1*7f2fe78bSCy Schubert 2*7f2fe78bSCy Schubert<!DOCTYPE html> 3*7f2fe78bSCy Schubert 4*7f2fe78bSCy Schubert<html> 5*7f2fe78bSCy Schubert <head> 6*7f2fe78bSCy Schubert <meta charset="utf-8" /> 7*7f2fe78bSCy Schubert <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" /> 8*7f2fe78bSCy Schubert 9*7f2fe78bSCy Schubert <title>PKINIT configuration — MIT Kerberos Documentation</title> 10*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/pygments.css" /> 11*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/agogo.css" /> 12*7f2fe78bSCy Schubert <link rel="stylesheet" type="text/css" href="../_static/kerb.css" /> 13*7f2fe78bSCy Schubert <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script> 14*7f2fe78bSCy Schubert <script src="../_static/jquery.js"></script> 15*7f2fe78bSCy Schubert <script src="../_static/underscore.js"></script> 16*7f2fe78bSCy Schubert <script src="../_static/doctools.js"></script> 17*7f2fe78bSCy Schubert <link rel="author" title="About these documents" href="../about.html" /> 18*7f2fe78bSCy Schubert <link rel="index" title="Index" href="../genindex.html" /> 19*7f2fe78bSCy Schubert <link rel="search" title="Search" href="../search.html" /> 20*7f2fe78bSCy Schubert <link rel="copyright" title="Copyright" href="../copyright.html" /> 21*7f2fe78bSCy Schubert <link rel="next" title="OTP Preauthentication" href="otp.html" /> 22*7f2fe78bSCy Schubert <link rel="prev" title="Backups of secure hosts" href="backup_host.html" /> 23*7f2fe78bSCy Schubert </head><body> 24*7f2fe78bSCy Schubert <div class="header-wrapper"> 25*7f2fe78bSCy Schubert <div class="header"> 26*7f2fe78bSCy Schubert 27*7f2fe78bSCy Schubert 28*7f2fe78bSCy Schubert <h1><a href="../index.html">MIT Kerberos Documentation</a></h1> 29*7f2fe78bSCy Schubert 30*7f2fe78bSCy Schubert <div class="rel"> 31*7f2fe78bSCy Schubert 32*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 33*7f2fe78bSCy Schubert accesskey="C">Contents</a> | 34*7f2fe78bSCy Schubert <a href="backup_host.html" title="Backups of secure hosts" 35*7f2fe78bSCy Schubert accesskey="P">previous</a> | 36*7f2fe78bSCy Schubert <a href="otp.html" title="OTP Preauthentication" 37*7f2fe78bSCy Schubert accesskey="N">next</a> | 38*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 39*7f2fe78bSCy Schubert accesskey="I">index</a> | 40*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 41*7f2fe78bSCy Schubert accesskey="S">Search</a> | 42*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__PKINIT configuration">feedback</a> 43*7f2fe78bSCy Schubert </div> 44*7f2fe78bSCy Schubert </div> 45*7f2fe78bSCy Schubert </div> 46*7f2fe78bSCy Schubert 47*7f2fe78bSCy Schubert <div class="content-wrapper"> 48*7f2fe78bSCy Schubert <div class="content"> 49*7f2fe78bSCy Schubert <div class="document"> 50*7f2fe78bSCy Schubert 51*7f2fe78bSCy Schubert <div class="documentwrapper"> 52*7f2fe78bSCy Schubert <div class="bodywrapper"> 53*7f2fe78bSCy Schubert <div class="body" role="main"> 54*7f2fe78bSCy Schubert 55*7f2fe78bSCy Schubert <section id="pkinit-configuration"> 56*7f2fe78bSCy Schubert<span id="pkinit"></span><h1>PKINIT configuration<a class="headerlink" href="#pkinit-configuration" title="Permalink to this headline">¶</a></h1> 57*7f2fe78bSCy Schubert<p>PKINIT is a preauthentication mechanism for Kerberos 5 which uses 58*7f2fe78bSCy SchubertX.509 certificates to authenticate the KDC to clients and vice versa. 59*7f2fe78bSCy SchubertPKINIT can also be used to enable anonymity support, allowing clients 60*7f2fe78bSCy Schubertto communicate securely with the KDC or with application servers 61*7f2fe78bSCy Schubertwithout authenticating as a particular client principal.</p> 62*7f2fe78bSCy Schubert<section id="creating-certificates"> 63*7f2fe78bSCy Schubert<h2>Creating certificates<a class="headerlink" href="#creating-certificates" title="Permalink to this headline">¶</a></h2> 64*7f2fe78bSCy Schubert<p>PKINIT requires an X.509 certificate for the KDC and one for each 65*7f2fe78bSCy Schubertclient principal which will authenticate using PKINIT. For anonymous 66*7f2fe78bSCy SchubertPKINIT, a KDC certificate is required, but client certificates are 67*7f2fe78bSCy Schubertnot. A commercially issued server certificate can be used for the KDC 68*7f2fe78bSCy Schubertcertificate, but generally cannot be used for client certificates.</p> 69*7f2fe78bSCy Schubert<p>The instruction in this section describe how to establish a 70*7f2fe78bSCy Schubertcertificate authority and create standard PKINIT certificates. Skip 71*7f2fe78bSCy Schubertthis section if you are using a commercially issued server certificate 72*7f2fe78bSCy Schubertas the KDC certificate for anonymous PKINIT, or if you are configuring 73*7f2fe78bSCy Schuberta client to use an Active Directory KDC.