krb5: Update to 1.21.1 - src - FreeBSD source tree

diff options


context:
space:
mode:

author	Cy Schubert <cy@FreeBSD.org>	2023-08-04 17:53:10 +0000
committer	Cy Schubert <cy@FreeBSD.org>	2023-08-04 17:53:10 +0000
commit	0320e0d5bb9fbb5da53478b3fd80ad79b110191d (patch)
tree	e1185f75bd2d3f87b0c17f787debc3ee8648214b /doc/html/user
parent	b0e4d68d5124581ae353493d69bea352de4cff8a (diff)

vendor/krb5/1.21.1

Diffstat (limited to 'doc/html/user')

-rw-r--r--

doc/html/user/index.html

-rw-r--r--

doc/html/user/pwd_mgmt.html

-rw-r--r--

doc/html/user/tkt_mgmt.html

212

-rw-r--r--

doc/html/user/user_commands/index.html

-rw-r--r--

doc/html/user/user_commands/kdestroy.html

-rw-r--r--

doc/html/user/user_commands/kinit.html

-rw-r--r--

doc/html/user/user_commands/klist.html

-rw-r--r--

doc/html/user/user_commands/kpasswd.html

-rw-r--r--

doc/html/user/user_commands/krb5-config.html

-rw-r--r--

doc/html/user/user_commands/ksu.html

162

-rw-r--r--

doc/html/user/user_commands/kswitch.html

-rw-r--r--

doc/html/user/user_commands/kvno.html

-rw-r--r--

doc/html/user/user_commands/sclient.html

-rw-r--r--

doc/html/user/user_config/index.html

-rw-r--r--

doc/html/user/user_config/k5identity.html

-rw-r--r--

doc/html/user/user_config/k5login.html

-rw-r--r--

doc/html/user/user_config/kerberos.html

310

17 files changed, 872 insertions, 548 deletions

diff --git a/doc/html/user/index.html b/doc/html/user/index.html
index 9f3731a10d39..7caf0bf016e3 100644
--- a/doc/html/user/index.html
+++ b/doc/html/user/index.html

@@ -1,34 +1,33 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>For users — MIT Kerberos Documentation</title>

+ <title>For users — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../genindex.html" />

+ <link rel="search" title="Search" href="../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../index.html" />

- <link rel="prev" title="MIT Kerberos Documentation (1.16)" href="../index.html" />

+ <link rel="prev" title="MIT Kerberos Documentation (1.21.1)" href="../index.html" />

</head>

<body>

@@ -41,7 +40,7 @@

<a href="../index.html" title="Full Table of Contents"

accesskey="C">Contents</a> |

- <a href="../index.html" title="MIT Kerberos Documentation (1.16)"

+ <a href="../index.html" title="MIT Kerberos Documentation (1.21.1)"

accesskey="P">previous</a> |

<a href="pwd_mgmt.html" title="Password management"

accesskey="N">next</a> |

@@ -60,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<h1>For users<a class="headerlink" href="#for-users" title="Permalink to this headline">¶</a></h1>

@@ -80,6 +79,7 @@

</ul>

</li>

<li class="toctree-l1"><a class="reference internal" href="user_config/index.html">User config files</a><ul>

+<li class="toctree-l2"><a class="reference internal" href="user_config/kerberos.html">kerberos</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_config/k5login.html">.k5login</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_config/k5identity.html">.k5identity</a></li>

</ul>

@@ -114,7 +114,7 @@

<br/>

<h2>Table of contents</h2>

-<li class="toctree-l1 current"><a class="current reference internal" href="">For users</a><ul>

+<li class="toctree-l1 current"><a class="current reference internal" href="#">For users</a><ul>

<li class="toctree-l2"><a class="reference internal" href="pwd_mgmt.html">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_config/index.html">User config files</a></li>

@@ -149,14 +149,14 @@

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

<a href="../index.html" title="Full Table of Contents"

>Contents</a> |

- <a href="../index.html" title="MIT Kerberos Documentation (1.16)"

+ <a href="../index.html" title="MIT Kerberos Documentation (1.21.1)"

>previous</a> |

<a href="pwd_mgmt.html" title="Password management"

>next</a> |

diff --git a/doc/html/user/pwd_mgmt.html b/doc/html/user/pwd_mgmt.html
index 5eb6d0942c1b..d58752d881a4 100644
--- a/doc/html/user/pwd_mgmt.html
+++ b/doc/html/user/pwd_mgmt.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>Password management — MIT Kerberos Documentation</title>

+ <title>Password management — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../genindex.html" />

+ <link rel="search" title="Search" href="../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../index.html" />

- <link rel="up" title="For users" href="index.html" />

</head>

@@ -61,75 +59,75 @@

- <div class="body">

+ <div class="body" role="main">

<h1>Password management<a class="headerlink" href="#password-management" title="Permalink to this headline">¶</a></h1>

<p>Your password is the only way Kerberos has of verifying your identity.

If someone finds out your password, that person can masquerade as

-you—send email that comes from you, read, edit, or delete your files,

-or log into other hosts as you—and no one will be able to tell the

+you—send email that comes from you, read, edit, or delete your files,

+or log into other hosts as you—and no one will be able to tell the

difference. For this reason, it is important that you choose a good

password, and keep it secret. If you need to give access to your

account to someone else, you can do so through Kerberos (see

-<a class="reference internal" href="#grant-access"><em>Granting access to your account</em></a>). You should never tell your password to anyone,

+<a class="reference internal" href="#grant-access"><span class="std std-ref">Granting access to your account</span></a>). You should never tell your password to anyone,

including your system administrator, for any reason. You should

change your password frequently, particularly any time you think

someone may have found out what it is.</p>

<h2>Changing your password<a class="headerlink" href="#changing-your-password" title="Permalink to this headline">¶</a></h2>

-<p>To change your Kerberos password, use the <a class="reference internal" href="user_commands/kpasswd.html#kpasswd-1"><em>kpasswd</em></a> command.

+<p>To change your Kerberos password, use the <a class="reference internal" href="user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a> command.

It will ask you for your old password (to prevent someone else from

-walking up to your computer when you’re not there and changing your

+walking up to your computer when you’re not there and changing your

password), and then prompt you for the new one twice. (The reason you

have to type it twice is to make sure you have typed it correctly.)

-For example, user <tt class="docutils literal"><span class="pre">david</span></tt> would do the following:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kpasswd

-Password for david: <- Type your old password.

-Enter new password: <- Type your new password.

-Enter it again: <- Type the new password again.

-Password changed.

-shell%

+For example, user <code class="docutils literal"><span class="pre">david</span></code> would do the following:</p>

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kpasswd</span>

+<span class="n">Password</span> <span class="k">for</span> <span class="n">david</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">your</span> <span class="n">old</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">Enter</span> <span class="n">new</span> <span class="n">password</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">your</span> <span class="n">new</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">Enter</span> <span class="n">it</span> <span class="n">again</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">the</span> <span class="n">new</span> <span class="n">password</span> <span class="n">again</span><span class="o">.</span>

+<span class="n">Password</span> <span class="n">changed</span><span class="o">.</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>If <tt class="docutils literal"><span class="pre">david</span></tt> typed the incorrect old password, he would get the

+<p>If <code class="docutils literal"><span class="pre">david</span></code> typed the incorrect old password, he would get the

following message:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kpasswd

-Password for david: <- Type the incorrect old password.

-kpasswd: Password incorrect while getting initial ticket

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kpasswd</span>

+<span class="n">Password</span> <span class="k">for</span> <span class="n">david</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">the</span> <span class="n">incorrect</span> <span class="n">old</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">kpasswd</span><span class="p">:</span> <span class="n">Password</span> <span class="n">incorrect</span> <span class="k">while</span> <span class="n">getting</span> <span class="n">initial</span> <span class="n">ticket</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>If you make a mistake and don’t type the new password the same way

+<p>If you make a mistake and don’t type the new password the same way

twice, kpasswd will ask you to try again:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kpasswd

-Password for david: <- Type the old password.

-Enter new password: <- Type the new password.

-Enter it again: <- Type a different new password.

-kpasswd: Password mismatch while reading password

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kpasswd</span>

+<span class="n">Password</span> <span class="k">for</span> <span class="n">david</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">the</span> <span class="n">old</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">Enter</span> <span class="n">new</span> <span class="n">password</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">the</span> <span class="n">new</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">Enter</span> <span class="n">it</span> <span class="n">again</span><span class="p">:</span> <span class="o"><-</span> <span class="n">Type</span> <span class="n">a</span> <span class="n">different</span> <span class="n">new</span> <span class="n">password</span><span class="o">.</span>

+<span class="n">kpasswd</span><span class="p">:</span> <span class="n">Password</span> <span class="n">mismatch</span> <span class="k">while</span> <span class="n">reading</span> <span class="n">password</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

<p>Once you change your password, it takes some time for the change to

propagate through the system. Depending on how your system is set up,

this might be anywhere from a few minutes to an hour or more. If you

need to get new Kerberos tickets shortly after changing your password,

-try the new password. If the new password doesn’t work, try again

+try the new password. If the new password doesn’t work, try again

using the old one.</p>

</div>

<span id="grant-access"></span><h2>Granting access to your account<a class="headerlink" href="#granting-access-to-your-account" title="Permalink to this headline">¶</a></h2>

<p>If you need to give someone access to log into your account, you can

do so through Kerberos, without telling the person your password.

-Simply create a file called <a class="reference internal" href="user_config/k5login.html#k5login-5"><em>.k5login</em></a> in your home directory.

+Simply create a file called <a class="reference internal" href="user_config/k5login.html#k5login-5"><span class="std std-ref">.k5login</span></a> in your home directory.

This file should contain the Kerberos principal of each person to whom

you wish to give access. Each principal must be on a separate line.

Here is a sample .k5login file:</p>

-<div class="highlight-python"><div class="highlight"><pre>jennifer@ATHENA.MIT.EDU

-david@EXAMPLE.COM

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

+<span class="n">david</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

</pre></div>

</div>

-<p>This file would allow the users <tt class="docutils literal"><span class="pre">jennifer</span></tt> and <tt class="docutils literal"><span class="pre">david</span></tt> to use your

+<p>This file would allow the users <code class="docutils literal"><span class="pre">jennifer</span></code> and <code class="docutils literal"><span class="pre">david</span></code> to use your

user ID, provided that they had Kerberos tickets in their respective

realms. If you will be logging into other hosts across a network, you

will want to include your own Kerberos principal in your .k5login file

@@ -146,7 +144,7 @@ NFS), that user does not inherit your network privileges.</li>

administrator could find out, if necessary, who was capable of using

your user ID at a particular time.</li>

</ul>

-<p>One common application is to have a .k5login file in root’s home

+<p>One common application is to have a .k5login file in root’s home

directory, giving root access to that machine to the Kerberos

principals listed. This allows system administrators to allow users

to become root locally, or to log in remotely as root, without their

@@ -179,9 +177,7 @@ type the root password over the network.</p>

<h2>Table of contents</h2>

<li class="toctree-l1 current"><a class="reference internal" href="index.html">For users</a><ul class="current">

-<li class="toctree-l2 current"><a class="current reference internal" href="">Password management</a><ul class="simple">

-</ul>

-</li>

+<li class="toctree-l2 current"><a class="current reference internal" href="#">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_config/index.html">User config files</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_commands/index.html">User commands</a></li>

@@ -215,8 +211,8 @@ type the root password over the network.</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/tkt_mgmt.html b/doc/html/user/tkt_mgmt.html
index b9edfb4905ea..2f97d76ea314 100644
--- a/doc/html/user/tkt_mgmt.html
+++ b/doc/html/user/tkt_mgmt.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>Ticket management — MIT Kerberos Documentation</title>

+ <title>Ticket management — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../genindex.html" />

+ <link rel="search" title="Search" href="../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../index.html" />

- <link rel="up" title="For users" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<h1>Ticket management<a class="headerlink" href="#ticket-management" title="Permalink to this headline">¶</a></h1>

@@ -71,7 +69,7 @@ can forward copies of your tickets to a remote host. Most of these

programs also automatically destroy your tickets when they exit.

However, MIT recommends that you explicitly destroy your Kerberos

tickets when you are through with them, just to be sure. One way to

-help ensure that this happens is to add the <a class="reference internal" href="user_commands/kdestroy.html#kdestroy-1"><em>kdestroy</em></a> command

+help ensure that this happens is to add the <a class="reference internal" href="user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a> command

to your .logout file. Additionally, if you are going to be away from

your machine and are concerned about an intruder using your

permissions, it is safest to either destroy all copies of your

@@ -109,7 +107,7 @@ ticket expires. The second is the latest possible expiration time for

any ticket issued based on this renewable ticket.</p>

<p>A ticket with the <strong>initial flag</strong> set was issued based on the

authentication protocol, and not on a ticket-granting ticket.

-Application servers that wish to ensure that the user’s key has been

+Application servers that wish to ensure that the user’s key has been

recently presented for verification could specify that this flag must

be set to accept the ticket.</p>

<p>An <strong>invalid</strong> ticket must be rejected by application servers.

@@ -143,61 +141,61 @@ to securely distribute a session key.</p>

<p>If your site has integrated Kerberos V5 with the login system, you

will get Kerberos tickets automatically when you log in. Otherwise,

you may need to explicitly obtain your Kerberos tickets, using the

-<a class="reference internal" href="user_commands/kinit.html#kinit-1"><em>kinit</em></a> program. Similarly, if your Kerberos tickets expire,

+<a class="reference internal" href="user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> program. Similarly, if your Kerberos tickets expire,

use the kinit program to obtain new ones.</p>

-<p>To use the kinit program, simply type <tt class="docutils literal"><span class="pre">kinit</span></tt> and then type your

+<p>To use the kinit program, simply type <code class="docutils literal"><span class="pre">kinit</span></code> and then type your

password at the prompt. For example, Jennifer (whose username is

-<tt class="docutils literal"><span class="pre">jennifer</span></tt>) works for Bleep, Inc. (a fictitious company with the

+<code class="docutils literal"><span class="pre">jennifer</span></code>) works for Bleep, Inc. (a fictitious company with the

domain name mit.edu and the Kerberos realm ATHENA.MIT.EDU). She would

type:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kinit

-Password for jennifer@ATHENA.MIT.EDU: <-- [Type jennifer's password here.]

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kinit</span>

+<span class="n">Password</span> <span class="k">for</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> <span class="o"><--</span> <span class="p">[</span><span class="n">Type</span> <span class="n">jennifer</span><span class="s1">'s password here.]</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

<p>If you type your password incorrectly, kinit will give you the

following error message:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kinit

-Password for jennifer@ATHENA.MIT.EDU: <-- [Type the wrong password here.]

-kinit: Password incorrect

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kinit</span>

+<span class="n">Password</span> <span class="k">for</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> <span class="o"><--</span> <span class="p">[</span><span class="n">Type</span> <span class="n">the</span> <span class="n">wrong</span> <span class="n">password</span> <span class="n">here</span><span class="o">.</span><span class="p">]</span>

+<span class="n">kinit</span><span class="p">:</span> <span class="n">Password</span> <span class="n">incorrect</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>and you won’t get Kerberos tickets.</p>

+<p>and you won’t get Kerberos tickets.</p>

<p>By default, kinit assumes you want tickets for your own username in

-your default realm. Suppose Jennifer’s friend David is visiting, and

+your default realm. Suppose Jennifer’s friend David is visiting, and

he wants to borrow a window to check his mail. David needs to get

tickets for himself in his own realm, EXAMPLE.COM. He would type:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kinit david@EXAMPLE.COM

-Password for david@EXAMPLE.COM: <-- [Type david's password here.]

