krb5: Import MIT 1.21.3 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2025-03-19 22:12:25 +0000
commit	8f7d3ef26dec89a92ec0665de84a5936310a5574 (patch)
tree	9a465418bd4056bf0d369751320a414eaed29fa4 /doc/html/user/user_config
parent	1a79b20663ca26acc2998b90ea2ff2aefd8af5b1 (diff)

Diffstat (limited to 'doc/html/user/user_config')

-rw-r--r--

doc/html/user/user_config/index.html

-rw-r--r--

doc/html/user/user_config/k5identity.html

-rw-r--r--

doc/html/user/user_config/k5login.html

-rw-r--r--

doc/html/user/user_config/kerberos.html

173

4 files changed, 185 insertions, 210 deletions

diff --git a/doc/html/user/user_config/index.html b/doc/html/user/user_config/index.html
index 6b4470000f73..4154d2de8adc 100644
--- a/doc/html/user/user_config/index.html
+++ b/doc/html/user/user_config/index.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>User config files — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,7 +52,7 @@

- <div class="section" id="user-config-files">

+ <section id="user-config-files">

<h1>User config files<a class="headerlink" href="#user-config-files" title="Permalink to this headline">¶</a></h1>

<p>The following files in your home directory can be used to control the

behavior of Kerberos as it applies to your account (unless they have

@@ -73,14 +64,16 @@ been disabled by your host’s configuration):</p>

<li class="toctree-l1"><a class="reference internal" href="k5identity.html">.k5identity</a></li>

</ul>

</div>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">User config files</a></li>

@@ -122,6 +115,7 @@ been disabled by your host’s configuration):</p>

</form>

</div>

</div>

@@ -129,8 +123,8 @@ been disabled by your host’s configuration):</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2024, MIT.

</div>

diff --git a/doc/html/user/user_config/k5identity.html b/doc/html/user/user_config/k5identity.html
index 717897cb6921..e4ebf6b19741 100644
--- a/doc/html/user/user_config/k5identity.html
+++ b/doc/html/user/user_config/k5identity.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>.k5identity — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,69 +52,71 @@

- <div class="section" id="k5identity">

+ <section id="k5identity">

<span id="k5identity-5"></span><h1>.k5identity<a class="headerlink" href="#k5identity" title="Permalink to this headline">¶</a></h1>

-<div class="section" id="description">

+<section id="description">

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

<p>The .k5identity file, which resides in a user’s home directory,

contains a list of rules for selecting a client principals based on

the server being accessed. These rules are used to choose a

credential cache within the cache collection when possible.</p>

-<p>Blank lines and lines beginning with <code class="docutils literal"><span class="pre">#</span></code> are ignored. Each line has

+<p>Blank lines and lines beginning with <code class="docutils literal notranslate"><span class="pre">#</span></code> are ignored. Each line has

the form:</p>

-<div><em>principal</em> <em>field</em>=<em>value</em> …</div></blockquote>

+<div><p><em>principal</em> <em>field</em>=<em>value</em> …</p>

+</div></blockquote>

<p>If the server principal meets all of the field constraints, then

principal is chosen as the client principal. The following fields are

recognized:</p>

-<dl class="docutils">

-<dt><strong>realm</strong></dt>

-<dd>If the realm of the server principal is known, it is matched

+<dl>

+<dt><strong>realm</strong></dt><dd><p>If the realm of the server principal is known, it is matched

against <em>value</em>, which may be a pattern using shell wildcards.