</p> 74*7f2fe78bSCy Schubert<section id="generating-a-certificate-authority-certificate"> 75*7f2fe78bSCy Schubert<h3>Generating a certificate authority certificate<a class="headerlink" href="#generating-a-certificate-authority-certificate" title="Permalink to this headline">¶</a></h3> 76*7f2fe78bSCy Schubert<p>You can establish a new certificate authority (CA) for use with a 77*7f2fe78bSCy SchubertPKINIT deployment with the commands:</p> 78*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span> 79*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">key</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">x509</span> <span class="o">-</span><span class="n">out</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">days</span> <span class="mi">3650</span> 80*7f2fe78bSCy Schubert</pre></div> 81*7f2fe78bSCy Schubert</div> 82*7f2fe78bSCy Schubert<p>The second command will ask for the values of several certificate 83*7f2fe78bSCy Schubertfields. These fields can be set to any values. You can adjust the 84*7f2fe78bSCy Schubertexpiration time of the CA certificate by changing the number after 85*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">-days</span></code>. Since the CA certificate must be deployed to client 86*7f2fe78bSCy Schubertmachines each time it changes, it should normally have an expiration 87*7f2fe78bSCy Schuberttime far in the future; however, expiration times after 2037 may cause 88*7f2fe78bSCy Schubertinteroperability issues in rare circumstances.</p> 89*7f2fe78bSCy Schubert<p>The result of these commands will be two files, cakey.pem and 90*7f2fe78bSCy Schubertcacert.pem. cakey.pem will contain a 2048-bit RSA private key, which 91*7f2fe78bSCy Schubertmust be carefully protected. cacert.pem will contain the CA 92*7f2fe78bSCy Schubertcertificate, which must be placed in the filesystems of the KDC and 93*7f2fe78bSCy Schuberteach client host. cakey.pem will be required to create KDC and client 94*7f2fe78bSCy Schubertcertificates.</p> 95*7f2fe78bSCy Schubert</section> 96*7f2fe78bSCy Schubert<section id="generating-a-kdc-certificate"> 97*7f2fe78bSCy Schubert<h3>Generating a KDC certificate<a class="headerlink" href="#generating-a-kdc-certificate" title="Permalink to this headline">¶</a></h3> 98*7f2fe78bSCy Schubert<p>A KDC certificate for use with PKINIT is required to have some unusual 99*7f2fe78bSCy Schubertfields, which makes generating them with OpenSSL somewhat complicated. 100*7f2fe78bSCy SchubertFirst, you will need a file containing the following:</p> 101*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[kdc_cert] 102*7f2fe78bSCy SchubertbasicConstraints=CA:FALSE 103*7f2fe78bSCy SchubertkeyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement 104*7f2fe78bSCy SchubertextendedKeyUsage=1.3.6.1.5.2.3.5 105*7f2fe78bSCy SchubertsubjectKeyIdentifier=hash 106*7f2fe78bSCy SchubertauthorityKeyIdentifier=keyid,issuer 107*7f2fe78bSCy SchubertissuerAltName=issuer:copy 108*7f2fe78bSCy SchubertsubjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name 109*7f2fe78bSCy Schubert 110*7f2fe78bSCy Schubert[kdc_princ_name] 111*7f2fe78bSCy Schubertrealm=EXP:0,GeneralString:${ENV::REALM} 112*7f2fe78bSCy Schubertprincipal_name=EXP:1,SEQUENCE:kdc_principal_seq 113*7f2fe78bSCy Schubert 114*7f2fe78bSCy Schubert[kdc_principal_seq] 115*7f2fe78bSCy Schubertname_type=EXP:0,INTEGER:2 116*7f2fe78bSCy Schubertname_string=EXP:1,SEQUENCE:kdc_principals 117*7f2fe78bSCy Schubert 118*7f2fe78bSCy Schubert[kdc_principals] 119*7f2fe78bSCy Schubertprinc1=GeneralString:krbtgt 120*7f2fe78bSCy Schubertprinc2=GeneralString:${ENV::REALM} 121*7f2fe78bSCy Schubert</pre></div> 122*7f2fe78bSCy Schubert</div> 123*7f2fe78bSCy Schubert<p>If the above contents are placed in extensions.kdc, you can generate 124*7f2fe78bSCy Schubertand sign a KDC certificate with the following commands:</p> 125*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span> 126*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span> <span class="o">-</span><span class="n">key</span> <span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span> 127*7f2fe78bSCy Schubert<span class="n">env</span> <span class="n">REALM</span><span class="o">=</span><span class="n">YOUR_REALMNAME</span> <span class="n">openssl</span> <span class="n">x509</span> <span class="o">-</span><span class="n">req</span> <span class="o">-</span><span class="ow">in</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span> \ 128*7f2fe78bSCy Schubert <span class="o">-</span><span class="n">CAkey</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">CA</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdc</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">days</span> <span class="mi">365</span> \ 129*7f2fe78bSCy Schubert <span class="o">-</span><span class="n">extfile</span> <span class="n">extensions</span><span class="o">.