-shell%

+<span class="n">Password</span> <span class="k">for</span> <span class="n">david</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="p">:</span> <span class="o"><--</span> <span class="p">[</span><span class="n">Type</span> <span class="n">david</span><span class="s1">'s password here.]</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

<p>David would then have tickets which he could use to log onto his own

-machine. Note that he typed his password locally on Jennifer’s

+machine. Note that he typed his password locally on Jennifer’s

machine, but it never went over the network. Kerberos on the local

host performed the authentication to the KDC in the other realm.</p>

<p>If you want to be able to forward your tickets to another host, you

need to request forwardable tickets. You do this by specifying the

<strong>-f</strong> option:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kinit -f

-Password for jennifer@ATHENA.MIT.EDU: <-- [Type your password here.]

-shell%

+<span class="n">Password</span> <span class="k">for</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="p">:</span> <span class="o"><--</span> <span class="p">[</span><span class="n">Type</span> <span class="n">your</span> <span class="n">password</span> <span class="n">here</span><span class="o">.</span><span class="p">]</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

<p>Note that kinit does not tell you that it obtained forwardable

-tickets; you can verify this using the <a class="reference internal" href="user_commands/klist.html#klist-1"><em>klist</em></a> command (see

-<a class="reference internal" href="#view-tkt"><em>Viewing tickets with klist</em></a>).</p>

-<p>Normally, your tickets are good for your system’s default ticket

+tickets; you can verify this using the <a class="reference internal" href="user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> command (see

+<a class="reference internal" href="#view-tkt"><span class="std std-ref">Viewing tickets with klist</span></a>).</p>

+<p>Normally, your tickets are good for your system’s default ticket

lifetime, which is ten hours on many systems. You can specify a

different ticket lifetime with the <strong>-l</strong> option. Add the letter

<strong>s</strong> to the value for seconds, <strong>m</strong> for minutes, <strong>h</strong> for hours, or

<strong>d</strong> for days. For example, to obtain forwardable tickets for

-<tt class="docutils literal"><span class="pre">david@EXAMPLE.COM</span></tt> that would be good for three hours, you would

+<code class="docutils literal"><span class="pre">david@EXAMPLE.COM</span></code> that would be good for three hours, you would

type:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kinit -f -l 3h david@EXAMPLE.COM

-Password for david@EXAMPLE.COM: <-- [Type david's password here.]

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kinit</span> <span class="o">-</span><span class="n">f</span> <span class="o">-</span><span class="n">l</span> <span class="mi">3</span><span class="n">h</span> <span class="n">david</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

@@ -211,67 +209,67 @@ lifetime.</p>

</div>

<span id="view-tkt"></span><h2>Viewing tickets with klist<a class="headerlink" href="#viewing-tickets-with-klist" title="Permalink to this headline">¶</a></h2>

-<p>The <a class="reference internal" href="user_commands/klist.html#klist-1"><em>klist</em></a> command shows your tickets. When you first obtain

+<p>The <a class="reference internal" href="user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a> command shows your tickets. When you first obtain

tickets, you will have only the ticket-granting ticket. The listing

would look like this:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% klist

-Ticket cache: /tmp/krb5cc_ttypa

-Default principal: jennifer@ATHENA.MIT.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">klist</span>

+<span class="n">Ticket</span> <span class="n">cache</span><span class="p">:</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">krb5cc_ttypa</span>

+<span class="n">Default</span> <span class="n">principal</span><span class="p">:</span> <span class="n">jennifer</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

-Valid starting Expires Service principal

-06/07/04 19:49:21 06/08/04 05:49:19 krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

-shell%

+<span class="n">Valid</span> <span class="n">starting</span> <span class="n">Expires</span> <span class="n">Service</span> <span class="n">principal</span>

+<span class="mi">06</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">04</span> <span class="mi">19</span><span class="p">:</span><span class="mi">49</span><span class="p">:</span><span class="mi">21</span> <span class="mi">06</span><span class="o">/</span><span class="mi">08</span><span class="o">/</span><span class="mi">04</span> <span class="mi">05</span><span class="p">:</span><span class="mi">49</span><span class="p">:</span><span class="mi">19</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

<p>The ticket cache is the location of your ticket file. In the above

-example, this file is named <tt class="docutils literal"><span class="pre">/tmp/krb5cc_ttypa</span></tt>. The default

+example, this file is named <code class="docutils literal"><span class="pre">/tmp/krb5cc_ttypa</span></code>. The default

principal is your Kerberos principal.</p>

-<p>The “valid starting” and “expires” fields describe the period of time

-during which the ticket is valid. The “service principal” describes

+<p>The “valid starting” and “expires” fields describe the period of time

+during which the ticket is valid. The “service principal” describes

each ticket. The ticket-granting ticket has a first component

-<tt class="docutils literal"><span class="pre">krbtgt</span></tt>, and a second component which is the realm name.</p>

-<p>Now, if <tt class="docutils literal"><span class="pre">jennifer</span></tt> connected to the machine <tt class="docutils literal"><span class="pre">daffodil.mit.edu</span></tt>,

-and then typed “klist” again, she would have gotten the following

+<code class="docutils literal"><span class="pre">krbtgt</span></code>, and a second component which is the realm name.</p>

+<p>Now, if <code class="docutils literal"><span class="pre">jennifer</span></code> connected to the machine <code class="docutils literal"><span class="pre">daffodil.mit.edu</span></code>,

+and then typed “klist” again, she would have gotten the following

result:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% klist

-Ticket cache: /tmp/krb5cc_ttypa

-Default principal: jennifer@ATHENA.MIT.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">klist</span>

+<span class="n">Ticket</span> <span class="n">cache</span><span class="p">:</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">krb5cc_ttypa</span>

-Valid starting Expires Service principal

-06/07/04 19:49:21 06/08/04 05:49:19 krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

-06/07/04 20:22:30 06/08/04 05:49:19 host/daffodil.mit.edu@ATHENA.MIT.EDU

-shell%

+<span class="n">Valid</span> <span class="n">starting</span> <span class="n">Expires</span> <span class="n">Service</span> <span class="n">principal</span>

+<span class="mi">06</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">04</span> <span class="mi">20</span><span class="p">:</span><span class="mi">22</span><span class="p">:</span><span class="mi">30</span> <span class="mi">06</span><span class="o">/</span><span class="mi">08</span><span class="o">/</span><span class="mi">04</span> <span class="mi">05</span><span class="p">:</span><span class="mi">49</span><span class="p">:</span><span class="mi">19</span> <span class="n">host</span><span class="o">/</span><span class="n">daffodil</span><span class="o">.</span><span class="n">mit</span><span class="o">.</span><span class="n">edu</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>Here’s what happened: when <tt class="docutils literal"><span class="pre">jennifer</span></tt> used ssh to connect to the

-host <tt class="docutils literal"><span class="pre">daffodil.mit.edu</span></tt>, the ssh program presented her

+<p>Here’s what happened: when <code class="docutils literal"><span class="pre">jennifer</span></code> used ssh to connect to the

+host <code class="docutils literal"><span class="pre">daffodil.mit.edu</span></code>, the ssh program presented her

ticket-granting ticket to the KDC and requested a host ticket for the

-host <tt class="docutils literal"><span class="pre">daffodil.mit.edu</span></tt>. The KDC sent the host ticket, which ssh

-then presented to the host <tt class="docutils literal"><span class="pre">daffodil.mit.edu</span></tt>, and she was allowed

+host <code class="docutils literal"><span class="pre">daffodil.mit.edu</span></code>. The KDC sent the host ticket, which ssh

+then presented to the host <code class="docutils literal"><span class="pre">daffodil.mit.edu</span></code>, and she was allowed

to log in without typing her password.</p>

<p>Suppose your Kerberos tickets allow you to log into a host in another

-domain, such as <tt class="docutils literal"><span class="pre">trillium.example.com</span></tt>, which is also in another

-Kerberos realm, <tt class="docutils literal"><span class="pre">EXAMPLE.COM</span></tt>. If you ssh to this host, you will

-receive a ticket-granting ticket for the realm <tt class="docutils literal"><span class="pre">EXAMPLE.COM</span></tt>, plus

-the new host ticket for <tt class="docutils literal"><span class="pre">trillium.example.com</span></tt>. klist will now

+domain, such as <code class="docutils literal"><span class="pre">trillium.example.com</span></code>, which is also in another

+Kerberos realm, <code class="docutils literal"><span class="pre">EXAMPLE.COM</span></code>. If you ssh to this host, you will

+receive a ticket-granting ticket for the realm <code class="docutils literal"><span class="pre">EXAMPLE.COM</span></code>, plus

+the new host ticket for <code class="docutils literal"><span class="pre">trillium.example.com</span></code>. klist will now

show:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% klist

-Ticket cache: /tmp/krb5cc_ttypa

-Default principal: jennifer@ATHENA.MIT.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">klist</span>

+<span class="n">Ticket</span> <span class="n">cache</span><span class="p">:</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">krb5cc_ttypa</span>

-Valid starting Expires Service principal

-06/07/04 19:49:21 06/08/04 05:49:19 krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

-06/07/04 20:22:30 06/08/04 05:49:19 host/daffodil.mit.edu@ATHENA.MIT.EDU

-06/07/04 20:24:18 06/08/04 05:49:19 krbtgt/EXAMPLE.COM@ATHENA.MIT.EDU

-06/07/04 20:24:18 06/08/04 05:49:19 host/trillium.example.com@EXAMPLE.COM

-shell%

+<span class="n">Valid</span> <span class="n">starting</span> <span class="n">Expires</span> <span class="n">Service</span> <span class="n">principal</span>

+<span class="mi">06</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">04</span> <span class="mi">20</span><span class="p">:</span><span class="mi">24</span><span class="p">:</span><span class="mi">18</span> <span class="mi">06</span><span class="o">/</span><span class="mi">08</span><span class="o">/</span><span class="mi">04</span> <span class="mi">05</span><span class="p">:</span><span class="mi">49</span><span class="p">:</span><span class="mi">19</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

+<span class="mi">06</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">04</span> <span class="mi">20</span><span class="p">:</span><span class="mi">24</span><span class="p">:</span><span class="mi">18</span> <span class="mi">06</span><span class="o">/</span><span class="mi">08</span><span class="o">/</span><span class="mi">04</span> <span class="mi">05</span><span class="p">:</span><span class="mi">49</span><span class="p">:</span><span class="mi">19</span> <span class="n">host</span><span class="o">/</span><span class="n">trillium</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>Depending on your host’s and realm’s configuration, you may also see a

-ticket with the service principal <tt class="docutils literal"><span class="pre">host/trillium.example.com@</span></tt>. If

+<p>Depending on your host’s and realm’s configuration, you may also see a

+ticket with the service principal <code class="docutils literal"><span class="pre">host/trillium.example.com@</span></code>. If

so, this means that your host did not know what realm

-trillium.example.com is in, so it asked the <tt class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></tt> KDC for

-a referral. The next time you connect to <tt class="docutils literal"><span class="pre">trillium.example.com</span></tt>,

+trillium.example.com is in, so it asked the <code class="docutils literal"><span class="pre">ATHENA.MIT.EDU</span></code> KDC for

+a referral. The next time you connect to <code class="docutils literal"><span class="pre">trillium.example.com</span></code>,

the odd-looking entry will be used to avoid needing to ask for a

referral again.</p>

<p>You can use the <strong>-f</strong> option to view the flags that apply to your

@@ -329,29 +327,29 @@ tickets. The flags are:</p>

<p>Here is a sample listing. In this example, the user <em>jennifer</em>

obtained her initial tickets (<strong>I</strong>), which are forwardable (<strong>F</strong>)

and postdated (<strong>d</strong>) but not yet validated (<strong>i</strong>):</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% klist -f

-Ticket cache: /tmp/krb5cc_320

-Default principal: jennifer@ATHENA.MIT.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">klist</span> <span class="o">-</span><span class="n">f</span>

+<span class="n">Ticket</span> <span class="n">cache</span><span class="p">:</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">krb5cc_320</span>

-Valid starting Expires Service principal

-31/07/05 19:06:25 31/07/05 19:16:25 krbtgt/ATHENA.MIT.EDU@ATHENA.MIT.EDU

- Flags: FdiI

-shell%

+<span class="n">Valid</span> <span class="n">starting</span> <span class="n">Expires</span> <span class="n">Service</span> <span class="n">principal</span>

+<span class="mi">31</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">05</span> <span class="mi">19</span><span class="p">:</span><span class="mi">06</span><span class="p">:</span><span class="mi">25</span> <span class="mi">31</span><span class="o">/</span><span class="mi">07</span><span class="o">/</span><span class="mi">05</span> <span class="mi">19</span><span class="p">:</span><span class="mi">16</span><span class="p">:</span><span class="mi">25</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span><span class="nd">@ATHENA</span><span class="o">.</span><span class="n">MIT</span><span class="o">.</span><span class="n">EDU</span>

+ <span class="n">Flags</span><span class="p">:</span> <span class="n">FdiI</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>In the following example, the user <em>david</em>‘s tickets were forwarded

+<p>In the following example, the user <em>david</em>’s tickets were forwarded

(<strong>f</strong>) to this host from another host. The tickets are reforwardable

(<strong>F</strong>):</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% klist -f

-Ticket cache: /tmp/krb5cc_p11795

-Default principal: david@EXAMPLE.COM

+<span class="n">Ticket</span> <span class="n">cache</span><span class="p">:</span> <span class="o">/</span><span class="n">tmp</span><span class="o">/</span><span class="n">krb5cc_p11795</span>

+<span class="n">Default</span> <span class="n">principal</span><span class="p">:</span> <span class="n">david</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

-Valid starting Expires Service principal

-07/31/05 11:52:29 07/31/05 21:11:23 krbtgt/EXAMPLE.COM@EXAMPLE.COM

- Flags: Ff

-07/31/05 12:03:48 07/31/05 21:11:23 host/trillium.example.com@EXAMPLE.COM

- Flags: Ff

-shell%

+<span class="n">Valid</span> <span class="n">starting</span> <span class="n">Expires</span> <span class="n">Service</span> <span class="n">principal</span>

+<span class="mi">07</span><span class="o">/</span><span class="mi">31</span><span class="o">/</span><span class="mi">05</span> <span class="mi">11</span><span class="p">:</span><span class="mi">52</span><span class="p">:</span><span class="mi">29</span> <span class="mi">07</span><span class="o">/</span><span class="mi">31</span><span class="o">/</span><span class="mi">05</span> <span class="mi">21</span><span class="p">:</span><span class="mi">11</span><span class="p">:</span><span class="mi">23</span> <span class="n">krbtgt</span><span class="o">/</span><span class="n">EXAMPLE</span><span class="o">.</span><span class="n">COM</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