For host-based server principals, the realm will generally only be

known if there is a <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#domain-realm"><span class="std std-ref">[domain_realm]</span></a> section in

-<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> with a mapping for the hostname.</dd>

-<dt><strong>service</strong></dt>

-<dd>If the server principal is a host-based principal, its service

+<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> with a mapping for the hostname.</p>

+</dd>

+<dt><strong>service</strong></dt><dd><p>If the server principal is a host-based principal, its service

component is matched against <em>value</em>, which may be a pattern using

-shell wildcards.</dd>

-<dt><strong>host</strong></dt>

-<dd><p class="first">If the server principal is a host-based principal, its hostname

+shell wildcards.</p>

+</dd>

+<dt><strong>host</strong></dt><dd><p>If the server principal is a host-based principal, its hostname

component is converted to lower case and matched against <em>value</em>,

which may be a pattern using shell wildcards.</p>

-<p class="last">If the server principal matches the constraints of multiple lines

+<p>If the server principal matches the constraints of multiple lines

in the .k5identity file, the principal from the first matching

line is used. If no line matches, credentials will be selected

some other way, such as the realm heuristic or the current primary

cache.</p>

</dd>

</dl>

-</div>

-<div class="section" id="example">

+</section>

+<section id="example">

<h2>EXAMPLE<a class="headerlink" href="#example" title="Permalink to this headline">¶</a></h2>

<p>The following example .k5identity file selects the client principal

-<code class="docutils literal"><span class="pre">alice@KRBTEST.COM</span></code> if the server principal is within that realm,

-the principal <code class="docutils literal"><span class="pre">alice/root@EXAMPLE.COM</span></code> if the server host is within

-a servers subdomain, and the principal <code class="docutils literal"><span class="pre">alice/mail@EXAMPLE.COM</span></code> when

-accessing the IMAP service on <code class="docutils literal"><span class="pre">mail.example.com</span></code>:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@KRBTEST</span><span class="o">.</span><span class="n">COM</span> <span class="n">realm</span><span class="o">=</span><span class="n">KRBTEST</span><span class="o">.</span><span class="n">COM</span>

+<code class="docutils literal notranslate"><span class="pre">alice@KRBTEST.COM</span></code> if the server principal is within that realm,

+the principal <code class="docutils literal notranslate"><span class="pre">alice/root@EXAMPLE.COM</span></code> if the server host is within

+a servers subdomain, and the principal <code class="docutils literal notranslate"><span class="pre">alice/mail@EXAMPLE.COM</span></code> when

+accessing the IMAP service on <code class="docutils literal notranslate"><span class="pre">mail.example.com</span></code>:</p>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@KRBTEST</span><span class="o">.</span><span class="n">COM</span> <span class="n">realm</span><span class="o">=</span><span class="n">KRBTEST</span><span class="o">.</span><span class="n">COM</span>

<span class="n">alice</span><span class="o">/</span><span class="n">root</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span> <span class="n">host</span><span class="o">=*.</span><span class="n">servers</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span>

<span class="n">alice</span><span class="o">/</span><span class="n">mail</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span> <span class="n">host</span><span class="o">=</span><span class="n">mail</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span> <span class="n">service</span><span class="o">=</span><span class="n">imap</span>

</pre></div>

</div>

-</div>

-<div class="section" id="see-also">

+</section>

+<section id="see-also">

<p>kerberos(1), <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a></p>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">.k5identity</a><ul>

@@ -170,6 +163,7 @@ accessing the IMAP service on <code class="docutils literal"><span class="pre">m

</form>

</div>

</div>

@@ -177,8 +171,8 @@ accessing the IMAP service on <code class="docutils literal"><span class="pre">m

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2024, MIT.

</div>

diff --git a/doc/html/user/user_config/k5login.html b/doc/html/user/user_config/k5login.html
index 348602ea8579..97afc40cedd6 100644
--- a/doc/html/user/user_config/k5login.html
+++ b/doc/html/user/user_config/k5login.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>.k5login — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,9 +52,9 @@

- <div class="section" id="k5login">

+ <section id="k5login">

<span id="k5login-5"></span><h1>.k5login<a class="headerlink" href="#k5login" title="Permalink to this headline">¶</a></h1>

-<div class="section" id="description">

+<section id="description">

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

<p>The .k5login file, which resides in a user’s home directory, contains

a list of the Kerberos principals. Anyone with valid tickets for a

@@ -71,50 +62,52 @@ principal in the file is allowed host access with the UID of the user

in whose home directory the file resides. One common use is to place

a .k5login file in root’s home directory, thereby granting system

administrators remote root access to the host via Kerberos.</p>

-</div>

-<div class="section" id="examples">

+</section>

+<section id="examples">

<h2>EXAMPLES<a class="headerlink" href="#examples" title="Permalink to this headline">¶</a></h2>