</span><span class="n">kdc</span> <span class="o">-</span><span class="n">extensions</span> <span class="n">kdc_cert</span> <span class="o">-</span><span class="n">CAcreateserial</span> 130*7f2fe78bSCy Schubert<span class="n">rm</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span> 131*7f2fe78bSCy Schubert</pre></div> 132*7f2fe78bSCy Schubert</div> 133*7f2fe78bSCy Schubert<p>The second command will ask for the values of certificate fields, 134*7f2fe78bSCy Schubertwhich can be set to any values. In the third command, substitute your 135*7f2fe78bSCy SchubertKDC’s realm name for YOUR_REALMNAME. You can adjust the certificate’s 136*7f2fe78bSCy Schubertexpiration date by changing the number after <code class="docutils literal notranslate"><span class="pre">-days</span></code>. Remember to 137*7f2fe78bSCy Schubertcreate a new KDC certificate before the old one expires.</p> 138*7f2fe78bSCy Schubert<p>The result of this operation will be in two files, kdckey.pem and 139*7f2fe78bSCy Schubertkdc.pem. Both files must be placed in the KDC’s filesystem. 140*7f2fe78bSCy Schubertkdckey.pem, which contains the KDC’s private key, must be carefully 141*7f2fe78bSCy Schubertprotected.</p> 142*7f2fe78bSCy Schubert<p>If you examine the KDC certificate with <code class="docutils literal notranslate"><span class="pre">openssl</span> <span class="pre">x509</span> <span class="pre">-in</span> <span class="pre">kdc.pem</span> 143*7f2fe78bSCy Schubert<span class="pre">-text</span> <span class="pre">-noout</span></code>, OpenSSL will not know how to display the KDC principal 144*7f2fe78bSCy Schubertname in the Subject Alternative Name extension, so it will appear as 145*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">othername:<unsupported></span></code>. This is normal and does not mean 146*7f2fe78bSCy Schubertanything is wrong with the KDC certificate.</p> 147*7f2fe78bSCy Schubert</section> 148*7f2fe78bSCy Schubert<section id="generating-client-certificates"> 149*7f2fe78bSCy Schubert<h3>Generating client certificates<a class="headerlink" href="#generating-client-certificates" title="Permalink to this headline">¶</a></h3> 150*7f2fe78bSCy Schubert<p>PKINIT client certificates also must have some unusual certificate 151*7f2fe78bSCy Schubertfields. To generate a client certificate with OpenSSL for a 152*7f2fe78bSCy Schubertsingle-component principal name, you will need an extensions file 153*7f2fe78bSCy Schubert(different from the KDC extensions file above) containing:</p> 154*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[client_cert] 155*7f2fe78bSCy SchubertbasicConstraints=CA:FALSE 156*7f2fe78bSCy SchubertkeyUsage=digitalSignature,keyEncipherment,keyAgreement 157*7f2fe78bSCy SchubertextendedKeyUsage=1.3.6.1.5.2.3.4 158*7f2fe78bSCy SchubertsubjectKeyIdentifier=hash 159*7f2fe78bSCy SchubertauthorityKeyIdentifier=keyid,issuer 160*7f2fe78bSCy SchubertissuerAltName=issuer:copy 161*7f2fe78bSCy SchubertsubjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name 162*7f2fe78bSCy Schubert 163*7f2fe78bSCy Schubert[princ_name] 164*7f2fe78bSCy Schubertrealm=EXP:0,GeneralString:${ENV::REALM} 165*7f2fe78bSCy Schubertprincipal_name=EXP:1,SEQUENCE:principal_seq 166*7f2fe78bSCy Schubert 167*7f2fe78bSCy Schubert[principal_seq] 168*7f2fe78bSCy Schubertname_type=EXP:0,INTEGER:1 169*7f2fe78bSCy Schubertname_string=EXP:1,SEQUENCE:principals 170*7f2fe78bSCy Schubert 171*7f2fe78bSCy Schubert[principals] 172*7f2fe78bSCy Schubertprinc1=GeneralString:${ENV::CLIENT} 173*7f2fe78bSCy Schubert</pre></div> 174*7f2fe78bSCy Schubert</div> 175*7f2fe78bSCy Schubert<p>If the above contents are placed in extensions.client, you can 176*7f2fe78bSCy Schubertgenerate and sign a client certificate with the following commands:</p> 177*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span> 178*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">key</span> <span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">out</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span> 179*7f2fe78bSCy Schubert<span class="n">env</span> <span class="n">REALM</span><span class="o">=</span><span class="n">YOUR_REALMNAME</span> <span class="n">CLIENT</span><span class="o">=</span><span class="n">YOUR_PRINCNAME</span> <span class="n">openssl</span> <span class="n">x509</span> \ 180*7f2fe78bSCy Schubert <span class="o">-</span><span class="n">CAkey</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">CA</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">req</span> <span class="o">-</span><span class="ow">in</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span> \ 181*7f2fe78bSCy Schubert <span class="o">-</span><span class="n">extensions</span> <span class="n">client_cert</span> <span class="o">-</span><span class="n">extfile</span> <span class="n">extensions</span><span class="o">.</span><span class="n">client</span> \ 182*7f2fe78bSCy Schubert <span class="o">-</span><span class="n">days</span> <span class="mi">365</span> <span class="o">-</span><span class="n">out</span> <span class="n">client</span><span class="o">.