+ <span class="n">Flags</span><span class="p">:</span> <span class="n">Ff</span>

+<span class="mi">07</span><span class="o">/</span><span class="mi">31</span><span class="o">/</span><span class="mi">05</span> <span class="mi">12</span><span class="p">:</span><span class="mi">03</span><span class="p">:</span><span class="mi">48</span> <span class="mi">07</span><span class="o">/</span><span class="mi">31</span><span class="o">/</span><span class="mi">05</span> <span class="mi">21</span><span class="p">:</span><span class="mi">11</span><span class="p">:</span><span class="mi">23</span> <span class="n">host</span><span class="o">/</span><span class="n">trillium</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span>

+ <span class="n">Flags</span><span class="p">:</span> <span class="n">Ff</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

@@ -363,16 +361,16 @@ they are stored. If this happens, the person who has them can

masquerade as you until they expire. For this reason, you should

destroy your Kerberos tickets when you are away from your computer.</p>

<p>Destroying your tickets is easy. Simply type kdestroy:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kdestroy

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kdestroy</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

-<p>If <a class="reference internal" href="user_commands/kdestroy.html#kdestroy-1"><em>kdestroy</em></a> fails to destroy your tickets, it will beep and

-give an error message. For example, if kdestroy can’t find any

+<p>If <a class="reference internal" href="user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a> fails to destroy your tickets, it will beep and

+give an error message. For example, if kdestroy can’t find any

tickets to destroy, it will give the following message:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% kdestroy

-kdestroy: No credentials cache file found while destroying cache

-shell%

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">kdestroy</span>

+<span class="n">kdestroy</span><span class="p">:</span> <span class="n">No</span> <span class="n">credentials</span> <span class="n">cache</span> <span class="n">file</span> <span class="n">found</span> <span class="k">while</span> <span class="n">destroying</span> <span class="n">cache</span>

+<span class="n">shell</span><span class="o">%</span>

</pre></div>

</div>

@@ -400,9 +398,7 @@ shell%

<li class="toctree-l1 current"><a class="reference internal" href="index.html">For users</a><ul class="current">

<li class="toctree-l2"><a class="reference internal" href="pwd_mgmt.html">Password management</a></li>

-<li class="toctree-l2 current"><a class="current reference internal" href="">Ticket management</a><ul class="simple">

-</ul>

-</li>

+<li class="toctree-l2 current"><a class="current reference internal" href="#">Ticket management</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_config/index.html">User config files</a></li>

<li class="toctree-l2"><a class="reference internal" href="user_commands/index.html">User commands</a></li>

</ul>

@@ -435,8 +431,8 @@ shell%

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/index.html b/doc/html/user/user_commands/index.html
index 2c363b631787..812c62144b3c 100644
--- a/doc/html/user/user_commands/index.html
+++ b/doc/html/user/user_commands/index.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>User commands — MIT Kerberos Documentation</title>

+ <title>User commands — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="For users" href="../index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="id1"></span><h1>User commands<a class="headerlink" href="#user-commands" title="Permalink to this headline">¶</a></h1>

@@ -98,7 +96,7 @@

<li class="toctree-l2"><a class="reference internal" href="../pwd_mgmt.html">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../user_config/index.html">User config files</a></li>

-<li class="toctree-l2 current"><a class="current reference internal" href="">User commands</a><ul>

+<li class="toctree-l2 current"><a class="current reference internal" href="#">User commands</a><ul>

<li class="toctree-l3"><a class="reference internal" href="kdestroy.html">kdestroy</a></li>

<li class="toctree-l3"><a class="reference internal" href="kinit.html">kinit</a></li>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

@@ -140,8 +138,8 @@

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/kdestroy.html b/doc/html/user/user_commands/kdestroy.html
index c38e9d7685dd..b855a6ad9727 100644
--- a/doc/html/user/user_commands/kdestroy.html
+++ b/doc/html/user/user_commands/kdestroy.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kdestroy — MIT Kerberos Documentation</title>

+ <title>kdestroy — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="kdestroy-1"></span><h1>kdestroy<a class="headerlink" href="#kdestroy" title="Permalink to this headline">¶</a></h1>

@@ -70,11 +68,12 @@

<p><strong>kdestroy</strong>

[<strong>-A</strong>]

[<strong>-q</strong>]

-[<strong>-c</strong> <em>cache_name</em>]</p>

+[<strong>-c</strong> <em>cache_name</em>]

+[<strong>-p</strong> <em>princ_name</em>]</p>

</div>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

-<p>The kdestroy utility destroys the user’s active Kerberos authorization

+<p>The kdestroy utility destroys the user’s active Kerberos authorization

tickets by overwriting and deleting the credentials cache that

contains them. If the credentials cache is not specified, the default

credentials cache is destroyed.</p>

@@ -84,10 +83,11 @@ credentials cache is destroyed.</p>

<dd>Destroys all caches in the collection, if a cache collection is

-available.</dd>

+available. May be used with the <strong>-c</strong> option to specify the

+collection to be destroyed.</dd>

<dd>Run quietly. Normally kdestroy beeps if it fails to destroy the

-user’s tickets. The <strong>-q</strong> flag suppresses this behavior.</dd>

+user’s tickets. The <strong>-q</strong> flag suppresses this behavior.</dd>

<dt><strong>-c</strong> <em>cache_name</em></dt>

<dd><p class="first">Use <em>cache_name</em> as the credentials (ticket) cache name and

location; if this option is not used, the default cache name and

@@ -96,6 +96,10 @@ location are used.</p>

<strong>KRB5CCNAME</strong> environment variable is set, its value is used to

name the default ticket cache.</p>

</dd>

+<dt><strong>-p</strong> <em>princ_name</em></dt>

+<dd>If a cache collection is available, destroy the cache for

+<em>princ_name</em> instead of the primary cache. May be used with the

+<strong>-c</strong> option to specify the collection to be searched.</dd>

</dl>

</div>

@@ -106,27 +110,19 @@ when you log out.</p>

</div>

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-<p>kdestroy uses the following environment variable:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd>Location of the default Kerberos 5 credentials (ticket) cache, in

-the form <em>type</em>:<em>residual</em>. If no <em>type</em> prefix is present, the

-<strong>FILE</strong> type is assumed. The type of the default cache may

-determine the availability of a cache collection; for instance, a

-default cache of type <strong>DIR</strong> causes caches within the directory

-to be present in the collection.</dd>

-</dl>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFCCNAME</em></a></dt>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a></dt>

<dd>Default location of Kerberos 5 credentials cache</dd>

</dl>

</div>

-<p><a class="reference internal" href="kinit.html#kinit-1"><em>kinit</em></a>, <a class="reference internal" href="klist.html#klist-1"><em>klist</em></a></p>

+<p><a class="reference internal" href="kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="klist.html#klist-1"><span class="std std-ref">klist</span></a>, <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -158,7 +154,7 @@ to be present in the collection.</dd>

<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../user_config/index.html">User config files</a></li>

<li class="toctree-l2 current"><a class="reference internal" href="index.html">User commands</a><ul class="current">

-<li class="toctree-l3 current"><a class="current reference internal" href="">kdestroy</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kdestroy</a></li>

<li class="toctree-l3"><a class="reference internal" href="kinit.html">kinit</a></li>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

@@ -199,8 +195,8 @@ to be present in the collection.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/kinit.html b/doc/html/user/user_commands/kinit.html
index e1dad27e9c59..53eccc9455be 100644
--- a/doc/html/user/user_commands/kinit.html
+++ b/doc/html/user/user_commands/kinit.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kinit — MIT Kerberos Documentation</title>

+ <title>kinit — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="kinit-1"></span><h1>kinit<a class="headerlink" href="#kinit" title="Permalink to this headline">¶</a></h1>

@@ -80,13 +78,14 @@

[<strong>-E</strong>]

[<strong>-v</strong>]

[<strong>-R</strong>]

-[<strong>-k</strong> [-<strong>t</strong> <em>keytab_file</em>]]

+[<strong>-k</strong> [<strong>-i</strong> | -<strong>t</strong> <em>keytab_file</em>]]

[<strong>-c</strong> <em>cache_name</em>]

[<strong>-n</strong>]

[<strong>-S</strong> <em>service_name</em>]

[<strong>-I</strong> <em>input_ccache</em>]

[<strong>-T</strong> <em>armor_ccache</em>]

[<strong>-X</strong> <em>attribute</em>[=<em>value</em>]]

+[<strong>–request-pac</strong> | <strong>–no-request-pac</strong>]

[<em>principal</em>]</p>

</div>

@@ -103,23 +102,23 @@ choice of principal name.</p>

<dd>display verbose output.</dd>

<dt><strong>-l</strong> <em>lifetime</em></dt>

-<dd><p class="first">(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> string.) Requests a ticket with the lifetime

+<dd><p class="first">(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> string.) Requests a ticket with the lifetime

<em>lifetime</em>.</p>

-<p>For example, <tt class="docutils literal"><span class="pre">kinit</span> <span class="pre">-l</span> <span class="pre">5:30</span></tt> or <tt class="docutils literal"><span class="pre">kinit</span> <span class="pre">-l</span> <span class="pre">5h30m</span></tt>.</p>

+<p>For example, <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-l</span> <span class="pre">5:30</span></code> or <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-l</span> <span class="pre">5h30m</span></code>.</p>

<p class="last">If the <strong>-l</strong> option is not specified, the default ticket lifetime

(configured by each site) is used. Specifying a ticket lifetime

longer than the maximum ticket lifetime (configured by each site)

will not override the configured maximum ticket lifetime.</p>

</dd>

<dt><strong>-s</strong> <em>start_time</em></dt>

-<dd><p class="first">(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> string.) Requests a postdated ticket. Postdated

+<dd><p class="first">(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> string.) Requests a postdated ticket. Postdated

tickets are issued with the <strong>invalid</strong> flag set, and need to be

resubmitted to the KDC for validation before use.</p>

<p class="last"><em>start_time</em> specifies the duration of the delay before the ticket

can become valid.</p>

</dd>

<dt><strong>-r</strong> <em>renewable_life</em></dt>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> string.) Requests renewable tickets, with a total

+<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> string.) Requests renewable tickets, with a total

lifetime of <em>renewable_life</em>.</dd>

<dd>requests forwardable tickets.</dd>

@@ -130,7 +129,7 @@ lifetime of <em>renewable_life</em>.</dd>

<dd>requests non-proxiable tickets.</dd>

-<dd>requests tickets restricted to the host’s local address[es].</dd>

+<dd>requests tickets restricted to the host’s local address[es].</dd>

<dd>requests tickets not restricted by address.</dd>

@@ -138,8 +137,7 @@ lifetime of <em>renewable_life</em>.</dd>

KDC to reply with a different client principal from the one

requested.</dd>

-<dd>treats the principal name as an enterprise name (implies the

-<strong>-C</strong> option).</dd>

+<dd>treats the principal name as an enterprise name.</dd>

<dd>requests that the ticket-granting ticket in the cache (with the

<strong>invalid</strong> flag set) be passed to the KDC for validation. If the

@@ -150,18 +148,18 @@ with the validated ticket.</dd>

expired ticket cannot be renewed, even if the ticket is still

within its renewable life.</p>

<p class="last">Note that renewable tickets that have expired as reported by

-<a class="reference internal" href="klist.html#klist-1"><em>klist</em></a> may sometimes be renewed using this option,

+<a class="reference internal" href="klist.html#klist-1"><span class="std std-ref">klist</span></a> may sometimes be renewed using this option,

because the KDC applies a grace period to account for client-KDC

-clock skew. See <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> <strong>clockskew</strong> setting.</p>

+clock skew. See <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> <strong>clockskew</strong> setting.</p>

</dd>

<dt><strong>-k</strong> [<strong>-i</strong> | <strong>-t</strong> <em>keytab_file</em>]</dt>

-<dd>requests a ticket, obtained from a key in the local host’s keytab.

+<dd>requests a ticket, obtained from a key in the local host’s keytab.

The location of the keytab may be specified with the <strong>-t</strong>

<em>keytab_file</em> option, or with the <strong>-i</strong> option to specify the use

of the default client keytab; otherwise the default keytab will be

used. By default, a host ticket for the local host is requested,

but any principal may be specified. On a KDC, the special keytab

-location <tt class="docutils literal"><span class="pre">KDB:</span></tt> can be used to indicate that kinit should open

+location <code class="docutils literal"><span class="pre">KDB:</span></code> can be used to indicate that kinit should open

the KDC database and look up the key directly. This permits an

administrator to obtain tickets as any principal that supports

authentication based on the key.</dd>

@@ -169,14 +167,14 @@ authentication based on the key.</dd>

<dd><p class="first">Requests anonymous processing. Two types of anonymous principals

are supported.</p>

<p>For fully anonymous Kerberos, configure pkinit on the KDC and

-configure <strong>pkinit_anchors</strong> in the client’s <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a>.

-Then use the <strong>-n</strong> option with a principal of the form <tt class="docutils literal"><span class="pre">@REALM</span></tt>

+configure <strong>pkinit_anchors</strong> in the client’s <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>.

