1*7f2fe78bSCy Schubert 2*7f2fe78bSCy Schubert<!DOCTYPE html> 3*7f2fe78bSCy Schubert 4*7f2fe78bSCy Schubert<html> 5*7f2fe78bSCy Schubert <head> 6*7f2fe78bSCy Schubert <meta charset="utf-8" /> 7*7f2fe78bSCy Schubert <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" /> 8*7f2fe78bSCy Schubert 9*7f2fe78bSCy Schubert <title>Installing and configuring UNIX client machines — MIT Kerberos Documentation</title> 10*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/pygments.css" /> 11*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/agogo.css" /> 12*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/kerb.css" /> 13*7f2fe78bSCy Schubert <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script> 14*7f2fe78bSCy Schubert <script src="../_static/jquery.js"></script> 15*7f2fe78bSCy Schubert <script src="../_static/underscore.js"></script> 16*7f2fe78bSCy Schubert <script src="../_static/doctools.js"></script> 17*7f2fe78bSCy Schubert <link rel="author" title="About these documents" href="../about.html" /> 18*7f2fe78bSCy Schubert <link rel="index" title="Index" href="../genindex.html" /> 19*7f2fe78bSCy Schubert <link rel="search" title="Search" href="../search.html" /> 20*7f2fe78bSCy Schubert <link rel="copyright" title="Copyright" href="../copyright.html" /> 21*7f2fe78bSCy Schubert <link rel="next" title="UNIX Application Servers" href="install_appl_srv.html" /> 22*7f2fe78bSCy Schubert <link rel="prev" title="Installing KDCs" href="install_kdc.html" /> 23*7f2fe78bSCy Schubert </head><body> 24*7f2fe78bSCy Schubert <div class="header-wrapper"> 25*7f2fe78bSCy Schubert <div class="header"> 26*7f2fe78bSCy Schubert 27*7f2fe78bSCy Schubert 28*7f2fe78bSCy Schubert <h1><a href="../index.html">MIT Kerberos Documentation</a></h1> 29*7f2fe78bSCy Schubert 30*7f2fe78bSCy Schubert <div class="rel"> 31*7f2fe78bSCy Schubert 32*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 33*7f2fe78bSCy Schubert accesskey="C">Contents</a> | 34*7f2fe78bSCy Schubert <a href="install_kdc.html" title="Installing KDCs" 35*7f2fe78bSCy Schubert accesskey="P">previous</a> | 36*7f2fe78bSCy Schubert <a href="install_appl_srv.html" title="UNIX Application Servers" 37*7f2fe78bSCy Schubert accesskey="N">next</a> | 38*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 39*7f2fe78bSCy Schubert accesskey="I">index</a> | 40*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 41*7f2fe78bSCy Schubert accesskey="S">Search</a> | 42*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Installing and configuring UNIX client machines">feedback</a> 43*7f2fe78bSCy Schubert </div> 44*7f2fe78bSCy Schubert </div> 45*7f2fe78bSCy Schubert </div> 46*7f2fe78bSCy Schubert 47*7f2fe78bSCy Schubert <div class="content-wrapper"> 48*7f2fe78bSCy Schubert <div class="content"> 49*7f2fe78bSCy Schubert <div class="document"> 50*7f2fe78bSCy Schubert 51*7f2fe78bSCy Schubert <div class="documentwrapper"> 52*7f2fe78bSCy Schubert <div class="bodywrapper"> 53*7f2fe78bSCy Schubert <div class="body" role="main"> 54*7f2fe78bSCy Schubert 55*7f2fe78bSCy Schubert <section id="installing-and-configuring-unix-client-machines"> 56*7f2fe78bSCy Schubert<h1>Installing and configuring UNIX client machines<a class="headerlink" href="#installing-and-configuring-unix-client-machines" title="Permalink to this headline">¶</a></h1> 57*7f2fe78bSCy Schubert<p>The Kerberized client programs include <a class="reference internal" href="../user/user_commands/kinit.html#kinit-1"><span class="std std-ref">kinit</span></a>, 58*7f2fe78bSCy Schubert<a class="reference internal" href="../user/user_commands/klist.html#klist-1"><span class="std std-ref">klist</span></a>, <a class="reference internal" href="../user/user_commands/kdestroy.html#kdestroy-1"><span class="std std-ref">kdestroy</span></a>, and <a class="reference internal" href="../user/user_commands/kpasswd.html#kpasswd-1"><span class="std std-ref">kpasswd</span></a>. All of 59*7f2fe78bSCy Schubertthese programs are in the directory <a class="reference internal" href="../mitK5defaults.html#paths"><span class="std std-ref">BINDIR</span></a>.</p> 60*7f2fe78bSCy Schubert<p>You can often integrate Kerberos with the login system on client 61*7f2fe78bSCy Schubertmachines, typically through the use of PAM. The details vary by 62*7f2fe78bSCy Schubertoperating system, and should be covered in your operating system’s 63*7f2fe78bSCy Schubertdocumentation. If you do this, you will need to make sure your users 64*7f2fe78bSCy Schubertknow to use their Kerberos passwords when they log in.</p> 65*7f2fe78bSCy Schubert<p>You will also need to educate your users to use the ticket management 66*7f2fe78bSCy Schubertprograms kinit, klist, and kdestroy. If you do not have Kerberos 67*7f2fe78bSCy Schubertpassword changing integrated into the native password program (again, 68*7f2fe78bSCy Schuberttypically through PAM), you will need to educate users to use kpasswd 69*7f2fe78bSCy Schubertin place of its non-Kerberos counterparts passwd.