</span><span class="n">pem</span> 183*7f2fe78bSCy Schubert<span class="n">rm</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span> 184*7f2fe78bSCy Schubert</pre></div> 185*7f2fe78bSCy Schubert</div> 186*7f2fe78bSCy Schubert<p>Normally, the first two commands should be run on the client host, and 187*7f2fe78bSCy Schubertthe resulting client.req file transferred to the certificate authority 188*7f2fe78bSCy Schuberthost for the third command. As in the previous steps, the second 189*7f2fe78bSCy Schubertcommand will ask for the values of certificate fields, which can be 190*7f2fe78bSCy Schubertset to any values. In the third command, substitute your realm’s name 191*7f2fe78bSCy Schubertfor YOUR_REALMNAME and the client’s principal name (without realm) for 192*7f2fe78bSCy SchubertYOUR_PRINCNAME. You can adjust the certificate’s expiration date by 193*7f2fe78bSCy Schubertchanging the number after <code class="docutils literal notranslate"><span class="pre">-days</span></code>.</p> 194*7f2fe78bSCy Schubert<p>The result of this operation will be two files, clientkey.pem and 195*7f2fe78bSCy Schubertclient.pem. Both files must be present on the client’s host; 196*7f2fe78bSCy Schubertclientkey.pem, which contains the client’s private key, must be 197*7f2fe78bSCy Schubertprotected from access by others.</p> 198*7f2fe78bSCy Schubert<p>As in the KDC certificate, OpenSSL will display the client principal 199*7f2fe78bSCy Schubertname as <code class="docutils literal notranslate"><span class="pre">othername:<unsupported></span></code> in the Subject Alternative Name 200*7f2fe78bSCy Schubertextension of a PKINIT client certificate.</p> 201*7f2fe78bSCy Schubert<p>If the client principal name contains more than one component 202*7f2fe78bSCy Schubert(e.g. <code class="docutils literal notranslate"><span class="pre">host/example.com@REALM</span></code>), the <code class="docutils literal notranslate"><span class="pre">[principals]</span></code> section of 203*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">extensions.client</span></code> must be altered to contain multiple entries. 204*7f2fe78bSCy Schubert(Simply setting <code class="docutils literal notranslate"><span class="pre">CLIENT</span></code> to <code class="docutils literal notranslate"><span class="pre">host/example.com</span></code> would generate a 205*7f2fe78bSCy Schubertcertificate for <code class="docutils literal notranslate"><span class="pre">host\/example.com@REALM</span></code> which would not match the 206*7f2fe78bSCy Schubertmulti-component principal name.) For a two-component principal, the 207*7f2fe78bSCy Schubertsection should read:</p> 208*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[principals] 209*7f2fe78bSCy Schubertprinc1=GeneralString:${ENV::CLIENT1} 210*7f2fe78bSCy Schubertprinc2=GeneralString:${ENV::CLIENT2} 211*7f2fe78bSCy Schubert</pre></div> 212*7f2fe78bSCy Schubert</div> 213*7f2fe78bSCy Schubert<p>The environment variables <code class="docutils literal notranslate"><span class="pre">CLIENT1</span></code> and <code class="docutils literal notranslate"><span class="pre">CLIENT2</span></code> must then be set 214*7f2fe78bSCy Schubertto the first and second components when running <code class="docutils literal notranslate"><span class="pre">openssl</span> <span class="pre">x509</span></code>.</p> 215*7f2fe78bSCy Schubert</section> 216*7f2fe78bSCy Schubert</section> 217*7f2fe78bSCy Schubert<section id="configuring-the-kdc"> 218*7f2fe78bSCy Schubert<h2>Configuring the KDC<a class="headerlink" href="#configuring-the-kdc" title="Permalink to this headline">¶</a></h2> 219*7f2fe78bSCy Schubert<p>The KDC must have filesystem access to the KDC certificate (kdc.pem) 220*7f2fe78bSCy Schubertand the KDC private key (kdckey.pem). Configure the following 221*7f2fe78bSCy Schubertrelation in the KDC’s <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file, either in the 222*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdcdefaults"><span class="std std-ref">[kdcdefaults]</span></a> section or in a <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection (with 223*7f2fe78bSCy Schubertappropriate pathnames):</p> 224*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_identity</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">kdc</span><span class="o">.