-<p>Suppose the user <code class="docutils literal"><span class="pre">alice</span></code> had a .k5login file in her home directory

+<p>Suppose the user <code class="docutils literal notranslate"><span class="pre">alice</span></code> had a .k5login file in her home directory

containing just the following line:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">bob</span><span class="nd">@FOOBAR</span><span class="o">.</span><span class="n">ORG</span>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">bob</span><span class="nd">@FOOBAR</span><span class="o">.</span><span class="n">ORG</span>

</pre></div>

</div>

-<p>This would allow <code class="docutils literal"><span class="pre">bob</span></code> to use Kerberos network applications, such as

-ssh(1), to access <code class="docutils literal"><span class="pre">alice</span></code>’s account, using <code class="docutils literal"><span class="pre">bob</span></code>’s Kerberos

+<p>This would allow <code class="docutils literal notranslate"><span class="pre">bob</span></code> to use Kerberos network applications, such as

+ssh(1), to access <code class="docutils literal notranslate"><span class="pre">alice</span></code>’s account, using <code class="docutils literal notranslate"><span class="pre">bob</span></code>’s Kerberos

tickets. In a default configuration (with <strong>k5login_authoritative</strong> set

to true in <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>), this .k5login file would not let

-<code class="docutils literal"><span class="pre">alice</span></code> use those network applications to access her account, since

+<code class="docutils literal notranslate"><span class="pre">alice</span></code> use those network applications to access her account, since

she is not listed! With no .k5login file, or with <strong>k5login_authoritative</strong>

-set to false, a default rule would permit the principal <code class="docutils literal"><span class="pre">alice</span></code> in the

-machine’s default realm to access the <code class="docutils literal"><span class="pre">alice</span></code> account.</p>

-<p>Let us further suppose that <code class="docutils literal"><span class="pre">alice</span></code> is a system administrator.

+set to false, a default rule would permit the principal <code class="docutils literal notranslate"><span class="pre">alice</span></code> in the

+machine’s default realm to access the <code class="docutils literal notranslate"><span class="pre">alice</span></code> account.</p>

+<p>Let us further suppose that <code class="docutils literal notranslate"><span class="pre">alice</span></code> is a system administrator.

Alice and the other system administrators would have their principals

in root’s .k5login file on each host:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

<span class="n">joeadmin</span><span class="o">/</span><span class="n">root</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

</pre></div>

</div>

<p>This would allow either system administrator to log in to these hosts

using their Kerberos tickets instead of having to type the root

-password. Note that because <code class="docutils literal"><span class="pre">bob</span></code> retains the Kerberos tickets for

-his own principal, <code class="docutils literal"><span class="pre">bob@FOOBAR.ORG</span></code>, he would not have any of the

-privileges that require <code class="docutils literal"><span class="pre">alice</span></code>’s tickets, such as root access to

-any of the site’s hosts, or the ability to change <code class="docutils literal"><span class="pre">alice</span></code>’s

+password. Note that because <code class="docutils literal notranslate"><span class="pre">bob</span></code> retains the Kerberos tickets for

+his own principal, <code class="docutils literal notranslate"><span class="pre">bob@FOOBAR.ORG</span></code>, he would not have any of the

+privileges that require <code class="docutils literal notranslate"><span class="pre">alice</span></code>’s tickets, such as root access to

+any of the site’s hosts, or the ability to change <code class="docutils literal notranslate"><span class="pre">alice</span></code>’s

password.</p>

-</div>

-<div class="section" id="see-also">

+</section>

+<section id="see-also">

<p>kerberos(1)</p>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">.k5login</a><ul>

@@ -161,6 +154,7 @@ password.</p>

</form>

</div>

</div>

@@ -168,8 +162,8 @@ password.</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2024, MIT.