</p> 70*7f2fe78bSCy Schubert<section id="client-machine-configuration-files"> 71*7f2fe78bSCy Schubert<h2>Client machine configuration files<a class="headerlink" href="#client-machine-configuration-files" title="Permalink to this headline">¶</a></h2> 72*7f2fe78bSCy Schubert<p>Each machine running Kerberos should have a <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file. 73*7f2fe78bSCy SchubertAt a minimum, it should define a <strong>default_realm</strong> setting in 74*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/krb5_conf.html#libdefaults"><span class="std std-ref">[libdefaults]</span></a>. If you are not using DNS SRV records 75*7f2fe78bSCy Schubert(<a class="reference internal" href="realm_config.html#kdc-hostnames"><span class="std std-ref">Hostnames for KDCs</span></a>) or URI records (<a class="reference internal" href="realm_config.html#kdc-discovery"><span class="std std-ref">KDC Discovery</span></a>), it must 76*7f2fe78bSCy Schubertalso contain a <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> section containing information for your 77*7f2fe78bSCy Schubertrealm’s KDCs.</p> 78*7f2fe78bSCy Schubert<p>Consider setting <strong>rdns</strong> to false in order to reduce your dependence 79*7f2fe78bSCy Schuberton precisely correct DNS information for service hostnames. Turning 80*7f2fe78bSCy Schubertthis flag off means that service hostnames will be canonicalized 81*7f2fe78bSCy Schubertthrough forward name resolution (which adds your domain name to 82*7f2fe78bSCy Schubertunqualified hostnames, and resolves CNAME records in DNS), but not 83*7f2fe78bSCy Schubertthrough reverse address lookup. The default value of this flag is 84*7f2fe78bSCy Schuberttrue for historical reasons only.</p> 85*7f2fe78bSCy Schubert<p>If you anticipate users frequently logging into remote hosts 86*7f2fe78bSCy Schubert(e.g., using ssh) using forwardable credentials, consider setting 87*7f2fe78bSCy Schubert<strong>forwardable</strong> to true so that users obtain forwardable tickets by 88*7f2fe78bSCy Schubertdefault. Otherwise users will need to use <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-f</span></code> to get 89*7f2fe78bSCy Schubertforwardable tickets.</p> 90*7f2fe78bSCy Schubert<p>Consider adjusting the <strong>ticket_lifetime</strong> setting to match the likely 91*7f2fe78bSCy Schubertlength of sessions for your users. For instance, if most of your 92*7f2fe78bSCy Schubertusers will be logging in for an eight-hour workday, you could set the 93*7f2fe78bSCy Schubertdefault to ten hours so that tickets obtained in the morning expire 94*7f2fe78bSCy Schubertshortly after the end of the workday. Users can still manually 95*7f2fe78bSCy Schubertrequest longer tickets when necessary, up to the maximum allowed by 96*7f2fe78bSCy Schuberteach user’s principal record on the KDC.</p> 97*7f2fe78bSCy Schubert<p>If a client host may access services in different realms, it may be 98*7f2fe78bSCy Schubertuseful to define a <a class="reference internal" href="conf_files/krb5_conf.html#domain-realm"><span class="std std-ref">[domain_realm]</span></a> mapping so that clients know 99*7f2fe78bSCy Schubertwhich hosts belong to which realms. However, if your clients and KDC 100*7f2fe78bSCy Schubertare running release 1.7 or later, it is also reasonable to leave this 101*7f2fe78bSCy Schubertsection out on client machines and just define it in the KDC’s 102*7f2fe78bSCy Schubertkrb5.conf.</p> 103*7f2fe78bSCy Schubert</section> 104*7f2fe78bSCy Schubert</section> 105*7f2fe78bSCy Schubert 106*7f2fe78bSCy Schubert 107*7f2fe78bSCy Schubert <div class="clearer"></div> 108*7f2fe78bSCy Schubert </div> 109*7f2fe78bSCy Schubert </div> 110*7f2fe78bSCy Schubert </div> 111*7f2fe78bSCy Schubert </div> 112*7f2fe78bSCy Schubert <div class="sidebar"> 113*7f2fe78bSCy Schubert 114*7f2fe78bSCy Schubert <h2>On this page</h2> 115*7f2fe78bSCy Schubert <ul> 116*7f2fe78bSCy Schubert<li><a class="reference internal" href="#">Installing and configuring UNIX client machines</a><ul> 117*7f2fe78bSCy Schubert<li><a class="reference internal" href="#client-machine-configuration-files">Client machine configuration files</a></li> 118*7f2fe78bSCy Schubert</ul> 119*7f2fe78bSCy Schubert</li> 120*7f2fe78bSCy Schubert</ul> 121*7f2fe78bSCy Schubert 122*7f2fe78bSCy Schubert <br/> 123*7f2fe78bSCy Schubert <h2>Table of contents</h2> 124*7f2fe78bSCy Schubert <ul class="current"> 125*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li> 126*7f2fe78bSCy Schubert<li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current"> 