+Then use the <strong>-n</strong> option with a principal of the form <code class="docutils literal"><span class="pre">@REALM</span></code>

(an empty principal name followed by the at-sign and a realm

name). If permitted by the KDC, an anonymous ticket will be

returned.</p>

<p>A second form of anonymous tickets is supported; these

realm-exposed tickets hide the identity of the client but not the

-client’s realm. For this mode, use <tt class="docutils literal"><span class="pre">kinit</span> <span class="pre">-n</span></tt> with a normal

+client’s realm. For this mode, use <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-n</span></code> with a normal

principal name. If supported by the KDC, the principal (but not

realm) will be replaced by the anonymous principal.</p>

<p class="last">As of release 1.8, the MIT Kerberos KDC only supports fully

@@ -219,46 +217,46 @@ tickets.</dd>

interpreted by pre-authentication modules. The acceptable

attribute and value values vary from module to module. This

option may be specified multiple times to specify multiple

-attributes. If no value is specified, it is assumed to be “yes”.</p>

+attributes. If no value is specified, it is assumed to be “yes”.</p>

<p>The following attributes are recognized by the PKINIT

pre-authentication mechanism:</p>

<dt><strong>X509_user_identity</strong>=<em>value</em></dt>

-<dd>specify where to find user’s X509 identity information</dd>

+<dd>specify where to find user’s X509 identity information</dd>

<dt><strong>X509_anchors</strong>=<em>value</em></dt>

<dd>specify where to find trusted X509 anchor information</dd>

<dt><strong>flag_RSA_PROTOCOL</strong>[<strong>=yes</strong>]</dt>

<dd>specify use of RSA, rather than the default Diffie-Hellman

protocol</dd>

+<dt><strong>disable_freshness</strong>[<strong>=yes</strong>]</dt>

+<dd>disable sending freshness tokens (for testing purposes only)</dd>

</dl>

</dd>

+<dt><strong>–request-pac</strong> | <strong>–no-request-pac</strong></dt>

+<dd>mutually exclusive. If <strong>–request-pac</strong> is set, ask the KDC to

+include a PAC in authdata; if <strong>–no-request-pac</strong> is set, ask the

+KDC not to include a PAC; if neither are set, the KDC will follow

+its default, which is typically is to include a PAC if doing so is

+supported.</dd>

</dl>

</div>

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-<p>kinit uses the following environment variables:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd>Location of the default Kerberos 5 credentials cache, in the form

-<em>type</em>:<em>residual</em>. If no <em>type</em> prefix is present, the <strong>FILE</strong>

-type is assumed. The type of the default cache may determine the

-availability of a cache collection; for instance, a default cache

-of type <strong>DIR</strong> causes caches within the directory to be present

-in the collection.</dd>

-</dl>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFCCNAME</em></a></dt>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a></dt>

<dd>default location of Kerberos 5 credentials cache</dd>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFKTNAME</em></a></dt>

-<dd>default location for the local host’s keytab.</dd>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a></dt>

+<dd>default location for the local host’s keytab.</dd>

</dl>

</div>

-<p><a class="reference internal" href="klist.html#klist-1"><em>klist</em></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><em>kdestroy</em></a>, kerberos(1)</p>

+<p><a class="reference internal" href="klist.html#klist-1"><span class="std std-ref">klist</span></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -290,7 +288,7 @@ in the collection.</dd>

<li class="toctree-l2"><a class="reference internal" href="../user_config/index.html">User config files</a></li>

<li class="toctree-l2 current"><a class="reference internal" href="index.html">User commands</a><ul class="current">

<li class="toctree-l3"><a class="reference internal" href="kdestroy.html">kdestroy</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">kinit</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kinit</a></li>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

@@ -330,8 +328,8 @@ in the collection.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/klist.html b/doc/html/user/user_commands/klist.html
index 0dfb589d1cc6..dcc3961a0379 100644
--- a/doc/html/user/user_commands/klist.html
+++ b/doc/html/user/user_commands/klist.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>klist — MIT Kerberos Documentation</title>

+ <title>klist — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="klist-1"></span><h1>klist<a class="headerlink" href="#klist" title="Permalink to this headline">¶</a></h1>

@@ -71,8 +69,9 @@

[<strong>-e</strong>]

[[<strong>-c</strong>] [<strong>-l</strong>] [<strong>-A</strong>] [<strong>-f</strong>] [<strong>-s</strong>] [<strong>-a</strong> [<strong>-n</strong>]]]

[<strong>-C</strong>]

-[<strong>-k</strong> [<strong>-t</strong>] [<strong>-K</strong>]]

+[<strong>-k</strong> [<strong>-i</strong>] [<strong>-t</strong>] [<strong>-K</strong>]]

[<strong>-V</strong>]

+[<strong>-d</strong>]

[<em>cache_name</em>|<em>keytab_name</em>]</p>

</div>

@@ -99,20 +98,20 @@ neither <strong>-c</strong> nor <strong>-k</strong> is specified.</dd>

<dd><p class="first">Shows the flags present in the credentials, using the following

abbreviations:</p>

-<div class="last highlight-python"><div class="highlight"><pre>F Forwardable

-f forwarded

-P Proxiable

-p proxy

-D postDateable

-d postdated

-R Renewable

-I Initial

-i invalid

-H Hardware authenticated

-A preAuthenticated

-T Transit policy checked

-O Okay as delegate

-a anonymous

+<div class="last highlight-default"><div class="highlight"><pre><span></span><span class="n">F</span> <span class="n">Forwardable</span>

+<span class="n">f</span> <span class="n">forwarded</span>

+<span class="n">P</span> <span class="n">Proxiable</span>

+<span class="n">p</span> <span class="n">proxy</span>

+<span class="n">D</span> <span class="n">postDateable</span>

+<span class="n">d</span> <span class="n">postdated</span>

+<span class="n">R</span> <span class="n">Renewable</span>

+<span class="n">I</span> <span class="n">Initial</span>

+<span class="n">i</span> <span class="n">invalid</span>

+<span class="n">H</span> <span class="n">Hardware</span> <span class="n">authenticated</span>

+<span class="n">A</span> <span class="n">preAuthenticated</span>

+<span class="n">T</span> <span class="n">Transit</span> <span class="n">policy</span> <span class="n">checked</span>

+<span class="n">O</span> <span class="n">Okay</span> <span class="k">as</span> <span class="n">delegate</span>

+<span class="n">a</span> <span class="n">anonymous</span>

</pre></div>

</div>

</dd>

@@ -140,6 +139,8 @@ keytab file.</dd>

<dd>Display the value of the encryption key in each keytab entry in

the keytab file.</dd>

+<dt><strong>-d</strong></dt>

+<dd>Display the authdata types (if any) for each entry.</dd>

<dd>Display the Kerberos version number and exit.</dd>

</dl>

@@ -150,29 +151,21 @@ value is used to locate the default ticket cache.</p>

</div>

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-<p>klist uses the following environment variable:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd>Location of the default Kerberos 5 credentials (ticket) cache, in

-the form <em>type</em>:<em>residual</em>. If no <em>type</em> prefix is present, the

-<strong>FILE</strong> type is assumed. The type of the default cache may

-determine the availability of a cache collection; for instance, a

-default cache of type <strong>DIR</strong> causes caches within the directory

-to be present in the collection.</dd>

-</dl>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFCCNAME</em></a></dt>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a></dt>

<dd>Default location of Kerberos 5 credentials cache</dd>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFKTNAME</em></a></dt>

-<dd>Default location for the local host’s keytab file.</dd>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a></dt>

+<dd>Default location for the local host’s keytab file.</dd>

</dl>

</div>

-<p><a class="reference internal" href="kinit.html#kinit-1"><em>kinit</em></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><em>kdestroy</em></a></p>

+<p><a class="reference internal" href="kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -205,7 +198,7 @@ to be present in the collection.</dd>

<li class="toctree-l2 current"><a class="reference internal" href="index.html">User commands</a><ul class="current">

<li class="toctree-l3"><a class="reference internal" href="kdestroy.html">kdestroy</a></li>

<li class="toctree-l3"><a class="reference internal" href="kinit.html">kinit</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">klist</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">klist</a></li>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

@@ -244,8 +237,8 @@ to be present in the collection.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/kpasswd.html b/doc/html/user/user_commands/kpasswd.html
index 824cae0dac3b..af3b2dd019dc 100644
--- a/doc/html/user/user_commands/kpasswd.html
+++ b/doc/html/user/user_commands/kpasswd.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kpasswd — MIT Kerberos Documentation</title>

+ <title>kpasswd — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="kpasswd-1"></span><h1>kpasswd<a class="headerlink" href="#kpasswd" title="Permalink to this headline">¶</a></h1>

@@ -71,7 +69,7 @@

</div>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

-<p>The kpasswd command is used to change a Kerberos principal’s password.

+<p>The kpasswd command is used to change a Kerberos principal’s password.

kpasswd first prompts for the current Kerberos password, then prompts

the user twice for the new password, and the password is changed.</p>

<p>If the principal is governed by a policy that specifies the length

@@ -90,9 +88,14 @@ if there is one; if not, the principal is derived from the

identity of the user invoking the kpasswd command.</dd>

</dl>

</div>

+<div class="section" id="environment">

+<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

+</div>

-<p><a class="reference internal" href="../../admin/admin_commands/kadmin_local.html#kadmin-1"><em>kadmin</em></a>, <a class="reference internal" href="../../admin/admin_commands/kadmind.html#kadmind-8"><em>kadmind</em></a></p>

+<p><a class="reference internal" href="../../admin/admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>, <a class="reference internal" href="../../admin/admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -108,6 +111,7 @@ identity of the user invoking the kpasswd command.</dd>

<li><a class="reference internal" href="#synopsis">SYNOPSIS</a></li>

<li><a class="reference internal" href="#description">DESCRIPTION</a></li>

<li><a class="reference internal" href="#options">OPTIONS</a></li>

+<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li>

</ul>

</li>

@@ -124,7 +128,7 @@ identity of the user invoking the kpasswd command.</dd>

<li class="toctree-l3"><a class="reference internal" href="kdestroy.html">kdestroy</a></li>

<li class="toctree-l3"><a class="reference internal" href="kinit.html">kinit</a></li>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">kpasswd</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kpasswd</a></li>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

<li class="toctree-l3"><a class="reference internal" href="kswitch.html">kswitch</a></li>

@@ -162,8 +166,8 @@ identity of the user invoking the kpasswd command.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/krb5-config.html b/doc/html/user/user_commands/krb5-config.html
index 6a8b44c4dfc3..80a50d33cf60 100644
--- a/doc/html/user/user_commands/krb5-config.html
+++ b/doc/html/user/user_commands/krb5-config.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>krb5-config — MIT Kerberos Documentation</title>

+ <title>krb5-config — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="krb5-config-1"></span><h1>krb5-config<a class="headerlink" href="#krb5-config" title="Permalink to this headline">¶</a></h1>

@@ -133,17 +131,17 @@ Allowed values for <em>library</em> are:</p>

<h2>EXAMPLES<a class="headerlink" href="#examples" title="Permalink to this headline">¶</a></h2>

<p>krb5-config is particularly useful for compiling against a Kerberos

installation that was installed in a non-standard location. For example,

-a Kerberos installation that is installed in <tt class="docutils literal"><span class="pre">/opt/krb5/</span></tt> but uses

-libraries in <tt class="docutils literal"><span class="pre">/usr/local/lib/</span></tt> for text localization would produce

+a Kerberos installation that is installed in <code class="docutils literal"><span class="pre">/opt/krb5/</span></code> but uses

+libraries in <code class="docutils literal"><span class="pre">/usr/local/lib/</span></code> for text localization would produce

the following output:</p>

-<div class="highlight-python"><div class="highlight"><pre>shell% krb5-config --libs krb5

--L/opt/krb5/lib -Wl,-rpath -Wl,/opt/krb5/lib -L/usr/local/lib -lkrb5 -lk5crypto -lcom_err

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">shell</span><span class="o">%</span> <span class="n">krb5</span><span class="o">-</span><span class="n">config</span> <span class="o">--</span><span class="n">libs</span> <span class="n">krb5</span>

+<span class="o">-</span><span class="n">L</span><span class="o">/</span><span class="n">opt</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">lib</span> <span class="o">-</span><span class="n">Wl</span><span class="p">,</span><span class="o">-</span><span class="n">rpath</span> <span class="o">-</span><span class="n">Wl</span><span class="p">,</span><span class="o">/</span><span class="n">opt</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">lib</span> <span class="o">-</span><span class="n">L</span><span class="o">/</span><span class="n">usr</span><span class="o">/</span><span class="n">local</span><span class="o">/</span><span class="n">lib</span> <span class="o">-</span><span class="n">lkrb5</span> <span class="o">-</span><span class="n">lk5crypto</span> <span class="o">-</span><span class="n">lcom_err</span>

</pre></div>

</div>

-<p>kerberos(1), cc(1)</p>

+<p><a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a>, cc(1)</p>

</div>

@@ -177,7 +175,7 @@ the following output:</p>

<li class="toctree-l3"><a class="reference internal" href="kinit.html">kinit</a></li>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">krb5-config</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">krb5-config</a></li>

<li class="toctree-l3"><a class="reference internal" href="kswitch.html">kswitch</a></li>

@@ -214,8 +212,8 @@ the following output:</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/ksu.html b/doc/html/user/user_commands/ksu.html
index fe58258b985d..90d1b69e1487 100644
--- a/doc/html/user/user_commands/ksu.html
+++ b/doc/html/user/user_commands/ksu.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>ksu — MIT Kerberos Documentation</title>

+ <title>ksu — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

@@ -73,11 +71,12 @@

[ <strong>-c</strong> <em>source_cache_name</em> ]

[ <strong>-k</strong> ]

[ <strong>-r</strong> time ]

-[ <strong>-pf</strong> ]

+[ <strong>-p</strong> | <strong>-P</strong>]

+[ <strong>-f</strong> | <strong>-F</strong>]

[ <strong>-l</strong> <em>lifetime</em> ]

[ <strong>-z | Z</strong> ]

[ <strong>-q</strong> ]

-[ <strong>-e</strong> <em>command</em> [ args ... ] ] [ <strong>-a</strong> [ args ... ] ]</p>

+[ <strong>-e</strong> <em>command</em> [ args … ] ] [ <strong>-a</strong> [ args … ] ]</p>

</div>

<h2>REQUIREMENTS<a class="headerlink" href="#requirements" title="Permalink to this headline">¶</a></h2>

@@ -92,10 +91,10 @@ the target user, and the other is to create a new security context.</p>

<p>For the sake of clarity, all references to and attributes of

-the user invoking the program will start with “source”

-(e.g., “source user”, “source cache”, etc.).</p>

+the user invoking the program will start with “source”

+(e.g., “source user”, “source cache”, etc.).</p>

<p class="last">Likewise, all references to and attributes of the target

-account will start with “target”.</p>

+account will start with “target”.</p>

</div>

@@ -103,19 +102,19 @@ account will start with “target”.</p>

<p>To fulfill the first mission, ksu operates in two phases:

authentication and authorization. Resolving the target principal name

is the first step in authentication. The user can either specify his

-principal name with the <strong>-n</strong> option (e.g., <tt class="docutils literal"><span class="pre">-n</span> <span class="pre">jqpublic@USC.EDU</span></tt>)

+principal name with the <strong>-n</strong> option (e.g., <code class="docutils literal"><span class="pre">-n</span> <span class="pre">jqpublic@USC.EDU</span></code>)

or a default principal name will be assigned using a heuristic

described in the OPTIONS section (see <strong>-n</strong> option). The target user

name must be the first argument to ksu; if not specified root is the

-default. If <tt class="docutils literal"><span class="pre">.</span></tt> is specified then the target user will be the

-source user (e.g., <tt class="docutils literal"><span class="pre">ksu</span> <span class="pre">.</span></tt>). If the source user is root or the

+default. If <code class="docutils literal"><span class="pre">.</span></code> is specified then the target user will be the

+source user (e.g., <code class="docutils literal"><span class="pre">ksu</span> <span class="pre">.</span></code>). If the source user is root or the

target user is the source user, no authentication or authorization

takes place. Otherwise, ksu looks for an appropriate Kerberos ticket

in the source cache.</p>

<p>The ticket can either be for the end-server or a ticket granting

-ticket (TGT) for the target principal’s realm. If the ticket for the

-end-server is already in the cache, it’s decrypted and verified. If

-it’s not in the cache but the TGT is, the TGT is used to obtain the

+ticket (TGT) for the target principal’s realm. If the ticket for the

+end-server is already in the cache, it’s decrypted and verified. If

+it’s not in the cache but the TGT is, the TGT is used to obtain the

ticket for the end-server. The end-server ticket is then verified.