</div>

diff --git a/doc/html/user/user_config/kerberos.html b/doc/html/user/user_config/kerberos.html
index ac625d8d03cc..fcc718c8ddd6 100644
--- a/doc/html/user/user_config/kerberos.html
+++ b/doc/html/user/user_config/kerberos.html

@@ -1,35 +1,26 @@

-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

- "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<!DOCTYPE html>

-<html xmlns="http://www.w3.org/1999/xhtml">

+<html>

<head>

- <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <meta charset="utf-8" />

+ <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />

<title>kerberos — MIT Kerberos Documentation</title>

- <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

- <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

- <script type="text/javascript">

- var DOCUMENTATION_OPTIONS = {

- URL_ROOT: '../../',

- VERSION: '1.21.2',

- COLLAPSE_INDEX: false,

- FILE_SUFFIX: '.html',

- HAS_SOURCE: true,

- SOURCELINK_SUFFIX: '.txt'

- };

- </script>

- <script type="text/javascript" src="../../_static/jquery.js"></script>

- <script type="text/javascript" src="../../_static/underscore.js"></script>

- <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="stylesheet" type="text/css" href="../../_static/pygments.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/agogo.css" />

+ <link rel="stylesheet" type="text/css" href="../../_static/kerb.css" />

+ <script data-url_root="../../" id="documentation_options" src="../../_static/documentation_options.js"></script>

+ <script src="../../_static/jquery.js"></script>

+ <script src="../../_static/underscore.js"></script>

+ <script src="../../_static/doctools.js"></script>

- </head>

- <body>

+ </head><body>

@@ -61,9 +52,9 @@

- <div class="section" id="kerberos">

+ <section id="kerberos">

<span id="kerberos-7"></span><h1>kerberos<a class="headerlink" href="#kerberos" title="Permalink to this headline">¶</a></h1>

-<div class="section" id="description">

+<section id="description">

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

<p>The Kerberos system authenticates individual users in a network

environment. After authenticating yourself to Kerberos, you can use

@@ -77,8 +68,8 @@ administrator.</p>

<p>A Kerberos name usually contains three parts. The first is the

<strong>primary</strong>, which is usually a user’s or service’s name. The second

is the <strong>instance</strong>, which in the case of a user is usually null.

-Some users may have privileged instances, however, such as <code class="docutils literal"><span class="pre">root</span></code> or

-<code class="docutils literal"><span class="pre">admin</span></code>. In the case of a service, the instance is the fully

+Some users may have privileged instances, however, such as <code class="docutils literal notranslate"><span class="pre">root</span></code> or

+<code class="docutils literal notranslate"><span class="pre">admin</span></code>. In the case of a service, the instance is the fully

qualified name of the machine on which it runs; i.e. there can be an

ssh service running on the machine ABC (<a class="reference external" href="mailto:ssh/ABC%40REALM">ssh/ABC<span>@</span>REALM</a>), which is

different from the ssh service running on the machine XYZ

@@ -91,7 +82,7 @@ might be in realm EXAMPLE.COM).</p>

instance (if not null) by a slash, and the realm (if not the local

realm) follows, preceded by an “@” sign. The following are examples

of valid Kerberos names:</p>

-<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">david</span>

+<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">david</span>

<span class="n">jennifer</span><span class="o">/</span><span class="n">admin</span>

<span class="n">joeuser</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

<span class="n">cbrown</span><span class="o">/</span><span class="n">root</span><span class="nd">@FUBAR</span><span class="o">.</span><span class="n">ORG</span>

@@ -103,14 +94,14 @@ message that provides authentication.) Kerberos uses this ticket for

network utilities such as ssh. The ticket transactions are done

transparently, so you don’t have to worry about their management.</p>

<p>Note, however, that tickets expire. Administrators may configure more

-privileged tickets, such as those with service or instance of <code class="docutils literal"><span class="pre">root</span></code>

-or <code class="docutils literal"><span class="pre">admin</span></code>, to expire in a few minutes, while tickets that carry

+privileged tickets, such as those with service or instance of <code class="docutils literal notranslate"><span class="pre">root</span></code>