</span><span class="n">pem</span><span class="p">,</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span> 225*7f2fe78bSCy Schubert</pre></div> 226*7f2fe78bSCy Schubert</div> 227*7f2fe78bSCy Schubert<p>If any clients will authenticate using regular (as opposed to 228*7f2fe78bSCy Schubertanonymous) PKINIT, the KDC must also have filesystem access to the CA 229*7f2fe78bSCy Schubertcertificate (cacert.pem), and the following configuration (with the 230*7f2fe78bSCy Schubertappropriate pathname):</p> 231*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> 232*7f2fe78bSCy Schubert</pre></div> 233*7f2fe78bSCy Schubert</div> 234*7f2fe78bSCy Schubert<p>Because of the larger size of requests and responses using PKINIT, you 235*7f2fe78bSCy Schubertmay also need to allow TCP access to the KDC:</p> 236*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kdc_tcp_listen</span> <span class="o">=</span> <span class="mi">88</span> 237*7f2fe78bSCy Schubert</pre></div> 238*7f2fe78bSCy Schubert</div> 239*7f2fe78bSCy Schubert<p>Restart the <a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a> daemon to pick up the configuration 240*7f2fe78bSCy Schubertchanges.</p> 241*7f2fe78bSCy Schubert<p>The principal entry for each PKINIT-using client must be configured to 242*7f2fe78bSCy Schubertrequire preauthentication. Ensure this with the command:</p> 243*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">'modprinc +requires_preauth YOUR_PRINCNAME'</span> 244*7f2fe78bSCy Schubert</pre></div> 245*7f2fe78bSCy Schubert</div> 246*7f2fe78bSCy Schubert<p>Starting with release 1.12, it is possible to remove the long-term 247*7f2fe78bSCy Schubertkeys of a principal entry, which can save some space in the database 248*7f2fe78bSCy Schubertand help to clarify some PKINIT-related error conditions by not asking 249*7f2fe78bSCy Schubertfor a password:</p> 250*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">'purgekeys -all YOUR_PRINCNAME'</span> 251*7f2fe78bSCy Schubert</pre></div> 252*7f2fe78bSCy Schubert</div> 253*7f2fe78bSCy Schubert<p>These principal options can also be specified at principal creation 254*7f2fe78bSCy Schuberttime as follows:</p> 255*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">'add_principal +requires_preauth -nokey YOUR_PRINCNAME'</span> 256*7f2fe78bSCy Schubert</pre></div> 257*7f2fe78bSCy Schubert</div> 258*7f2fe78bSCy Schubert<p>By default, the KDC requires PKINIT client certificates to have the 259*7f2fe78bSCy Schubertstandard Extended Key Usage and Subject Alternative Name attributes 260*7f2fe78bSCy Schubertfor PKINIT. Starting in release 1.16, it is possible to authorize 261*7f2fe78bSCy Schubertclient certificates based on the subject or other criteria instead of 262*7f2fe78bSCy Schubertthe standard PKINIT Subject Alternative Name, by setting the 263*7f2fe78bSCy Schubert<strong>pkinit_cert_match</strong> string attribute on each client principal entry. 264*7f2fe78bSCy SchubertFor example:</p> 265*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="n">set_string</span> <span class="n">user</span><span class="nd">@REALM</span> <span class="n">pkinit_cert_match</span> <span class="s2">"<SUBJECT>CN=user@REALM$"</span> 266*7f2fe78bSCy Schubert</pre></div> 267*7f2fe78bSCy Schubert</div> 268*7f2fe78bSCy Schubert<p>The <strong>pkinit_cert_match</strong> string attribute follows the syntax used by 269*7f2fe78bSCy Schubertthe <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> <strong>pkinit_cert_match</strong> relation. To allow the 270*7f2fe78bSCy Schubertuse of non-PKINIT client certificates, it will also be necessary to 271*7f2fe78bSCy Schubertdisable key usage checking using the <strong>pkinit_eku_checking</strong> relation; 272*7f2fe78bSCy Schubertfor example:</p> 273*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[</span><span class="n">kdcdefaults</span><span class="p">]</span> 274*7f2fe78bSCy Schubert <span class="n">pkinit_eku_checking</span> <span class="o">=</span> <span class="n">none</span> 275*7f2fe78bSCy Schubert</pre></div> 276*7f2fe78bSCy Schubert</div> 277*7f2fe78bSCy Schubert</section> 278*7f2fe78bSCy Schubert<section id="configuring-the-clients"> 279*7f2fe78bSCy Schubert<h2>Configuring the clients<a class="headerlink" href="#configuring-the-clients" title="Permalink to this headline">¶</a></h2> 280*7f2fe78bSCy Schubert<p>Client hosts must be configured to trust the issuing authority for the 281*7f2fe78bSCy SchubertKDC certificate. For a newly established certificate authority, the 282*7f2fe78bSCy Schubertclient host must have filesystem access to the CA certificate 283*7f2fe78bSCy Schubert(cacert.pem) and the following relation in <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> in the 284*7f2fe78bSCy Schubertappropriate <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> subsection (with appropriate pathnames):</p> 285*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> 286*7f2fe78bSCy Schubert</pre></div> 287*7f2fe78bSCy Schubert</div> 288*7f2fe78bSCy Schubert<p>If the KDC certificate is a commercially issued server certificate, 289*7f2fe78bSCy Schubertthe issuing certificate is most likely included in a system directory. 