If neither ticket is in the cache, but ksu is compiled with the

<strong>GET_TGT_VIA_PASSWD</strong> define, the user will be prompted for a

@@ -131,14 +130,14 @@ invoked without the <strong>-e</strong> option. For a description of the <stron

option, see the OPTIONS section.</p>

<p>Upon successful authentication, ksu checks whether the target

principal is authorized to access the target account. In the target

-user’s home directory, ksu attempts to access two authorization files:

-<a class="reference internal" href="../user_config/k5login.html#k5login-5"><em>.k5login</em></a> and .k5users. In the .k5login file each line

+user’s home directory, ksu attempts to access two authorization files:

+<a class="reference internal" href="../user_config/k5login.html#k5login-5"><span class="std std-ref">.k5login</span></a> and .k5users. In the .k5login file each line

contains the name of a principal that is authorized to access the

account.</p>

<p>For example:</p>

-<div class="highlight-python"><div class="highlight"><pre>jqpublic@USC.EDU

-jqpublic/secure@USC.EDU

-jqpublic/admin@USC.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">jqpublic</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span>

+<span class="n">jqpublic</span><span class="o">/</span><span class="n">secure</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span>

+<span class="n">jqpublic</span><span class="o">/</span><span class="n">admin</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span>

</pre></div>

</div>

<p>The format of .k5users is the same, except the principal name may be

@@ -147,7 +146,7 @@ execute (see the <strong>-e</strong> option in the OPTIONS section for details).

<p>Thus if the target principal name is found in the .k5login file the

source user is authorized to access the target account. Otherwise ksu

looks in the .k5users file. If the target principal name is found

-without any trailing commands or followed only by <tt class="docutils literal"><span class="pre">*</span></tt> then the

+without any trailing commands or followed only by <code class="docutils literal"><span class="pre">*</span></code> then the

source user is authorized. If either .k5login or .k5users exist but

an appropriate entry for the target principal does not exist then

access is denied. If neither file exists then the principal will be

@@ -160,10 +159,10 @@ rules. Otherwise, authorization fails.</p>

similar fashion to su. The environment is unmodified with the

exception of USER, HOME and SHELL variables. If the target user is

not root, USER gets set to the target user name. Otherwise USER

-remains unchanged. Both HOME and SHELL are set to the target login’s

+remains unchanged. Both HOME and SHELL are set to the target login’s

default values. In addition, the environment variable <strong>KRB5CCNAME</strong>

gets set to the name of the target cache. The real and effective user

-ID are changed to that of the target user. The target user’s shell is

+ID are changed to that of the target user. The target user’s shell is

then invoked (the shell name is specified in the password file). Upon

termination of the shell, ksu deletes the target cache (unless ksu is

invoked with the <strong>-k</strong> option). This is implemented by first doing a

@@ -197,7 +196,7 @@ wrong password is typed in, ksu fails.</p>

<p class="last">During authentication, only the tickets that could be

-obtained without providing a password are cached in in the

+obtained without providing a password are cached in the

source cache.</p>

</div>

@@ -214,10 +213,10 @@ assigned via the following heuristic:</p>

<p>If the target user is the source user the default principal name

is set to the default principal of the source cache. If the

cache does not exist then the default principal name is set to

-<tt class="docutils literal"><span class="pre">target_user@local_realm</span></tt>. If the source and target users are

-different and neither <tt class="docutils literal"><span class="pre">~target_user/.k5users</span></tt> nor

-<tt class="docutils literal"><span class="pre">~target_user/.k5login</span></tt> exist then the default principal name

-is <tt class="docutils literal"><span class="pre">target_user_login_name@local_realm</span></tt>. Otherwise, starting

+<code class="docutils literal"><span class="pre">target_user@local_realm</span></code>. If the source and target users are

+different and neither <code class="docutils literal"><span class="pre">~target_user/.k5users</span></code> nor

+<code class="docutils literal"><span class="pre">~target_user/.k5login</span></code> exist then the default principal name

+is <code class="docutils literal"><span class="pre">target_user_login_name@local_realm</span></code>. Otherwise, starting

with the first principal listed below, ksu checks if the

principal is authorized to access the target account and whether

there is a legitimate ticket for that principal in the source

@@ -238,31 +237,31 @@ follows:</p>

<p>For each candidate in the above list, select an authorized

principal that has the same realm name and first part of the

principal name equal to the prefix of the candidate. For

-example if candidate a) is <tt class="docutils literal"><span class="pre">jqpublic@ISI.EDU</span></tt> and

-<tt class="docutils literal"><span class="pre">jqpublic/secure@ISI.EDU</span></tt> is authorized to access the target

+example if candidate a) is <code class="docutils literal"><span class="pre">jqpublic@ISI.EDU</span></code> and

+<code class="docutils literal"><span class="pre">jqpublic/secure@ISI.EDU</span></code> is authorized to access the target

account then the default principal is set to

-<tt class="docutils literal"><span class="pre">jqpublic/secure@ISI.EDU</span></tt>.</p>

+<code class="docutils literal"><span class="pre">jqpublic/secure@ISI.EDU</span></code>.</p>

</li>

<li><p class="first">Case 2: source user is root.</p>

<p>If the target user is non-root then the default principal name

-is <tt class="docutils literal"><span class="pre">target_user@local_realm</span></tt>. Else, if the source cache

+is <code class="docutils literal"><span class="pre">target_user@local_realm</span></code>. Else, if the source cache

exists the default principal name is set to the default

principal of the source cache. If the source cache does not

-exist, default principal name is set to <tt class="docutils literal"><span class="pre">root\@local_realm</span></tt>.</p>

+exist, default principal name is set to <code class="docutils literal"><span class="pre">root\@local_realm</span></code>.</p>

</li>

</ul>

</dd>

</dl>

<p><strong>-c</strong> <em>source_cache_name</em></p>

-<div><p>Specify source cache name (e.g., <tt class="docutils literal"><span class="pre">-c</span> <span class="pre">FILE:/tmp/my_cache</span></tt>). If

+<div><p>Specify source cache name (e.g., <code class="docutils literal"><span class="pre">-c</span> <span class="pre">FILE:/tmp/my_cache</span></code>). If

<strong>-c</strong> option is not used then the name is obtained from

<strong>KRB5CCNAME</strong> environment variable. If <strong>KRB5CCNAME</strong> is not

-defined the source cache name is set to <tt class="docutils literal"><span class="pre">krb5cc_<source</span> <span class="pre">uid></span></tt>.

-The target cache name is automatically set to <tt class="docutils literal"><span class="pre">krb5cc_<target</span>

-<span class="pre">uid>.(gen_sym())</span></tt>, where gen_sym generates a new number such that

+defined the source cache name is set to <code class="docutils literal"><span class="pre">krb5cc_<source</span> <span class="pre">uid></span></code>.

+The target cache name is automatically set to <code class="docutils literal"><span class="pre">krb5cc_<target</span>

+<span class="pre">uid>.(gen_sym())</span></code>, where gen_sym generates a new number such that

the resulting cache does not already exist. For example:</p>

-<div class="highlight-python"><div class="highlight"><pre>krb5cc_1984.2

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">krb5cc_1984</span><span class="o">.</span><span class="mi">2</span>

</pre></div>

</div>

</div></blockquote>

@@ -278,7 +277,7 @@ name. Use the <strong>-n</strong> option if you want the tickets for other then

the default principal. Note that the <strong>-z</strong> option is mutually

exclusive with the <strong>-Z</strong> option.</dd>

-<dd>Don’t copy any tickets from the source cache to the target cache.

+<dd>Don’t copy any tickets from the source cache to the target cache.

Just create a fresh target cache, where the default principal name

of the cache is initialized to the target principal name. Note

that the <strong>-Z</strong> option is mutually exclusive with the <strong>-z</strong>

@@ -288,7 +287,7 @@ option.</dd>

</dl>

<p>Ticket granting ticket options:</p>

-<dt><strong>-l</strong> <em>lifetime</em> <strong>-r</strong> <em>time</em> <strong>-pf</strong></dt>

+<dt><strong>-l</strong> <em>lifetime</em> <strong>-r</strong> <em>time</em> <strong>-p</strong> <strong>-P</strong> <strong>-f</strong> <strong>-F</strong></dt>

<dd>The ticket granting ticket options only apply to the case where

there are no appropriate tickets in the cache to authenticate the

source user. In this case if ksu is configured to prompt users

@@ -296,58 +295,66 @@ for a Kerberos password (<strong>GET_TGT_VIA_PASSWD</strong> is defined), the

ticket granting ticket options that are specified will be used

when getting a ticket granting ticket from the Kerberos server.</dd>

<dt><strong>-l</strong> <em>lifetime</em></dt>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> string.) Specifies the lifetime to be requested

+<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> string.) Specifies the lifetime to be requested

for the ticket; if this option is not specified, the default ticket

lifetime (12 hours) is used instead.</dd>

-<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><em>Time duration</em></a> string.) Specifies that the <strong>renewable</strong> option

+<dd>(<a class="reference internal" href="../../basic/date_format.html#duration"><span class="std std-ref">Time duration</span></a> string.) Specifies that the <strong>renewable</strong> option

should be requested for the ticket, and specifies the desired

total lifetime of the ticket.</dd>

<dd>specifies that the <strong>proxiable</strong> option should be requested for

the ticket.</dd>

+<dt><strong>-P</strong></dt>

+<dd>specifies that the <strong>proxiable</strong> option should not be requested

+for the ticket, even if the default configuration is to ask for

+proxiable tickets.</dd>

<dd>option specifies that the <strong>forwardable</strong> option should be

requested for the ticket.</dd>

-<dt><strong>-e</strong> <em>command</em> [<em>args</em> ...]</dt>

+<dt><strong>-F</strong></dt>

+<dd>option specifies that the <strong>forwardable</strong> option should not be

+requested for the ticket, even if the default configuration is to

+ask for forwardable tickets.</dd>

+<dt><strong>-e</strong> <em>command</em> [<em>args</em> …]</dt>

<dd><p class="first">ksu proceeds exactly the same as if it was invoked without the

<strong>-e</strong> option, except instead of executing the target shell, ksu

executes the specified command. Example of usage:</p>

-<div class="highlight-python"><div class="highlight"><pre>ksu bob -e ls -lag

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">ksu</span> <span class="n">bob</span> <span class="o">-</span><span class="n">e</span> <span class="n">ls</span> <span class="o">-</span><span class="n">lag</span>

</pre></div>

</div>

<p>The authorization algorithm for <strong>-e</strong> is as follows:</p>

<p>If the source user is root or source user == target user, no

authorization takes place and the command is executed. If source

-user id != 0, and <tt class="docutils literal"><span class="pre">~target_user/.k5users</span></tt> file does not exist,

-authorization fails. Otherwise, <tt class="docutils literal"><span class="pre">~target_user/.k5users</span></tt> file

+user id != 0, and <code class="docutils literal"><span class="pre">~target_user/.k5users</span></code> file does not exist,

+authorization fails. Otherwise, <code class="docutils literal"><span class="pre">~target_user/.k5users</span></code> file

must have an appropriate entry for target principal to get

authorized.</p>

<p>The .k5users file format:</p>

<p>A single principal entry on each line that may be followed by a

list of commands that the principal is authorized to execute. A

-principal name followed by a <tt class="docutils literal"><span class="pre">*</span></tt> means that the user is

+principal name followed by a <code class="docutils literal"><span class="pre">*</span></code> means that the user is

authorized to execute any command. Thus, in the following

example:</p>

-<div class="highlight-python"><div class="highlight"><pre>jqpublic@USC.EDU ls mail /local/kerberos/klist

-jqpublic/secure@USC.EDU *

-jqpublic/admin@USC.EDU

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">jqpublic</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span> <span class="n">ls</span> <span class="n">mail</span> <span class="o">/</span><span class="n">local</span><span class="o">/</span><span class="n">kerberos</span><span class="o">/</span><span class="n">klist</span>

+<span class="n">jqpublic</span><span class="o">/</span><span class="n">secure</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span> <span class="o">*</span>

+<span class="n">jqpublic</span><span class="o">/</span><span class="n">admin</span><span class="nd">@USC</span><span class="o">.</span><span class="n">EDU</span>

</pre></div>

</div>

-<p><tt class="docutils literal"><span class="pre">jqpublic@USC.EDU</span></tt> is only authorized to execute <tt class="docutils literal"><span class="pre">ls</span></tt>,

-<tt class="docutils literal"><span class="pre">mail</span></tt> and <tt class="docutils literal"><span class="pre">klist</span></tt> commands. <tt class="docutils literal"><span class="pre">jqpublic/secure@USC.EDU</span></tt> is

-authorized to execute any command. <tt class="docutils literal"><span class="pre">jqpublic/admin@USC.EDU</span></tt> is

+<p><code class="docutils literal"><span class="pre">jqpublic@USC.EDU</span></code> is only authorized to execute <code class="docutils literal"><span class="pre">ls</span></code>,

+<code class="docutils literal"><span class="pre">mail</span></code> and <code class="docutils literal"><span class="pre">klist</span></code> commands. <code class="docutils literal"><span class="pre">jqpublic/secure@USC.EDU</span></code> is

+authorized to execute any command. <code class="docutils literal"><span class="pre">jqpublic/admin@USC.EDU</span></code> is

not authorized to execute any command. Note, that

-<tt class="docutils literal"><span class="pre">jqpublic/admin@USC.EDU</span></tt> is authorized to execute the target

+<code class="docutils literal"><span class="pre">jqpublic/admin@USC.EDU</span></code> is authorized to execute the target

shell (regular ksu, without the <strong>-e</strong> option) but

-<tt class="docutils literal"><span class="pre">jqpublic@USC.EDU</span></tt> is not.</p>

+<code class="docutils literal"><span class="pre">jqpublic@USC.EDU</span></code> is not.</p>

<p>The commands listed after the principal name must be either a full

path names or just the program name. In the second case,

<strong>CMD_PATH</strong> specifying the location of authorized programs must

be defined at the compilation time of ksu. Which command gets

executed?</p>

<p class="last">If the source user is root or the target user is the source user

-or the user is authorized to execute any command (<tt class="docutils literal"><span class="pre">*</span></tt> entry)

+or the user is authorized to execute any command (<code class="docutils literal"><span class="pre">*</span></code> entry)

then command can be either a full or a relative path leading to

the target program. Otherwise, the user must specify either a

full path or just the program name.</p>

@@ -358,7 +365,7 @@ flags and parameters following -a will be passed to the shell,

thus all options intended for ksu must precede <strong>-a</strong>.</p>

<p>The <strong>-a</strong> option can be used to simulate the <strong>-e</strong> option if

used as follows:</p>

-<div class="highlight-python"><div class="highlight"><pre>-a -c [command [arguments]].

