1.\" Copyright (c) 1998 - 2002 Kungliga Tekniska H�gskolan 2.\" (Royal Institute of Technology, Stockholm, Sweden). 3.\" All rights reserved. 4.\" 5.\" Redistribution and use in source and binary forms, with or without 6.\" modification, are permitted provided that the following conditions 7.\" are met: 8.\" 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 16.\" 3. Neither the name of the Institute nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE INSTITUTE AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE INSTITUTE OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" $Id: kinit.1,v 1.23 2003/04/06 17:49:05 lha Exp $ 33.\" 34.Dd May 29, 1998 35.Dt KINIT 1 36.Os HEIMDAL 37.Sh NAME 38.Nm kinit 39.Nm kauth 40.Nd acquire initial tickets 41.Sh SYNOPSIS 42.Nm kinit 43.Op Fl 4 | Fl -524init 44.Op Fl 9 | Fl -524convert 45.Op Fl -afslog 46.Oo Fl c Ar cachename \*(Ba Xo 47.Fl -cache= Ns Ar cachename 48.Xc 49.Oc 50.Op Fl f | Fl -forwardable 51.Oo Fl t Ar keytabname \*(Ba Xo 52.Fl -keytab= Ns Ar keytabname 53.Xc 54.Oc 55.Oo Fl l Ar time \*(Ba Xo 56.Fl -lifetime= Ns Ar time 57.Xc 58.Oc 59.Op Fl p | Fl -proxiable 60.Op Fl R | Fl -renew 61.Op Fl -renewable 62.Oo Fl r Ar time \*(Ba Xo 63.Fl -renewable-life= Ns Ar time 64.Xc 65.Oc 66.Oo Fl S Ar principal \*(Ba Xo 67.Fl -server= Ns Ar principal 68.Xc 69.Oc 70.Oo Fl s Ar time \*(Ba Xo 71.Fl -start-time= Ns Ar time 72.Xc 73.Oc 74.Op Fl k | Fl -use-keytab 75.Op Fl v | Fl -validate 76.Oo Fl e Ar enctypes \*(Ba Xo 77.Fl -enctypes= Ns Ar enctypes 78.Xc 79.Oc 80.Oo Fl a Ar addresses \*(Ba Xo 81.Fl -extra-addresses= Ns Ar addresses 82.Xc 83.Oc 84.Op Fl -fcache-version= Ns Ar integer 85.Op Fl -no-addresses 86.Op Fl -anonymous 87.Op Fl -version 88.Op Fl -help 89.Op Ar principal Op Ar command 90.Sh DESCRIPTION 91.Nm 92is used to authenticate to the Kerberos server as 93.Ar principal , 94or if none is given, a system generated default (typically your login 95name at the default realm), and acquire a ticket granting ticket that 96can later be used to obtain tickets for other services. 97.Pp 98If you have compiled 99.Nm kinit 100with Kerberos 4 support and you have a 101Kerberos 4 server, 102.Nm 103will detect this and get you Kerberos 4 tickets. 104.Pp 105Supported options: 106.Bl -tag -width Ds 107.It Xo 108.Fl c Ar cachename 109.Fl -cache= Ns Ar cachename 110.Xc 111The credentials cache to put the acquired ticket in, if other than 112default. 113.It Xo 114.Fl f , 115.Fl -forwardable 116.Xc 117Get ticket that can be forwarded to another host. 118.It Xo 119.Fl t Ar keytabname , 120.Fl -keytab= Ns Ar keytabname 121.Xc 122Don't ask for a password, but instead get the key from the specified 123keytab. 124.It Xo 125.Fl l Ar time , 126.Fl -lifetime= Ns Ar time 127.Xc 128Specifies the lifetime of the ticket. The argument can either be in 129seconds, or a more human readable string like 130.Sq 1h . 131.It Xo 132.Fl p , 133.Fl -proxiable 134.Xc 135Request tickets with the proxiable flag set. 136.It Xo 137.Fl R , 138.Fl -renew 139.Xc 140Try to renew ticket. The ticket must have the 141.Sq renewable 142flag set, and must not be expired. 