+or <code class="docutils literal notranslate"><span class="pre">admin</span></code>, to expire in a few minutes, while tickets that carry

more ordinary privileges may be good for several hours or a day. If

your login session extends beyond the time limit, you will have to

re-authenticate yourself to Kerberos to get new tickets using the

<a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> command.</p>

<p>Some tickets are <strong>renewable</strong> beyond their initial lifetime. This

-means that <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-R</span></code> can extend their lifetime without requiring

+means that <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-R</span></code> can extend their lifetime without requiring

you to re-authenticate.</p>

<p>If you wish to delete your local tickets, use the <a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>

command.</p>

@@ -121,87 +112,86 @@ to forward them to the remote host. This can be useful for, e.g.,

running kinit on your local machine and then sshing into another to do

work. Note that this should not be done on untrusted machines since

they will then have your tickets.</p>

-</div>

-<div class="section" id="environment-variables">

+</section>

+<section id="environment-variables">

<h2>ENVIRONMENT VARIABLES<a class="headerlink" href="#environment-variables" title="Permalink to this headline">¶</a></h2>

<p>Several environment variables affect the operation of Kerberos-enabled

programs. These include:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd><p class="first">Default name for the credentials cache file, in the form

+<dl>

+<dt><strong>KRB5CCNAME</strong></dt><dd><p>Default name for the credentials cache file, in the form

<em>TYPE</em>:<em>residual</em>. The type of the default cache may determine

-the availability of a cache collection. <code class="docutils literal"><span class="pre">FILE</span></code> is not a

-collection type; <code class="docutils literal"><span class="pre">KEYRING</span></code>, <code class="docutils literal"><span class="pre">DIR</span></code>, and <code class="docutils literal"><span class="pre">KCM</span></code> are.</p>

-<p class="last">If not set, the value of <strong>default_ccache_name</strong> from

+the availability of a cache collection. <code class="docutils literal notranslate"><span class="pre">FILE</span></code> is not a

+collection type; <code class="docutils literal notranslate"><span class="pre">KEYRING</span></code>, <code class="docutils literal notranslate"><span class="pre">DIR</span></code>, and <code class="docutils literal notranslate"><span class="pre">KCM</span></code> are.</p>

+<p>If not set, the value of <strong>default_ccache_name</strong> from

configuration files (see <strong>KRB5_CONFIG</strong>) will be used. If that

-is also not set, the default <em>type</em> is <code class="docutils literal"><span class="pre">FILE</span></code>, and the

+is also not set, the default <em>type</em> is <code class="docutils literal notranslate"><span class="pre">FILE</span></code>, and the

<em>residual</em> is the path /tmp/krb5cc_*uid*, where <em>uid</em> is the

decimal user ID of the user.</p>

</dd>

-<dt><strong>KRB5_KTNAME</strong></dt>

-<dd>Specifies the location of the default keytab file, in the form

+<dt><strong>KRB5_KTNAME</strong></dt><dd><p>Specifies the location of the default keytab file, in the form

<em>TYPE</em>:<em>residual</em>. If no <em>type</em> is present, the <strong>FILE</strong> type is

assumed and <em>residual</em> is the pathname of the keytab file. If

-unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a> will be used.</dd>

-<dt><strong>KRB5_CONFIG</strong></dt>

-<dd>Specifies the location of the Kerberos configuration file. The

-default is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/krb5.conf</span></code>. Multiple filenames can

+unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a> will be used.</p>

+</dd>

+<dt><strong>KRB5_CONFIG</strong></dt><dd><p>Specifies the location of the Kerberos configuration file. The

+default is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/krb5.conf</span></code>. Multiple filenames can

be specified, separated by a colon; all files which are present

-will be read.</dd>

-<dt><strong>KRB5_KDC_PROFILE</strong></dt>

-<dd>Specifies the location of the KDC configuration file, which

+will be read.</p>

+</dd>

+<dt><strong>KRB5_KDC_PROFILE</strong></dt><dd><p>Specifies the location of the KDC configuration file, which

contains additional configuration directives for the Key

Distribution Center daemon and associated programs. The default

-is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal"><span class="pre">/krb5kdc</span></code><code class="docutils literal"><span class="pre">/kdc.conf</span></code>.</dd>