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="o">-</span><span class="n">a</span> <span class="o">-</span><span class="n">c</span> <span class="p">[</span><span class="n">command</span> <span class="p">[</span><span class="n">arguments</span><span class="p">]]</span><span class="o">.</span>

</pre></div>

</div>

<p class="last"><strong>-c</strong> is interpreted by the c-shell to execute the command.</p>

@@ -385,19 +392,19 @@ the .k5users file as described in the OPTIONS section

<dd>Specifies a list of directories containing programs that users are

authorized to execute (via .k5users file).</dd>

<dt><strong>HAVE_GETUSERSHELL</strong></dt>

-<dd>If the source user is non-root, ksu insists that the target user’s

-shell to be invoked is a “legal shell”. <em>getusershell(3)</em> is

-called to obtain the names of “legal shells”. Note that the

-target user’s shell is obtained from the passwd file.</dd>

+<dd>If the source user is non-root, ksu insists that the target user’s

+shell to be invoked is a “legal shell”. <em>getusershell(3)</em> is

+called to obtain the names of “legal shells”. Note that the

+target user’s shell is obtained from the passwd file.</dd>

</dl>

<p>Sample configuration:</p>

-<div class="highlight-python"><div class="highlight"><pre>KSU_OPTS = -DGET_TGT_VIA_PASSWD -DPRINC_LOOK_AHEAD -DCMD_PATH='"/bin /usr/ucb /local/bin"

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">KSU_OPTS</span> <span class="o">=</span> <span class="o">-</span><span class="n">DGET_TGT_VIA_PASSWD</span> <span class="o">-</span><span class="n">DPRINC_LOOK_AHEAD</span> <span class="o">-</span><span class="n">DCMD_PATH</span><span class="o">=</span><span class="s1">'"/bin /usr/ucb /local/bin"</span>

</pre></div>

</div>

<p>ksu should be owned by root and have the set user id bit turned on.</p>

<p>ksu attempts to get a ticket for the end server just as Kerberized

telnet and rlogin. Thus, there must be an entry for the server in the

-Kerberos database (e.g., <tt class="docutils literal"><span class="pre">host/nii.isi.edu@ISI.EDU</span></tt>). The keytab

+Kerberos database (e.g., <code class="docutils literal"><span class="pre">host/nii.isi.edu@ISI.EDU</span></code>). The keytab

file must be in an appropriate location.</p>

</div>

@@ -408,6 +415,15 @@ file must be in an appropriate location.</p>

<h2>AUTHOR OF KSU<a class="headerlink" href="#author-of-ksu" title="Permalink to this headline">¶</a></h2>

<p>GENNADY (ARI) MEDVINSKY</p>

</div>

+<div class="section" id="environment">

+<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

+</div>

+<div class="section" id="see-also">

+<h2>SEE ALSO<a class="headerlink" href="#see-also" title="Permalink to this headline">¶</a></h2>

+<p><a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a>, <a class="reference internal" href="kinit.html#kinit-1"><span class="std std-ref">kinit</span></a></p>

+</div>

</div>

@@ -430,6 +446,8 @@ file must be in an appropriate location.</p>

<li><a class="reference internal" href="#installation-instructions">INSTALLATION INSTRUCTIONS</a></li>

<li><a class="reference internal" href="#side-effects">SIDE EFFECTS</a></li>

<li><a class="reference internal" href="#author-of-ksu">AUTHOR OF KSU</a></li>

+<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li>

+<li><a class="reference internal" href="#see-also">SEE ALSO</a></li>

</ul>

</li>

</ul>

@@ -447,7 +465,7 @@ file must be in an appropriate location.</p>

<li class="toctree-l3"><a class="reference internal" href="klist.html">klist</a></li>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">ksu</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">ksu</a></li>

<li class="toctree-l3"><a class="reference internal" href="kswitch.html">kswitch</a></li>

<li class="toctree-l3"><a class="reference internal" href="sclient.html">sclient</a></li>

@@ -483,8 +501,8 @@ file must be in an appropriate location.</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/kswitch.html b/doc/html/user/user_commands/kswitch.html
index c141ef3eb6c3..ce52574b1221 100644
--- a/doc/html/user/user_commands/kswitch.html
+++ b/doc/html/user/user_commands/kswitch.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kswitch — MIT Kerberos Documentation</title>

+ <title>kswitch — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="kswitch-1"></span><h1>kswitch<a class="headerlink" href="#kswitch" title="Permalink to this headline">¶</a></h1>

@@ -88,27 +86,20 @@ made primary.</dd>

</div>

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-<p>kswitch uses the following environment variables:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd>Location of the default Kerberos 5 credentials (ticket) cache, in

-the form <em>type</em>:<em>residual</em>. If no <em>type</em> prefix is present, the

-<strong>FILE</strong> type is assumed. The type of the default cache may

-determine the availability of a cache collection; for instance, a

-default cache of type <strong>DIR</strong> causes caches within the directory

-to be present in the collection.</dd>

-</dl>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFCCNAME</em></a></dt>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a></dt>

<dd>Default location of Kerberos 5 credentials cache</dd>

</dl>

</div>

-<p><a class="reference internal" href="kinit.html#kinit-1"><em>kinit</em></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><em>kdestroy</em></a>, <a class="reference internal" href="klist.html#klist-1"><em>klist</em></a>), kerberos(1)</p>

+<p><a class="reference internal" href="kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="klist.html#klist-1"><span class="std std-ref">klist</span></a>,

+<a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -145,7 +136,7 @@ to be present in the collection.</dd>

<li class="toctree-l3"><a class="reference internal" href="kpasswd.html">kpasswd</a></li>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">kswitch</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kswitch</a></li>

<li class="toctree-l3"><a class="reference internal" href="sclient.html">sclient</a></li>

</ul>

@@ -180,8 +171,8 @@ to be present in the collection.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ © <a href="../../copyright.html">Copyright</a> 1985-2023, MIT.

</div>

diff --git a/doc/html/user/user_commands/kvno.html b/doc/html/user/user_commands/kvno.html
index 99f37f9ff0cd..e9d4fbce4241 100644
--- a/doc/html/user/user_commands/kvno.html
+++ b/doc/html/user/user_commands/kvno.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>kvno — MIT Kerberos Documentation</title>

+ <title>kvno — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

@@ -70,12 +68,15 @@

[<strong>-c</strong> <em>ccache</em>]

[<strong>-e</strong> <em>etype</em>]

+[<strong>-k</strong> <em>keytab</em>]

[<strong>-q</strong>]

-[<strong>-h</strong>]

+[<strong>-u</strong> | <strong>-S</strong> <em>sname</em>]

[<strong>-P</strong>]

-[<strong>-S</strong> <em>sname</em>]

-[<strong>-U</strong> <em>for_user</em>]

-<em>service1 service2</em> ...</p>

+[<strong>–cached-only</strong>]

+[<strong>–no-store</strong>]

+[<strong>–out-cache</strong> <em>cache</em>]

+[[{<strong>-F</strong> <em>cert_file</em> | {<strong>-I</strong> | <strong>-U</strong>} <em>for_user</em>} [<strong>-P</strong>]] | <strong>–u2u</strong> <em>ccache</em>]

+<em>service1 service2</em> …</p>

</div>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

@@ -92,48 +93,71 @@ default)</dd>

<dd>Specifies the enctype which will be requested for the session key

of all the services named on the command line. This is useful in

certain backward compatibility situations.</dd>

+<dt><strong>-k</strong> <em>keytab</em></dt>

+<dd>Decrypt the acquired tickets using <em>keytab</em> to confirm their

+validity.</dd>

<dd>Suppress printing output when successful. If a service ticket

cannot be obtained, an error message will still be printed and

kvno will exit with nonzero status.</dd>

-<dt><strong>-h</strong></dt>

-<dd>Prints a usage statement and exits.</dd>

+<dt><strong>-u</strong></dt>

+<dd>Use the unknown name type in requested service principal names.

+This option Cannot be used with <em>-S</em>.</dd>

-<dd>Specifies that the <em>service1 service2</em> ... arguments are to be

+<dd>Specifies that the <em>service1 service2</em> … arguments are to be

treated as services for which credentials should be acquired using

constrained delegation. This option is only valid when used in

conjunction with protocol transition.</dd>

<dt><strong>-S</strong> <em>sname</em></dt>

-<dd>Specifies that the <em>service1 service2</em> ... arguments are

+<dd>Specifies that the <em>service1 service2</em> … arguments are

interpreted as hostnames, and the service principals are to be

constructed from those hostnames and the service name <em>sname</em>.

The service hostnames will be canonicalized according to the usual

rules for constructing service principals.</dd>

-<dt><strong>-U</strong> <em>for_user</em></dt>

+<dt><strong>-I</strong> <em>for_user</em></dt>

<dd>Specifies that protocol transition (S4U2Self) is to be used to

acquire a ticket on behalf of <em>for_user</em>. If constrained

delegation is not requested, the service name must match the

credentials cache client principal.</dd>

+<dt><strong>-U</strong> <em>for_user</em></dt>

+<dd>Same as -I, but treats <em>for_user</em> as an enterprise name.</dd>

+<dt><strong>-F</strong> <em>cert_file</em></dt>

+<dd>Specifies that protocol transition is to be used, identifying the

+client principal with the X.509 certificate in <em>cert_file</em>. The

+certificate file must be in PEM format.</dd>

+<dt><strong>–cached-only</strong></dt>

+<dd>Only retrieve credentials already present in the cache, not from

+the KDC. (Added in release 1.19.)</dd>

+<dt><strong>–no-store</strong></dt>

+<dd>Do not store retrieved credentials in the cache. If

+<strong>–out-cache</strong> is also specified, credentials will still be

+stored into the output credential cache. (Added in release 1.19.)</dd>

+<dt><strong>–out-cache</strong> <em>ccache</em></dt>

+<dd>Initialize <em>ccache</em> and store all retrieved credentials into it.

+Do not store acquired credentials in the input cache. (Added in

+release 1.19.)</dd>

+<dt><strong>–u2u</strong> <em>ccache</em></dt>

+<dd>Requests a user-to-user ticket. <em>ccache</em> must contain a local

+krbtgt ticket for the server principal. The reported version

+number will typically be 0, as the resulting ticket is not

+encrypted in the server’s long-term key.</dd>

</dl>

</div>

<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

-<p>kvno uses the following environment variable:</p>

-<dl class="docutils">

-<dt><strong>KRB5CCNAME</strong></dt>

-<dd>Location of the credentials (ticket) cache.</dd>

-</dl>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

<h2>FILES<a class="headerlink" href="#files" title="Permalink to this headline">¶</a></h2>

-<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><em>DEFCCNAME</em></a></dt>

+<dt><a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCCNAME</span></a></dt>

<dd>Default location of the credentials cache</dd>

</dl>

</div>

-<p><a class="reference internal" href="kinit.html#kinit-1"><em>kinit</em></a>, <a class="reference internal" href="kdestroy.html#kdestroy-1"><em>kdestroy</em></a></p>

</div>

@@ -171,7 +195,7 @@ credentials cache client principal.</dd>

<li class="toctree-l3"><a class="reference internal" href="krb5-config.html">krb5-config</a></li>

<li class="toctree-l3"><a class="reference internal" href="kswitch.html">kswitch</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">kvno</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kvno</a></li>

<li class="toctree-l3"><a class="reference internal" href="sclient.html">sclient</a></li>

</ul>

</li>

@@ -205,8 +229,8 @@ credentials cache client principal.</dd>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

</div>

diff --git a/doc/html/user/user_commands/sclient.html b/doc/html/user/user_commands/sclient.html
index 141ff0aaef1d..20e98668ae61 100644
--- a/doc/html/user/user_commands/sclient.html
+++ b/doc/html/user/user_commands/sclient.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>sclient — MIT Kerberos Documentation</title>

+ <title>sclient — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User commands" href="index.html" />

</head>

@@ -61,7 +59,7 @@

- <div class="body">

+ <div class="body" role="main">

<span id="sclient-1"></span><h1>sclient<a class="headerlink" href="#sclient" title="Permalink to this headline">¶</a></h1>

@@ -72,13 +70,18 @@

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

<p>sclient is a sample application, primarily useful for testing

-purposes. It contacts a sample server <a class="reference internal" href="../../admin/admin_commands/sserver.html#sserver-8"><em>sserver</em></a> and

+purposes. It contacts a sample server <a class="reference internal" href="../../admin/admin_commands/sserver.html#sserver-8"><span class="std std-ref">sserver</span></a> and

authenticates to it using Kerberos version 5 tickets, then displays

-the server’s response.</p>

+the server’s response.</p>

+</div>

+<div class="section" id="environment">

+<h2>ENVIRONMENT<a class="headerlink" href="#environment" title="Permalink to this headline">¶</a></h2>

+<p>See <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a> for a description of Kerberos environment

+variables.</p>

</div>

-<p><a class="reference internal" href="kinit.html#kinit-1"><em>kinit</em></a>, <a class="reference internal" href="../../admin/admin_commands/sserver.html#sserver-8"><em>sserver</em></a></p>

+<p><a class="reference internal" href="kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="../../admin/admin_commands/sserver.html#sserver-8"><span class="std std-ref">sserver</span></a>, <a class="reference internal" href="../user_config/kerberos.html#kerberos-7"><span class="std std-ref">kerberos</span></a></p>

</div>

@@ -93,6 +96,7 @@ the server’s response.</p>

<li><a class="reference internal" href="#">sclient</a><ul>

<li><a class="reference internal" href="#synopsis">SYNOPSIS</a></li>

<li><a class="reference internal" href="#description">DESCRIPTION</a></li>

+<li><a class="reference internal" href="#environment">ENVIRONMENT</a></li>

</ul>

</li>

@@ -114,7 +118,7 @@ the server’s response.</p>

<li class="toctree-l3"><a class="reference internal" href="kswitch.html">kswitch</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">sclient</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">sclient</a></li>

</ul>

</li>

</ul>

@@ -147,8 +151,8 @@ the server’s response.</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

</div>

diff --git a/doc/html/user/user_config/index.html b/doc/html/user/user_config/index.html
index 2d3bdd742bbc..da05e8baf631 100644
--- a/doc/html/user/user_config/index.html
+++ b/doc/html/user/user_config/index.html

@@ -1,34 +1,32 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>User config files — MIT Kerberos Documentation</title>

+ <title>User config files — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="For users" href="../index.html" />

- <link rel="next" title=".k5login" href="k5login.html" />

+ <link rel="next" title="kerberos" href="kerberos.html" />

</head>

<body>

@@ -44,7 +42,7 @@

accesskey="C">Contents</a> |

<a href="../tkt_mgmt.html" title="Ticket management"

accesskey="P">previous</a> |

- <a href="k5login.html" title=".k5login"

+ <a href="kerberos.html" title="kerberos"

accesskey="N">next</a> |

<a href="../../genindex.html" title="General Index"

accesskey="I">index</a> |

@@ -61,15 +59,16 @@

- <div class="body">

+ <div class="body" role="main">

<h1>User config files<a class="headerlink" href="#user-config-files" title="Permalink to this headline">¶</a></h1>

<p>The following files in your home directory can be used to control the

behavior of Kerberos as it applies to your account (unless they have

-been disabled by your host’s configuration):</p>

+been disabled by your host’s configuration):</p>

<ul>

+<li class="toctree-l1"><a class="reference internal" href="kerberos.html">kerberos</a></li>

<li class="toctree-l1"><a class="reference internal" href="k5login.html">.k5login</a></li>

<li class="toctree-l1"><a class="reference internal" href="k5identity.html">.k5identity</a></li>

</ul>

@@ -93,7 +92,8 @@ been disabled by your host’s configuration):</p>

<li class="toctree-l1 current"><a class="reference internal" href="../index.html">For users</a><ul class="current">

<li class="toctree-l2"><a class="reference internal" href="../pwd_mgmt.html">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

-<li class="toctree-l2 current"><a class="current reference internal" href="">User config files</a><ul>

+<li class="toctree-l2 current"><a class="current reference internal" href="#">User config files</a><ul>

+<li class="toctree-l3"><a class="reference internal" href="kerberos.html">kerberos</a></li>