143.It Fl -renewable 144The same as 145.Fl -renewable-life , 146with an infinite time. 147.It Xo 148.Fl r Ar time , 149.Fl -renewable-life= Ns Ar time 150.Xc 151The max renewable ticket life. 152.It Xo 153.Fl S Ar principal , 154.Fl -server= Ns Ar principal 155.Xc 156Get a ticket for a service other than krbtgt/LOCAL.REALM. 157.It Xo 158.Fl s Ar time , 159.Fl -start-time= Ns Ar time 160.Xc 161Obtain a ticket that starts to be valid 162.Ar time 163(which can really be a generic time specification, like 164.Sq 1h ) 165seconds into the future. 166.It Xo 167.Fl k , 168.Fl -use-keytab 169.Xc 170The same as 171.Fl -keytab , 172but with the default keytab name (normally 173.Ar FILE:/etc/krb5.keytab ) . 174.It Xo 175.Fl v , 176.Fl -validate 177.Xc 178Try to validate an invalid ticket. 179.It Xo 180.Fl e , 181.Fl -enctypes= Ns Ar enctypes 182.Xc 183Request tickets with this particular enctype. 184.It Xo 185.Fl -fcache-version= Ns Ar version 186.Xc 187Create a credentials cache of version 188.Nm version . 189.It Xo 190.Fl a , 191.Fl -extra-addresses= Ns Ar enctypes 192.Xc 193Adds a set of addresses that will, in addition to the systems local 194addresses, be put in the ticket. This can be useful if all addresses a 195client can use can't be automatically figured out. One such example is 196if the client is behind a firewall. Also settable via 197.Li libdefaults/extra_addresses 198in 199.Xr krb5.conf 5 . 200.It Xo 201.Fl -no-addresses 202.Xc 203Request a ticket with no addresses. 204.It Xo 205.Fl -anonymous 206.Xc 207Request an anonymous ticket (which means that the ticket will be 208issued to an anonymous principal, typically 209.Dq anonymous@REALM ) . 210.El 211.Pp 212The following options are only available if 213.Nm 214has been compiled with support for Kerberos 4. 215.Bl -tag -width Ds 216.It Xo 217.Fl 4 , 218.Fl -524init 219.Xc 220Try to convert the obtained Kerberos 5 krbtgt to a version 4 221compatible ticket. It will store this ticket in the default Kerberos 4 222ticket file. 223.It Xo 224.Fl 9 , 225.Fl -524convert 226.Xc 227only convert ticket to version 4 228.It Fl -afslog 229Gets AFS tickets, converts them to version 4 format, and stores them 230in the kernel. Only useful if you have AFS. 231.El 232.Pp 233The 234.Ar forwardable , 235.Ar proxiable , 236.Ar ticket_life , 237and 238.Ar renewable_life 239options can be set to a default value from the 240.Dv appdefaults 241section in krb5.conf, see 242.Xr krb5_appdefault 3 . 243.Pp 244If a 245.Ar command 246is given, 247.Nm kinit 248will setup new credentials caches, and AFS PAG, and then run the given 249command. When it finishes the credentials will be removed. 250.Sh ENVIRONMENT 251.Bl -tag -width Ds 252.It Ev KRB5CCNAME 253Specifies the default credentials cache. 254.It Ev KRB5_CONFIG 255The file name of 256.Pa krb5.conf 257, the default being 258.Pa /etc/krb5.conf . 259.It Ev KRBTKFILE 260Specifies the Kerberos 4 ticket file to store version 4 tickets in. 261.El 262.\".Sh FILES 263.\".Sh EXAMPLES 264.\".Sh DIAGNOSTICS 265.Sh SEE ALSO 266.Xr kdestroy 1 , 267.Xr klist 1 , 268.Xr krb5_appdefault 3 , 269.Xr krb5.conf 5 270.\".Sh STANDARDS 271.\".Sh HISTORY 272.\".Sh AUTHORS 273.\".Sh BUGS 274