-<dt><strong>KRB5RCACHENAME</strong></dt>

-<dd>(New in release 1.18) Specifies the location of the default replay

-cache, in the form <em>type</em>:<em>residual</em>. The <code class="docutils literal"><span class="pre">file2</span></code> type with a

+is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal notranslate"><span class="pre">/krb5kdc</span></code><code class="docutils literal notranslate"><span class="pre">/kdc.conf</span></code>.</p>

+</dd>

+<dt><strong>KRB5RCACHENAME</strong></dt><dd><p>(New in release 1.18) Specifies the location of the default replay

+cache, in the form <em>type</em>:<em>residual</em>. The <code class="docutils literal notranslate"><span class="pre">file2</span></code> type with a

pathname residual specifies a replay cache file in the version-2

-format in the specified location. The <code class="docutils literal"><span class="pre">none</span></code> type (residual is

-ignored) disables the replay cache. The <code class="docutils literal"><span class="pre">dfl</span></code> type (residual is

+format in the specified location. The <code class="docutils literal notranslate"><span class="pre">none</span></code> type (residual is

+ignored) disables the replay cache. The <code class="docutils literal notranslate"><span class="pre">dfl</span></code> type (residual is

ignored) indicates the default, which uses a file2 replay cache in

-a temporary directory. The default is <code class="docutils literal"><span class="pre">dfl:</span></code>.</dd>

-<dt><strong>KRB5RCACHETYPE</strong></dt>

-<dd>Specifies the type of the default replay cache, if

+a temporary directory. The default is <code class="docutils literal notranslate"><span class="pre">dfl:</span></code>.</p>

+</dd>

+<dt><strong>KRB5RCACHETYPE</strong></dt><dd><p>Specifies the type of the default replay cache, if

<strong>KRB5RCACHENAME</strong> is unspecified. No residual can be specified,

-so <code class="docutils literal"><span class="pre">none</span></code> and <code class="docutils literal"><span class="pre">dfl</span></code> are the only useful types.</dd>

-<dt><strong>KRB5RCACHEDIR</strong></dt>

-<dd>Specifies the directory used by the <code class="docutils literal"><span class="pre">dfl</span></code> replay cache type.

+so <code class="docutils literal notranslate"><span class="pre">none</span></code> and <code class="docutils literal notranslate"><span class="pre">dfl</span></code> are the only useful types.</p>

+</dd>

+<dt><strong>KRB5RCACHEDIR</strong></dt><dd><p>Specifies the directory used by the <code class="docutils literal notranslate"><span class="pre">dfl</span></code> replay cache type.

The default is the value of the <strong>TMPDIR</strong> environment variable,

-or <code class="docutils literal"><span class="pre">/var/tmp</span></code> if <strong>TMPDIR</strong> is not set.</dd>

-<dt><strong>KRB5_TRACE</strong></dt>

-<dd>Specifies a filename to write trace log output to. Trace logs can

+or <code class="docutils literal notranslate"><span class="pre">/var/tmp</span></code> if <strong>TMPDIR</strong> is not set.</p>

+</dd>

+<dt><strong>KRB5_TRACE</strong></dt><dd><p>Specifies a filename to write trace log output to. Trace logs can

help illuminate decisions made internally by the Kerberos

-libraries. For example, <code class="docutils literal"><span class="pre">env</span> <span class="pre">KRB5_TRACE=/dev/stderr</span> <span class="pre">kinit</span></code>

+libraries. For example, <code class="docutils literal notranslate"><span class="pre">env</span> <span class="pre">KRB5_TRACE=/dev/stderr</span> <span class="pre">kinit</span></code>

would send tracing information for <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> to

-<code class="docutils literal"><span class="pre">/dev/stderr</span></code>. The default is not to write trace log output

-anywhere.</dd>

-<dt><strong>KRB5_CLIENT_KTNAME</strong></dt>

-<dd>Default client keytab file name. If unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCKTNAME</span></a> will be