290*7f2fe78bSCy SchubertYou can specify it by filename as above, or specify the whole 291*7f2fe78bSCy Schubertdirectory like so:</p> 292*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">DIR</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">ssl</span><span class="o">/</span><span class="n">certs</span> 293*7f2fe78bSCy Schubert</pre></div> 294*7f2fe78bSCy Schubert</div> 295*7f2fe78bSCy Schubert<p>A commercially issued server certificate will usually not have the 296*7f2fe78bSCy Schubertstandard PKINIT principal name or Extended Key Usage extensions, so 297*7f2fe78bSCy Schubertthe following additional configuration is required:</p> 298*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_eku_checking</span> <span class="o">=</span> <span class="n">kpServerAuth</span> 299*7f2fe78bSCy Schubert<span class="n">pkinit_kdc_hostname</span> <span class="o">=</span> <span class="n">hostname</span><span class="o">.</span><span class="n">of</span><span class="o">.</span><span class="n">kdc</span><span class="o">.</span><span class="n">certificate</span> 300*7f2fe78bSCy Schubert</pre></div> 301*7f2fe78bSCy Schubert</div> 302*7f2fe78bSCy Schubert<p>Multiple <strong>pkinit_kdc_hostname</strong> relations can be configured to 303*7f2fe78bSCy Schubertrecognize multiple KDC certificates. If the KDC is an Active 304*7f2fe78bSCy SchubertDirectory domain controller, setting <strong>pkinit_kdc_hostname</strong> is 305*7f2fe78bSCy Schubertnecessary, but it should not be necessary to set 306*7f2fe78bSCy Schubert<strong>pkinit_eku_checking</strong>.</p> 307*7f2fe78bSCy Schubert<p>To perform regular (as opposed to anonymous) PKINIT authentication, a 308*7f2fe78bSCy Schubertclient host must have filesystem access to a client certificate 309*7f2fe78bSCy Schubert(client.pem), and the corresponding private key (clientkey.pem). 310*7f2fe78bSCy SchubertConfigure the following relations in the client host’s 311*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file in the appropriate <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> subsection 312*7f2fe78bSCy Schubert(with appropriate pathnames):</p> 313*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_identities</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">client</span><span class="o">.</span><span class="n">pem</span><span class="p">,</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span> 314*7f2fe78bSCy Schubert</pre></div> 315*7f2fe78bSCy Schubert</div> 316*7f2fe78bSCy Schubert<p>If the KDC and client are properly configured, it should now be 317*7f2fe78bSCy Schubertpossible to run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">username</span></code> without entering a password.</p> 318*7f2fe78bSCy Schubert</section> 319*7f2fe78bSCy Schubert<section id="anonymous-pkinit"> 320*7f2fe78bSCy Schubert<span id="id1"></span><h2>Anonymous PKINIT<a class="headerlink" href="#anonymous-pkinit" title="Permalink to this headline">¶</a></h2> 321*7f2fe78bSCy Schubert<p>Anonymity support in Kerberos allows a client to obtain a ticket 322*7f2fe78bSCy Schubertwithout authenticating as any particular principal. Such a ticket can 323*7f2fe78bSCy Schubertbe used as a FAST armor ticket, or to securely communicate with an 324*7f2fe78bSCy Schubertapplication server anonymously.</p> 325*7f2fe78bSCy Schubert<p>To configure anonymity support, you must generate or otherwise procure 326*7f2fe78bSCy Schuberta KDC certificate and configure the KDC host, but you do not need to 327*7f2fe78bSCy Schubertgenerate any client certificates. On the KDC, you must set the 328*7f2fe78bSCy Schubert<strong>pkinit_identity</strong> variable to provide the KDC certificate, but do 329*7f2fe78bSCy Schubertnot need to set the <strong>pkinit_anchors</strong> variable or store the issuing 330*7f2fe78bSCy Schubertcertificate if you won’t have any client certificates to verify. On 331*7f2fe78bSCy Schubertclient hosts, you must set the <strong>pkinit_anchors</strong> variable (and 332*7f2fe78bSCy Schubertpossibly <strong>pkinit_kdc_hostname</strong> and <strong>pkinit_eku_checking</strong>) in order 333*7f2fe78bSCy Schubertto trust the issuing authority for the KDC certificate, but do not 334*7f2fe78bSCy Schubertneed to set the <strong>pkinit_identities</strong> variable.</p> 335*7f2fe78bSCy Schubert<p>Anonymity support is not enabled by default. To enable it, you must 336*7f2fe78bSCy Schubertcreate the principal <code class="docutils literal notranslate"><span class="pre">WELLKNOWN/ANONYMOUS</span></code> using the command:</p> 337*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">'addprinc -randkey WELLKNOWN/ANONYMOUS'</span> 338*7f2fe78bSCy Schubert</pre></div> 339*7f2fe78bSCy Schubert</div> 340*7f2fe78bSCy Schubert<p>Some Kerberos deployments include application servers which lack 341*7f2fe78bSCy Schubertproper access control, and grant some level of access to any user who 342*7f2fe78bSCy Schubertcan authenticate. In such an environment, enabling anonymity support 343*7f2fe78bSCy Schuberton the KDC would present a security issue. If you need to enable 344*7f2fe78bSCy Schubertanonymity support for TGTs (for use as FAST armor tickets) without 345*7f2fe78bSCy Schubertenabling anonymous authentication to application servers, you can set 346*7f2fe78bSCy Schubertthe variable <strong>restrict_anonymous_to_tgt</strong> to <code class="docutils literal notranslate"><span class="pre">true</span></code> in the 347*7f2fe78bSCy Schubertappropriate <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection of the KDC’s 348*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file.