CLIENT_KTNAME</strong></dt>

-<dd>Default client keytab file name. If unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCKTNAME</span></a> will be

-used).</dd>

-<dt><strong>KPROP_PORT</strong></dt>

-<dd><a class="reference internal" href="../../admin/admin_commands/kprop.html#kprop-8"><span class="std std-ref">kprop</span></a> port to use. Defaults to 754.</dd>

-<dt><strong>GSS_MECH_CONFIG</strong></dt>

-<dd>Specifies a filename containing GSSAPI mechanism module

-configuration. The default is to read <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech</span></code>

-and files with a <code class="docutils literal"><span class="pre">.conf</span></code> suffix within the directory

-<a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech.d</span></code>.</dd>

+<code class="docutils literal notranslate"><span class="pre">/dev/stderr</span></code>. The default is not to write trace log output

+anywhere.</p>

+</dd>

+<dt><strong>KRB5_CLIENT_KTNAME</strong></dt><dd><p>Default client keytab file name. If unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCKTNAME</span></a> will be

+used).</p>

+</dd>

+<dt><strong>KPROP_PORT</strong></dt><dd><p><a class="reference internal" href="../../admin/admin_commands/kprop.html#kprop-8"><span class="std std-ref">kprop</span></a> port to use. Defaults to 754.</p>

+</dd>

+<dt><strong>GSS_MECH_CONFIG</strong></dt><dd><p>Specifies a filename containing GSSAPI mechanism module

+configuration. The default is to read <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/gss/mech</span></code>

+and files with a <code class="docutils literal notranslate"><span class="pre">.conf</span></code> suffix within the directory

+<a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/gss/mech.d</span></code>.</p>

+</dd>

</dl>

<p>Most environment variables are disabled for certain programs, such as

secure when run within an untrusted process environment.</p>

-</div>

-<div class="section" id="see-also">

+</section>

+<section id="see-also">

<p><a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="../user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a>,

<a class="reference internal" href="../user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a>, <a class="reference internal" href="../user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>, <a class="reference internal" href="../user_commands/ksu.html#ksu-1"><span class="std std-ref">ksu</span></a>,

<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>, <a class="reference internal" href="../../admin/conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>, <a class="reference internal" href="../../admin/admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>,

<a class="reference internal" href="../../admin/admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, <a class="reference internal" href="../../admin/admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a>, <a class="reference internal" href="../../admin/admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a></p>

-</div>

-<div class="section" id="bugs">

+</section>

+<section id="bugs">

-</div>

-<div class="section" id="authors">

+</section>

+<section id="authors">

<h2>AUTHORS<a class="headerlink" href="#authors" title="Permalink to this headline">¶</a></h2>

<div class="line">Steve Miller, MIT Project Athena/Digital Equipment Corporation</div>

@@ -209,26 +199,28 @@ secure when run within an untrusted process environment.</p>

<div class="line">Greg Hudson, MIT Kerberos Consortium</div>

<div class="line">Robbie Harwood, Red Hat, Inc.</div>

</div>

-</div>

-<div class="section" id="history">

+</section>

+<section id="history">

<h2>HISTORY<a class="headerlink" href="#history" title="Permalink to this headline">¶</a></h2>

<p>The MIT Kerberos 5 implementation was developed at MIT, with

contributions from many outside parties. It is currently maintained

by the MIT Kerberos Consortium.</p>

-</div>

-<div class="section" id="restrictions">

+</section>

+<section id="restrictions">

<h2>RESTRICTIONS<a class="headerlink" href="#restrictions" title="Permalink to this headline">¶</a></h2>

Institute of Technology</p>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">kerberos</a><ul>

@@ -279,6 +271,7 @@ Institute of Technology</p>

</form>

</div>

</div>

@@ -286,8 +279,8 @@ Institute of Technology</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

</div>