<li class="toctree-l3"><a class="reference internal" href="k5login.html">.k5login</a></li>

<li class="toctree-l3"><a class="reference internal" href="k5identity.html">.k5identity</a></li>

</ul>

@@ -129,8 +129,8 @@ been disabled by your host’s configuration):</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

</div>

@@ -138,7 +138,7 @@ been disabled by your host’s configuration):</p>

>Contents</a> |

<a href="../tkt_mgmt.html" title="Ticket management"

>previous</a> |

- <a href="k5login.html" title=".k5login"

+ <a href="kerberos.html" title="kerberos"

>next</a> |

<a href="../../genindex.html" title="General Index"

>index</a> |

diff --git a/doc/html/user/user_config/k5identity.html b/doc/html/user/user_config/k5identity.html
index d1155590d7bc..fc38fdb6ec2c 100644
--- a/doc/html/user/user_config/k5identity.html
+++ b/doc/html/user/user_config/k5identity.html

@@ -1,33 +1,31 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>.k5identity — MIT Kerberos Documentation</title>

+ <title>.k5identity — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User config files" href="index.html" />

</head>

@@ -61,20 +59,20 @@

- <div class="body">

+ <div class="body" role="main">

<span id="k5identity-5"></span><h1>.k5identity<a class="headerlink" href="#k5identity" title="Permalink to this headline">¶</a></h1>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

-<p>The .k5identity file, which resides in a user’s home directory,

+<p>The .k5identity file, which resides in a user’s home directory,

contains a list of rules for selecting a client principals based on

the server being accessed. These rules are used to choose a

credential cache within the cache collection when possible.</p>

-<p>Blank lines and lines beginning with <tt class="docutils literal"><span class="pre">#</span></tt> are ignored. Each line has

+<p>Blank lines and lines beginning with <code class="docutils literal"><span class="pre">#</span></code> are ignored. Each line has

the form:</p>

-<div><em>principal</em> <em>field</em>=<em>value</em> ...</div></blockquote>

+<div><em>principal</em> <em>field</em>=<em>value</em> …</div></blockquote>

<p>If the server principal meets all of the field constraints, then

principal is chosen as the client principal. The following fields are

recognized:</p>

@@ -83,8 +81,8 @@ recognized:</p>

<dd>If the realm of the server principal is known, it is matched

against <em>value</em>, which may be a pattern using shell wildcards.

For host-based server principals, the realm will generally only be

-known if there is a <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#domain-realm"><em>[domain_realm]</em></a> section in

-<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a> with a mapping for the hostname.</dd>

+known if there is a <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#domain-realm"><span class="std std-ref">[domain_realm]</span></a> section in

+<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> with a mapping for the hostname.</dd>

<dt><strong>service</strong></dt>

<dd>If the server principal is a host-based principal, its service

component is matched against <em>value</em>, which may be a pattern using

@@ -104,19 +102,19 @@ cache.</p>

<h2>EXAMPLE<a class="headerlink" href="#example" title="Permalink to this headline">¶</a></h2>

<p>The following example .k5identity file selects the client principal

-<tt class="docutils literal"><span class="pre">alice@KRBTEST.COM</span></tt> if the server principal is within that realm,

-the principal <tt class="docutils literal"><span class="pre">alice/root@EXAMPLE.COM</span></tt> if the server host is within

-a servers subdomain, and the principal <tt class="docutils literal"><span class="pre">alice/mail@EXAMPLE.COM</span></tt> when

-accessing the IMAP service on <tt class="docutils literal"><span class="pre">mail.example.com</span></tt>:</p>

-<div class="highlight-python"><div class="highlight"><pre>alice@KRBTEST.COM realm=KRBTEST.COM

-alice/root@EXAMPLE.COM host=*.servers.example.com

-alice/mail@EXAMPLE.COM host=mail.example.com service=imap

+<code class="docutils literal"><span class="pre">alice@KRBTEST.COM</span></code> if the server principal is within that realm,

+the principal <code class="docutils literal"><span class="pre">alice/root@EXAMPLE.COM</span></code> if the server host is within

+a servers subdomain, and the principal <code class="docutils literal"><span class="pre">alice/mail@EXAMPLE.COM</span></code> when

+accessing the IMAP service on <code class="docutils literal"><span class="pre">mail.example.com</span></code>:</p>

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@KRBTEST</span><span class="o">.</span><span class="n">COM</span> <span class="n">realm</span><span class="o">=</span><span class="n">KRBTEST</span><span class="o">.</span><span class="n">COM</span>

+<span class="n">alice</span><span class="o">/</span><span class="n">root</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span> <span class="n">host</span><span class="o">=*.</span><span class="n">servers</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span>

+<span class="n">alice</span><span class="o">/</span><span class="n">mail</span><span class="nd">@EXAMPLE</span><span class="o">.</span><span class="n">COM</span> <span class="n">host</span><span class="o">=</span><span class="n">mail</span><span class="o">.</span><span class="n">example</span><span class="o">.</span><span class="n">com</span> <span class="n">service</span><span class="o">=</span><span class="n">imap</span>

</pre></div>

</div>

-<p>kerberos(1), <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a></p>

+<p>kerberos(1), <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a></p>

</div>

@@ -143,8 +141,9 @@ alice/mail@EXAMPLE.COM host=mail.example.com service=imap

<li class="toctree-l2"><a class="reference internal" href="../pwd_mgmt.html">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2 current"><a class="reference internal" href="index.html">User config files</a><ul class="current">

+<li class="toctree-l3"><a class="reference internal" href="kerberos.html">kerberos</a></li>

<li class="toctree-l3"><a class="reference internal" href="k5login.html">.k5login</a></li>

-<li class="toctree-l3 current"><a class="current reference internal" href="">.k5identity</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">.k5identity</a></li>

</ul>

</li>

<li class="toctree-l2"><a class="reference internal" href="../user_commands/index.html">User commands</a></li>

@@ -178,8 +177,8 @@ alice/mail@EXAMPLE.COM host=mail.example.com service=imap

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

</div>

diff --git a/doc/html/user/user_config/k5login.html b/doc/html/user/user_config/k5login.html
index f46db5c5f513..0d0fcdb24000 100644
--- a/doc/html/user/user_config/k5login.html
+++ b/doc/html/user/user_config/k5login.html

@@ -1,35 +1,33 @@

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

"http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

<head>

- <title>.k5login — MIT Kerberos Documentation</title>

+ <title>.k5login — MIT Kerberos Documentation</title>

var DOCUMENTATION_OPTIONS = {

URL_ROOT: '../../',

- VERSION: '1.16',

+ VERSION: '1.21.1',

COLLAPSE_INDEX: false,

FILE_SUFFIX: '.html',

- HAS_SOURCE: true

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

};

</script>

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

- <link rel="top" title="MIT Kerberos Documentation" href="../../index.html" />

- <link rel="up" title="User config files" href="index.html" />

- <link rel="prev" title="User config files" href="index.html" />

+ <link rel="prev" title="kerberos" href="kerberos.html" />

</head>

<body>

@@ -42,7 +40,7 @@

<a href="../../index.html" title="Full Table of Contents"

accesskey="C">Contents</a> |

- <a href="index.html" title="User config files"

+ <a href="kerberos.html" title="kerberos"

accesskey="P">previous</a> |

<a href="k5identity.html" title=".k5identity"

accesskey="N">next</a> |

@@ -61,48 +59,48 @@

- <div class="body">

+ <div class="body" role="main">

<span id="k5login-5"></span><h1>.k5login<a class="headerlink" href="#k5login" title="Permalink to this headline">¶</a></h1>

<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

-<p>The .k5login file, which resides in a user’s home directory, contains

+<p>The .k5login file, which resides in a user’s home directory, contains

a list of the Kerberos principals. Anyone with valid tickets for a

principal in the file is allowed host access with the UID of the user

in whose home directory the file resides. One common use is to place

-a .k5login file in root’s home directory, thereby granting system

+a .k5login file in root’s home directory, thereby granting system

administrators remote root access to the host via Kerberos.</p>

</div>

<h2>EXAMPLES<a class="headerlink" href="#examples" title="Permalink to this headline">¶</a></h2>

-<p>Suppose the user <tt class="docutils literal"><span class="pre">alice</span></tt> had a .k5login file in her home directory

+<p>Suppose the user <code class="docutils literal"><span class="pre">alice</span></code> had a .k5login file in her home directory

containing just the following line:</p>

-<div class="highlight-python"><div class="highlight"><pre>bob@FOOBAR.ORG

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">bob</span><span class="nd">@FOOBAR</span><span class="o">.</span><span class="n">ORG</span>

</pre></div>

</div>

-<p>This would allow <tt class="docutils literal"><span class="pre">bob</span></tt> to use Kerberos network applications, such as

-ssh(1), to access <tt class="docutils literal"><span class="pre">alice</span></tt>‘s account, using <tt class="docutils literal"><span class="pre">bob</span></tt>‘s Kerberos

+<p>This would allow <code class="docutils literal"><span class="pre">bob</span></code> to use Kerberos network applications, such as

+ssh(1), to access <code class="docutils literal"><span class="pre">alice</span></code>’s account, using <code class="docutils literal"><span class="pre">bob</span></code>’s Kerberos

tickets. In a default configuration (with <strong>k5login_authoritative</strong> set

-to true in <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><em>krb5.conf</em></a>), this .k5login file would not let

-<tt class="docutils literal"><span class="pre">alice</span></tt> use those network applications to access her account, since

+to true in <a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>), this .k5login file would not let

+<code class="docutils literal"><span class="pre">alice</span></code> use those network applications to access her account, since

she is not listed! With no .k5login file, or with <strong>k5login_authoritative</strong>

-set to false, a default rule would permit the principal <tt class="docutils literal"><span class="pre">alice</span></tt> in the

-machine’s default realm to access the <tt class="docutils literal"><span class="pre">alice</span></tt> account.</p>

-<p>Let us further suppose that <tt class="docutils literal"><span class="pre">alice</span></tt> is a system administrator.

+set to false, a default rule would permit the principal <code class="docutils literal"><span class="pre">alice</span></code> in the

+machine’s default realm to access the <code class="docutils literal"><span class="pre">alice</span></code> account.</p>

+<p>Let us further suppose that <code class="docutils literal"><span class="pre">alice</span></code> is a system administrator.

Alice and the other system administrators would have their principals

-in root’s .k5login file on each host:</p>

-<div class="highlight-python"><div class="highlight"><pre>alice@BLEEP.COM

+in root’s .k5login file on each host:</p>

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">alice</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

-joeadmin/root@BLEEP.COM

+<span class="n">joeadmin</span><span class="o">/</span><span class="n">root</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

</pre></div>

</div>

<p>This would allow either system administrator to log in to these hosts

using their Kerberos tickets instead of having to type the root

-password. Note that because <tt class="docutils literal"><span class="pre">bob</span></tt> retains the Kerberos tickets for

-his own principal, <tt class="docutils literal"><span class="pre">bob@FOOBAR.ORG</span></tt>, he would not have any of the

-privileges that require <tt class="docutils literal"><span class="pre">alice</span></tt>‘s tickets, such as root access to

-any of the site’s hosts, or the ability to change <tt class="docutils literal"><span class="pre">alice</span></tt>‘s

+password. Note that because <code class="docutils literal"><span class="pre">bob</span></code> retains the Kerberos tickets for

+his own principal, <code class="docutils literal"><span class="pre">bob@FOOBAR.ORG</span></code>, he would not have any of the

+privileges that require <code class="docutils literal"><span class="pre">alice</span></code>’s tickets, such as root access to

+any of the site’s hosts, or the ability to change <code class="docutils literal"><span class="pre">alice</span></code>’s

password.</p>

</div>

@@ -134,7 +132,8 @@ password.</p>

<li class="toctree-l2"><a class="reference internal" href="../pwd_mgmt.html">Password management</a></li>

<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

<li class="toctree-l2 current"><a class="reference internal" href="index.html">User config files</a><ul class="current">

-<li class="toctree-l3 current"><a class="current reference internal" href="">.k5login</a></li>

+<li class="toctree-l3"><a class="reference internal" href="kerberos.html">kerberos</a></li>

+<li class="toctree-l3 current"><a class="current reference internal" href="#">.k5login</a></li>

<li class="toctree-l3"><a class="reference internal" href="k5identity.html">.k5identity</a></li>

</ul>

</li>

@@ -169,14 +168,14 @@ password.</p>

- <div class="right" ><i>Release: 1.16</i><br />

+ <div class="right" ><i>Release: 1.21.1</i><br />

</div>

<a href="../../index.html" title="Full Table of Contents"

>Contents</a> |

- <a href="index.html" title="User config files"

+ <a href="kerberos.html" title="kerberos"

>previous</a> |

<a href="k5identity.html" title=".k5identity"

>next</a> |

diff --git a/doc/html/user/user_config/kerberos.html b/doc/html/user/user_config/kerberos.html
new file mode 100644
index 000000000000..02227a3508ed
--- /dev/null
+++ b/doc/html/user/user_config/kerberos.html

@@ -0,0 +1,310 @@

+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN"

+ "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">

+<html xmlns="http://www.w3.org/1999/xhtml">

+ <head>

+ <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />

+ <title>kerberos — MIT Kerberos Documentation</title>

+ <link rel="stylesheet" href="../../_static/agogo.css" type="text/css" />

+ <link rel="stylesheet" href="../../_static/pygments.css" type="text/css" />

+ <link rel="stylesheet" href="../../_static/kerb.css" type="text/css" />

+ <script type="text/javascript">

+ var DOCUMENTATION_OPTIONS = {

+ URL_ROOT: '../../',

+ VERSION: '1.21.1',

+ COLLAPSE_INDEX: false,

+ FILE_SUFFIX: '.html',

+ HAS_SOURCE: true,

+ SOURCELINK_SUFFIX: '.txt'

+ };

+ </script>

+ <script type="text/javascript" src="../../_static/jquery.js"></script>

+ <script type="text/javascript" src="../../_static/underscore.js"></script>

+ <script type="text/javascript" src="../../_static/doctools.js"></script>

+ <link rel="author" title="About these documents" href="../../about.html" />

+ <link rel="index" title="Index" href="../../genindex.html" />

+ <link rel="search" title="Search" href="../../search.html" />

+ <link rel="copyright" title="Copyright" href="../../copyright.html" />

+ <link rel="next" title=".k5login" href="k5login.html" />

+ <link rel="prev" title="User config files" href="index.html" />

+ </head>

+ <body>

+ <div class="header-wrapper">

+ <div class="header">

+ <h1><a href="../../index.html">MIT Kerberos Documentation</a></h1>

+ <div class="rel">

+ <a href="../../index.html" title="Full Table of Contents"

+ accesskey="C">Contents</a> |

+ <a href="index.html" title="User config files"

+ accesskey="P">previous</a> |

+ <a href="k5login.html" title=".k5login"

+ accesskey="N">next</a> |

+ <a href="../../genindex.html" title="General Index"

+ accesskey="I">index</a> |

+ <a href="../../search.html" title="Enter search criteria"

+ accesskey="S">Search</a> |

+ <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__kerberos">feedback</a>

+ </div>

+ <div class="content-wrapper">

+ <div class="content">

+ <div class="document">

+ <div class="documentwrapper">

+ <div class="bodywrapper">

+ <div class="body" role="main">

+ <div class="section" id="kerberos">

+<span id="kerberos-7"></span><h1>kerberos<a class="headerlink" href="#kerberos" title="Permalink to this headline">¶</a></h1>

+<div class="section" id="description">

+<h2>DESCRIPTION<a class="headerlink" href="#description" title="Permalink to this headline">¶</a></h2>

+<p>The Kerberos system authenticates individual users in a network

+environment. After authenticating yourself to Kerberos, you can use

+Kerberos-enabled programs without having to present passwords or

+certificates to those programs.</p>

+<p>If you receive the following response from <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>:</p>

+<p>kinit: Client not found in Kerberos database while getting initial

+credentials</p>

+<p>you haven’t been registered as a Kerberos user. See your system

+administrator.</p>

+<p>A Kerberos name usually contains three parts. The first is the

+<strong>primary</strong>, which is usually a user’s or service’s name. The second

+is the <strong>instance</strong>, which in the case of a user is usually null.