</p> 349*7f2fe78bSCy Schubert<p>To obtain anonymous credentials on a client, run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-n</span></code>, or 350*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-n</span> <span class="pre">@REALMNAME</span></code> to specify a realm. The resulting tickets 351*7f2fe78bSCy Schubertwill have the client name <code class="docutils literal notranslate"><span class="pre">WELLKNOWN/ANONYMOUS@WELLKNOWN:ANONYMOUS</span></code>.</p> 352*7f2fe78bSCy Schubert</section> 353*7f2fe78bSCy Schubert<section id="freshness-tokens"> 354*7f2fe78bSCy Schubert<h2>Freshness tokens<a class="headerlink" href="#freshness-tokens" title="Permalink to this headline">¶</a></h2> 355*7f2fe78bSCy Schubert<p>Freshness tokens can ensure that the client has recently had access to 356*7f2fe78bSCy Schubertits certificate private key. If freshness tokens are not required by 357*7f2fe78bSCy Schubertthe KDC, a client program with temporary possession of the private key 358*7f2fe78bSCy Schubertcan compose requests for future timestamps and use them later.</p> 359*7f2fe78bSCy Schubert<p>In release 1.17 and later, freshness tokens are supported by the 360*7f2fe78bSCy Schubertclient and are sent by the KDC when the client indicates support for 361*7f2fe78bSCy Schubertthem. Because not all clients support freshness tokens yet, they are 362*7f2fe78bSCy Schubertnot required by default. To check if freshness tokens are supported 363*7f2fe78bSCy Schubertby a realm’s clients, look in the KDC logs for the lines:</p> 364*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">PKINIT</span><span class="p">:</span> <span class="n">freshness</span> <span class="n">token</span> <span class="n">received</span> <span class="kn">from</span> <span class="o"><</span><span class="n">client</span> <span class="n">principal</span><span class="o">></span> 365*7f2fe78bSCy Schubert<span class="n">PKINIT</span><span class="p">:</span> <span class="n">no</span> <span class="n">freshness</span> <span class="n">token</span> <span class="n">received</span> <span class="kn">from</span> <span class="o"><</span><span class="n">client</span> <span class="n">principal</span><span class="o">></span> 366*7f2fe78bSCy Schubert</pre></div> 367*7f2fe78bSCy Schubert</div> 368*7f2fe78bSCy Schubert<p>To require freshness tokens for all clients in a realm (except for 369*7f2fe78bSCy Schubertclients authenticating anonymously), set the 370*7f2fe78bSCy Schubert<strong>pkinit_require_freshness</strong> variable to <code class="docutils literal notranslate"><span class="pre">true</span></code> in the appropriate 371*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection of the KDC’s <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file. To 372*7f2fe78bSCy Schuberttest that this option is in effect, run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-X</span> <span class="pre">disable_freshness</span></code> 373*7f2fe78bSCy Schubertand verify that authentication is unsuccessful.</p> 374*7f2fe78bSCy Schubert</section> 375*7f2fe78bSCy Schubert</section> 376*7f2fe78bSCy Schubert 377*7f2fe78bSCy Schubert 378*7f2fe78bSCy Schubert <div class="clearer"></div> 379*7f2fe78bSCy Schubert </div> 380*7f2fe78bSCy Schubert </div> 381*7f2fe78bSCy Schubert </div> 382*7f2fe78bSCy Schubert </div> 383*7f2fe78bSCy Schubert <div class="sidebar"> 384*7f2fe78bSCy Schubert 385*7f2fe78bSCy Schubert <h2>On this page</h2> 386*7f2fe78bSCy Schubert <ul> 387*7f2fe78bSCy Schubert<li><a class="reference internal" href="#">PKINIT configuration</a><ul> 388*7f2fe78bSCy Schubert<li><a class="reference internal" href="#creating-certificates">Creating certificates</a><ul> 389*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-a-certificate-authority-certificate">Generating a certificate authority certificate</a></li> 390*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-a-kdc-certificate">Generating a KDC certificate</a></li> 391*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-client-certificates">Generating client certificates</a></li> 392*7f2fe78bSCy Schubert</ul> 393*7f2fe78bSCy Schubert</li> 394*7f2fe78bSCy Schubert<li><a class="reference internal" href="#configuring-the-kdc">Configuring the KDC</a></li> 395*7f2fe78bSCy Schubert<li><a class="reference internal" href="#configuring-the-clients">Configuring