127*7f2fe78bSCy Schubert<li class="toctree-l2 current"><a class="reference internal" href="install.html">Installation guide</a><ul class="current"> 128*7f2fe78bSCy Schubert<li class="toctree-l3"><a class="reference internal" href="install_kdc.html">Installing KDCs</a></li> 129*7f2fe78bSCy Schubert<li class="toctree-l3 current"><a class="current reference internal" href="#">Installing and configuring UNIX client machines</a></li> 130*7f2fe78bSCy Schubert<li class="toctree-l3"><a class="reference internal" href="install_appl_srv.html">UNIX Application Servers</a></li> 131*7f2fe78bSCy Schubert</ul> 132*7f2fe78bSCy Schubert</li> 133*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li> 134*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li> 135*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li> 136*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li> 137*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li> 138*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> 139*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li> 140*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li> 141*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li> 142*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="pkinit.html">PKINIT configuration</a></li> 143*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li> 144*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li> 145*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li> 146*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li> 147*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li> 148*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li> 149*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li> 150*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration programs</a></li> 151*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li> 152*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li> 153*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li> 154*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li> 155*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li> 156*7f2fe78bSCy Schubert</ul> 157*7f2fe78bSCy Schubert</li> 158*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li> 159*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li> 160*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li> 161*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li> 162*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li> 163*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li> 164*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li> 165*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li> 166*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li> 167*7f2fe78bSCy Schubert</ul> 168*7f2fe78bSCy Schubert 169*7f2fe78bSCy Schubert <br/> 170*7f2fe78bSCy Schubert <h4><a href="../index.html">Full Table of Contents</a></h4> 171*7f2fe78bSCy Schubert <h4>Search</h4> 172*7f2fe78bSCy Schubert <form class="search" action="../search.html" method="get"> 173*7f2fe78bSCy Schubert <input type="text" name="q" size="18" /> 174*7f2fe78bSCy Schubert <input type="submit" value="Go" /> 175*7f2fe78bSCy Schubert <input type="hidden" name="check_keywords" value="yes" /> 176*7f2fe78bSCy Schubert <input type="hidden" name="area" value="default" /> 177*7f2fe78bSCy Schubert </form> 178*7f2fe78bSCy Schubert 179*7f2fe78bSCy Schubert </div> 180*7f2fe78bSCy Schubert <div class="clearer"></div> 181*7f2fe78bSCy Schubert </div> 182*7f2fe78bSCy Schubert </div> 183*7f2fe78bSCy Schubert 184*7f2fe78bSCy Schubert <div class="footer-wrapper"> 185*7f2fe78bSCy Schubert <div class="footer" > 186*7f2fe78bSCy Schubert <div class="right" ><i>Release: 1.21.3</i><br /> 187*7f2fe78bSCy Schubert © <a href="../copyright.html">Copyright</a> 1985-2024, MIT. 188*7f2fe78bSCy Schubert </div> 189*7f2fe78bSCy Schubert <div class="left"> 190*7f2fe78bSCy Schubert 191*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 192*7f2fe78bSCy Schubert >Contents</a> | 193*7f2fe78bSCy Schubert <a href="install_kdc.html" title="Installing KDCs" 194*7f2fe78bSCy Schubert >previous</a> | 195*7f2fe78bSCy Schubert <a href="install_appl_srv.html" title="UNIX Application Servers" 196*7f2fe78bSCy Schubert >next</a> | 197*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 198*7f2fe78bSCy Schubert >index</a> | 199*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 200*7f2fe78bSCy Schubert >Search</a> | 201*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__Installing and configuring UNIX client machines">feedback</a> 202*7f2fe78bSCy Schubert </div> 203*7f2fe78bSCy Schubert </div> 204*7f2fe78bSCy Schubert </div> 205*7f2fe78bSCy Schubert 206*7f2fe78bSCy Schubert </body> 207*7f2fe78bSCy Schubert</html>