+Some users may have privileged instances, however, such as <code class="docutils literal"><span class="pre">root</span></code> or

+<code class="docutils literal"><span class="pre">admin</span></code>. In the case of a service, the instance is the fully

+qualified name of the machine on which it runs; i.e. there can be an

+ssh service running on the machine ABC (<a class="reference external" href="mailto:ssh/ABC%40REALM">ssh/ABC<span>@</span>REALM</a>), which is

+different from the ssh service running on the machine XYZ

+(<a class="reference external" href="mailto:ssh/XYZ%40REALM">ssh/XYZ<span>@</span>REALM</a>). The third part of a Kerberos name is the <strong>realm</strong>.

+The realm corresponds to the Kerberos service providing authentication

+for the principal. Realms are conventionally all-uppercase, and often

+match the end of hostnames in the realm (for instance, host01.example.com

+might be in realm EXAMPLE.COM).</p>

+<p>When writing a Kerberos name, the principal name is separated from the

+instance (if not null) by a slash, and the realm (if not the local

+realm) follows, preceded by an “@” sign. The following are examples

+of valid Kerberos names:</p>

+<div class="highlight-default"><div class="highlight"><pre><span></span><span class="n">david</span>

+<span class="n">jennifer</span><span class="o">/</span><span class="n">admin</span>

+<span class="n">joeuser</span><span class="nd">@BLEEP</span><span class="o">.</span><span class="n">COM</span>

+<span class="n">cbrown</span><span class="o">/</span><span class="n">root</span><span class="nd">@FUBAR</span><span class="o">.</span><span class="n">ORG</span>

+</pre></div>

+</div>

+<p>When you authenticate yourself with Kerberos you get an initial

+Kerberos <strong>ticket</strong>. (A Kerberos ticket is an encrypted protocol

+message that provides authentication.) Kerberos uses this ticket for

+network utilities such as ssh. The ticket transactions are done

+transparently, so you don’t have to worry about their management.</p>

+<p>Note, however, that tickets expire. Administrators may configure more

+privileged tickets, such as those with service or instance of <code class="docutils literal"><span class="pre">root</span></code>

+or <code class="docutils literal"><span class="pre">admin</span></code>, to expire in a few minutes, while tickets that carry

+more ordinary privileges may be good for several hours or a day. If

+your login session extends beyond the time limit, you will have to

+re-authenticate yourself to Kerberos to get new tickets using the

+<a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> command.</p>

+<p>Some tickets are <strong>renewable</strong> beyond their initial lifetime. This

+means that <code class="docutils literal"><span class="pre">kinit</span> <span class="pre">-R</span></code> can extend their lifetime without requiring

+you to re-authenticate.</p>

+<p>If you wish to delete your local tickets, use the <a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>

+command.</p>

+<p>Kerberos tickets can be forwarded. In order to forward tickets, you

+must request <strong>forwardable</strong> tickets when you kinit. Once you have

+forwardable tickets, most Kerberos programs have a command line option

+to forward them to the remote host. This can be useful for, e.g.,

+running kinit on your local machine and then sshing into another to do

+work. Note that this should not be done on untrusted machines since

+they will then have your tickets.</p>

+</div>

+<div class="section" id="environment-variables">

+<h2>ENVIRONMENT VARIABLES<a class="headerlink" href="#environment-variables" title="Permalink to this headline">¶</a></h2>

+<p>Several environment variables affect the operation of Kerberos-enabled

+programs. These include:</p>

+<dl class="docutils">

+<dt><strong>KRB5CCNAME</strong></dt>

+<dd><p class="first">Default name for the credentials cache file, in the form

+<em>TYPE</em>:<em>residual</em>. The type of the default cache may determine

+the availability of a cache collection. <code class="docutils literal"><span class="pre">FILE</span></code> is not a

+collection type; <code class="docutils literal"><span class="pre">KEYRING</span></code>, <code class="docutils literal"><span class="pre">DIR</span></code>, and <code class="docutils literal"><span class="pre">KCM</span></code> are.</p>

+<p class="last">If not set, the value of <strong>default_ccache_name</strong> from

+configuration files (see <strong>KRB5_CONFIG</strong>) will be used. If that

+is also not set, the default <em>type</em> is <code class="docutils literal"><span class="pre">FILE</span></code>, and the

+<em>residual</em> is the path /tmp/krb5cc_*uid*, where <em>uid</em> is the

+decimal user ID of the user.</p>

+</dd>

+<dt><strong>KRB5_KTNAME</strong></dt>

+<dd>Specifies the location of the default keytab file, in the form

+<em>TYPE</em>:<em>residual</em>. If no <em>type</em> is present, the <strong>FILE</strong> type is

+assumed and <em>residual</em> is the pathname of the keytab file. If

+unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFKTNAME</span></a> will be used.</dd>

+<dt><strong>KRB5_CONFIG</strong></dt>

+<dd>Specifies the location of the Kerberos configuration file. The

+default is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/krb5.conf</span></code>. Multiple filenames can

+be specified, separated by a colon; all files which are present

+will be read.</dd>

+<dt><strong>KRB5_KDC_PROFILE</strong></dt>

+<dd>Specifies the location of the KDC configuration file, which

+contains additional configuration directives for the Key

+Distribution Center daemon and associated programs. The default

+is <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">LOCALSTATEDIR</span></a><code class="docutils literal"><span class="pre">/krb5kdc</span></code><code class="docutils literal"><span class="pre">/kdc.conf</span></code>.</dd>

+<dt><strong>KRB5RCACHENAME</strong></dt>

+<dd>(New in release 1.18) Specifies the location of the default replay

+cache, in the form <em>type</em>:<em>residual</em>. The <code class="docutils literal"><span class="pre">file2</span></code> type with a

+pathname residual specifies a replay cache file in the version-2

+format in the specified location. The <code class="docutils literal"><span class="pre">none</span></code> type (residual is

+ignored) disables the replay cache. The <code class="docutils literal"><span class="pre">dfl</span></code> type (residual is

+ignored) indicates the default, which uses a file2 replay cache in

+a temporary directory. The default is <code class="docutils literal"><span class="pre">dfl:</span></code>.</dd>

+<dt><strong>KRB5RCACHETYPE</strong></dt>

+<dd>Specifies the type of the default replay cache, if

+<strong>KRB5RCACHENAME</strong> is unspecified. No residual can be specified,

+so <code class="docutils literal"><span class="pre">none</span></code> and <code class="docutils literal"><span class="pre">dfl</span></code> are the only useful types.</dd>

+<dt><strong>KRB5RCACHEDIR</strong></dt>

+<dd>Specifies the directory used by the <code class="docutils literal"><span class="pre">dfl</span></code> replay cache type.

+The default is the value of the <strong>TMPDIR</strong> environment variable,

+or <code class="docutils literal"><span class="pre">/var/tmp</span></code> if <strong>TMPDIR</strong> is not set.</dd>

+<dt><strong>KRB5_TRACE</strong></dt>

+<dd>Specifies a filename to write trace log output to. Trace logs can

+help illuminate decisions made internally by the Kerberos

+libraries. For example, <code class="docutils literal"><span class="pre">env</span> <span class="pre">KRB5_TRACE=/dev/stderr</span> <span class="pre">kinit</span></code>

+would send tracing information for <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a> to

+<code class="docutils literal"><span class="pre">/dev/stderr</span></code>. The default is not to write trace log output

+anywhere.</dd>

+<dt><strong>KRB5_CLIENT_KTNAME</strong></dt>

+<dd>Default client keytab file name. If unset, <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">DEFCKTNAME</span></a> will be

+used).</dd>

+<dt><strong>KPROP_PORT</strong></dt>

+<dd><a class="reference internal" href="../../admin/admin_commands/kprop.html#kprop-8"><span class="std std-ref">kprop</span></a> port to use. Defaults to 754.</dd>

+<dt><strong>GSS_MECH_CONFIG</strong></dt>

+<dd>Specifies a filename containing GSSAPI mechanism module

+configuration. The default is to read <a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech</span></code>

+and files with a <code class="docutils literal"><span class="pre">.conf</span></code> suffix within the directory

+<a class="reference internal" href="../../mitK5defaults.html#paths"><span class="std std-ref">SYSCONFDIR</span></a><code class="docutils literal"><span class="pre">/gss/mech.d</span></code>.</dd>

+</dl>

+<p>Most environment variables are disabled for certain programs, such as

+login system programs and setuid programs, which are designed to be

+secure when run within an untrusted process environment.</p>

+</div>

+<div class="section" id="see-also">

+<h2>SEE ALSO<a class="headerlink" href="#see-also" title="Permalink to this headline">¶</a></h2>

+<p><a class="reference internal" href="../user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, <a class="reference internal" href="../user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, <a class="reference internal" href="../user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a>,

+<a class="reference internal" href="../user_commands/kswitch.html#kswitch-1"><span class="std std-ref">kswitch</span></a>, <a class="reference internal" href="../user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>, <a class="reference internal" href="../user_commands/ksu.html#ksu-1"><span class="std std-ref">ksu</span></a>,

+<a class="reference internal" href="../../admin/conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a>, <a class="reference internal" href="../../admin/conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a>, <a class="reference internal" href="../../admin/admin_commands/kadmin_local.html#kadmin-1"><span class="std std-ref">kadmin</span></a>,

+<a class="reference internal" href="../../admin/admin_commands/kadmind.html#kadmind-8"><span class="std std-ref">kadmind</span></a>, <a class="reference internal" href="../../admin/admin_commands/kdb5_util.html#kdb5-util-8"><span class="std std-ref">kdb5_util</span></a>, <a class="reference internal" href="../../admin/admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a></p>

+</div>

+<div class="section" id="bugs">

+<h2>BUGS<a class="headerlink" href="#bugs" title="Permalink to this headline">¶</a></h2>

+</div>

+<div class="section" id="authors">

+<h2>AUTHORS<a class="headerlink" href="#authors" title="Permalink to this headline">¶</a></h2>

+<div class="line-block">

+<div class="line">Steve Miller, MIT Project Athena/Digital Equipment Corporation</div>

+<div class="line">Clifford Neuman, MIT Project Athena</div>

+<div class="line">Greg Hudson, MIT Kerberos Consortium</div>

+<div class="line">Robbie Harwood, Red Hat, Inc.</div>

+</div>

+<div class="section" id="history">

+<h2>HISTORY<a class="headerlink" href="#history" title="Permalink to this headline">¶</a></h2>

+<p>The MIT Kerberos 5 implementation was developed at MIT, with

+contributions from many outside parties. It is currently maintained

+by the MIT Kerberos Consortium.</p>

+</div>

+<div class="section" id="restrictions">

+<h2>RESTRICTIONS<a class="headerlink" href="#restrictions" title="Permalink to this headline">¶</a></h2>

+Institute of Technology</p>

+</div>

+ </div>

+ <div class="sidebar">

+ <h2>On this page</h2>

+ <ul>

+<li><a class="reference internal" href="#">kerberos</a><ul>

+<li><a class="reference internal" href="#description">DESCRIPTION</a></li>

+<li><a class="reference internal" href="#environment-variables">ENVIRONMENT VARIABLES</a></li>

+<li><a class="reference internal" href="#see-also">SEE ALSO</a></li>

+<li><a class="reference internal" href="#bugs">BUGS</a></li>

+<li><a class="reference internal" href="#authors">AUTHORS</a></li>

+<li><a class="reference internal" href="#history">HISTORY</a></li>

+<li><a class="reference internal" href="#restrictions">RESTRICTIONS</a></li>

+</ul>

+</li>

+</ul>

+ <br/>

+ <h2>Table of contents</h2>

+ <ul class="current">

+<li class="toctree-l1 current"><a class="reference internal" href="../index.html">For users</a><ul class="current">

+<li class="toctree-l2"><a class="reference internal" href="../pwd_mgmt.html">Password management</a></li>

+<li class="toctree-l2"><a class="reference internal" href="../tkt_mgmt.html">Ticket management</a></li>

+<li class="toctree-l2 current"><a class="reference internal" href="index.html">User config files</a><ul class="current">

+<li class="toctree-l3 current"><a class="current reference internal" href="#">kerberos</a></li>

+<li class="toctree-l3"><a class="reference internal" href="k5login.html">.k5login</a></li>

+<li class="toctree-l3"><a class="reference internal" href="k5identity.html">.k5identity</a></li>

+</ul>

+</li>

+<li class="toctree-l2"><a class="reference internal" href="../user_commands/index.html">User commands</a></li>

+</ul>

+</li>

+<li class="toctree-l1"><a class="reference internal" href="../../admin/index.html">For administrators</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../appdev/index.html">For application developers</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../plugindev/index.html">For plugin module developers</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../build/index.html">Building Kerberos V5</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../basic/index.html">Kerberos V5 concepts</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../formats/index.html">Protocols and file formats</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../mitK5features.html">MIT Kerberos features</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../build_this.html">How to build this documentation from the source</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../about.html">Contributing to the MIT Kerberos Documentation</a></li>

+<li class="toctree-l1"><a class="reference internal" href="../../resources.html">Resources</a></li>

+</ul>

+ <br/>

+ <h4><a href="../../index.html">Full Table of Contents</a></h4>

+ <h4>Search</h4>

+ <form class="search" action="../../search.html" method="get">

+ <input type="text" name="q" size="18" />

+ <input type="submit" value="Go" />

+ <input type="hidden" name="check_keywords" value="yes" />

+ <input type="hidden" name="area" value="default" />

+ </form>

+ </div>

+ <div class="clearer"></div>

+ </div>

+ <div class="footer-wrapper">

+ <div class="footer" >

+ <div class="right" ><i>Release: 1.21.1</i><br />

+ </div>

+ <div class="left">

+ <a href="../../index.html" title="Full Table of Contents"

+ >Contents</a> |

+ <a href="index.html" title="User config files"

+ >previous</a> |

+ <a href="k5login.html" title=".k5login"

+ >next</a> |

+ <a href="../../genindex.html" title="General Index"

+ >index</a> |

+ <a href="../../search.html" title="Enter search criteria"

+ >Search</a> |

+ <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__kerberos">feedback</a>

+ </div>

+ </body>

+</html> \ No newline at end of file