the clients</a></li> 396*7f2fe78bSCy Schubert<li><a class="reference internal" href="#anonymous-pkinit">Anonymous PKINIT</a></li> 397*7f2fe78bSCy Schubert<li><a class="reference internal" href="#freshness-tokens">Freshness tokens</a></li> 398*7f2fe78bSCy Schubert</ul> 399*7f2fe78bSCy Schubert</li> 400*7f2fe78bSCy Schubert</ul> 401*7f2fe78bSCy Schubert 402*7f2fe78bSCy Schubert <br/> 403*7f2fe78bSCy Schubert <h2>Table of contents</h2> 404*7f2fe78bSCy Schubert <ul class="current"> 405*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li> 406*7f2fe78bSCy Schubert<li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current"> 407*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li> 408*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li> 409*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li> 410*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li> 411*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li> 412*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li> 413*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li> 414*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li> 415*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li> 416*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li> 417*7f2fe78bSCy Schubert<li class="toctree-l2 current"><a class="current reference internal" href="#">PKINIT configuration</a></li> 418*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li> 419*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li> 420*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li> 421*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li> 422*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li> 423*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li> 424*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li> 425*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration programs</a></li> 426*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li> 427*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li> 428*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li> 429*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li> 430*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li> 431*7f2fe78bSCy Schubert</ul> 432*7f2fe78bSCy Schubert</li> 433*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li> 434*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li> 435*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li> 436*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li> 437*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li> 438*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li> 439*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li> 440*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li> 441*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li> 442*7f2fe78bSCy Schubert</ul> 443*7f2fe78bSCy Schubert 444*7f2fe78bSCy Schubert <br/> 445*7f2fe78bSCy Schubert <h4><a href="../index.html">Full Table of Contents</a></h4> 446*7f2fe78bSCy Schubert <h4>Search</h4> 447*7f2fe78bSCy Schubert <form class="search" action="../search.html" method="get"> 448*7f2fe78bSCy Schubert <input type="text" name="q" size="18" /> 449*7f2fe78bSCy Schubert <input type="submit" value="Go" /> 450*7f2fe78bSCy Schubert <input type="hidden" name="check_keywords" value="yes" /> 451*7f2fe78bSCy Schubert <input type="hidden" name="area" value="default" /> 452*7f2fe78bSCy Schubert </form> 453*7f2fe78bSCy Schubert 454*7f2fe78bSCy Schubert </div> 455*7f2fe78bSCy Schubert <div class="clearer"></div> 456*7f2fe78bSCy Schubert </div> 457*7f2fe78bSCy Schubert </div> 458*7f2fe78bSCy Schubert 459*7f2fe78bSCy Schubert <div class="footer-wrapper"> 460*7f2fe78bSCy Schubert <div class="footer" > 461*7f2fe78bSCy Schubert <div class="right" ><i>Release: 1.21.3</i><br /> 462*7f2fe78bSCy Schubert © <a href="../copyright.html">Copyright</a> 1985-2024, MIT. 463*7f2fe78bSCy Schubert </div> 464*7f2fe78bSCy Schubert <div class="left"> 465*7f2fe78bSCy Schubert 466*7f2fe78bSCy Schubert <a href="../index.html" title="Full Table of Contents" 467*7f2fe78bSCy Schubert >Contents</a> | 468*7f2fe78bSCy Schubert <a href="backup_host.html" title="Backups of secure hosts" 469*7f2fe78bSCy Schubert >previous</a> | 470*7f2fe78bSCy Schubert <a href="otp.html" title="OTP Preauthentication" 471*7f2fe78bSCy Schubert >next</a> | 472*7f2fe78bSCy Schubert <a href="../genindex.html" title="General Index" 473*7f2fe78bSCy Schubert >index</a> | 474*7f2fe78bSCy Schubert <a href="../search.html" title="Enter search criteria" 475*7f2fe78bSCy Schubert >Search</a> | 476*7f2fe78bSCy Schubert <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__PKINIT configuration">feedback</a> 477*7f2fe78bSCy Schubert </div> 478*7f2fe78bSCy Schubert </div> 479*7f2fe78bSCy Schubert </div> 480*7f2fe78bSCy Schubert 481*7f2fe78bSCy Schubert </body> 482*7f2fe78bSCy Schubert</html>