-used).</dd>

-<dt><strong>KPROP_PORT</strong></dt>

-<dd><a class="reference internal" href="../../admin/admin_commands/kprop.html#kprop-8"><span class="std std-ref">kprop</span></a> port to use. Defaults to 754.</dd>

-<dt><strong>GSS_MECH_CONFIG</strong></dt>

-<dd>Specifies a filename containing GSSAPI mechanism module

-configuration. The default is to read <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech</span></code>

-and files with a <code class="docutils literal"><span class="pre">.conf</span></code> suffix within the directory

-<a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech.d</span></code>.</dd>

+<code class="docutils literal notranslate"><span class="pre">/dev/stderr</span></code>. The default is not to write trace log output

+anywhere.</p>

+</dd>

+<dt><strong>KRB5_CLIENT_KTNAME</strong></dt><dd><p>Default client keytab file name. If unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCKTNAME</span></a> will be

+used).</p>

+</dd>

+<dt><strong>KPROP_PORT</strong></dt><dd><p><a class="reference internal" href="../../admin/admin_commands/kprop.html#kprop-8"><span class="std std-ref">kprop</span></a> port to use. Defaults to 754.</p>

+</dd>

+<dt><strong>GSS_MECH_CONFIG</strong></dt><dd><p>Specifies a filename containing GSSAPI mechanism module

+configuration. The default is to read <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/gss/mech</span></code>

+and files with a <code class="docutils literal notranslate"><span class="pre">.conf</span></code> suffix within the directory

+<a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal notranslate"><span class="pre">/gss/mech.d</span></code>.</p>

+</dd>

</dl>

<p>Most environment variables are disabled for certain programs, such as

secure when run within an untrusted process environment.</p>

-</div>

-<div class="section" id="see-also">

+</section>

+<section id="see-also">

<p><a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="../user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a>,

<a class="reference internal" href="../user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a>, <a class="reference internal" href="../user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>, <a class="reference internal" href="../user_commands/ksu.html#ksu-1"><span class="std std-ref">ksu</span></a>,

<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>, <a class="reference internal" href="../../admin/conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>, <a class="reference internal" href="../../admin/admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>,

<a class="reference internal" href="../../admin/admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, <a class="reference internal" href="../../admin/admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a>, <a class="reference internal" href="../../admin/admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a></p>

-</div>

-<div class="section" id="bugs">

+</section>

+<section id="bugs">

-</div>

-<div class="section" id="authors">

+</section>

+<section id="authors">

<h2>AUTHORS<a class="headerlink" href="#authors" title="Permalink to this headline">¶</a></h2>

<div class="line">Steve Miller, MIT Project Athena/Digital Equipment Corporation</div>

@@ -209,26 +199,28 @@ secure when run within an untrusted process environment.</p>

<div class="line">Greg Hudson, MIT Kerberos Consortium</div>

<div class="line">Robbie Harwood, Red Hat, Inc.</div>

</div>

-</div>

-<div class="section" id="history">

+</section>

+<section id="history">

<h2>HISTORY<a class="headerlink" href="#history" title="Permalink to this headline">¶</a></h2>

<p>The MIT Kerberos 5 implementation was developed at MIT, with

contributions from many outside parties. It is currently maintained

by the MIT Kerberos Consortium.</p>

-</div>

-<div class="section" id="restrictions">

+</section>

+<section id="restrictions">

<h2>RESTRICTIONS<a class="headerlink" href="#restrictions" title="Permalink to this headline">¶</a></h2>

Institute of Technology</p>

-</div>

+</section>

+ <div class="clearer"></div>

</div>

<ul>

<li><a class="reference internal" href="#">kerberos</a><ul>

@@ -279,6 +271,7 @@ Institute of Technology</p>

</form>

</div>

</div>

@@ -286,8 +279,8 @@ Institute of Technology</p>

- <div class="right" ><i>Release: 1.21.2</i><br />

+ <div class="right" ><i>Release: 1.21.3</i><br />

</div>