xref: /freebsd/crypto/krb5/doc/html/admin/pkinit.html (revision 7f2fe78b9dd5f51c821d771b63d2e096f6fd49e9)
1*7f2fe78bSCy Schubert
2*7f2fe78bSCy Schubert<!DOCTYPE html>
3*7f2fe78bSCy Schubert
4*7f2fe78bSCy Schubert<html>
5*7f2fe78bSCy Schubert  <head>
6*7f2fe78bSCy Schubert    <meta charset="utf-8" />
7*7f2fe78bSCy Schubert    <meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="generator" content="Docutils 0.17.1: http://docutils.sourceforge.net/" />
8*7f2fe78bSCy Schubert
9*7f2fe78bSCy Schubert    <title>PKINIT configuration &#8212; MIT Kerberos Documentation</title>
10*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/pygments.css" />
11*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/agogo.css" />
12*7f2fe78bSCy Schubert    <link rel="stylesheet" type="text/css" href="../_static/kerb.css" />
13*7f2fe78bSCy Schubert    <script data-url_root="../" id="documentation_options" src="../_static/documentation_options.js"></script>
14*7f2fe78bSCy Schubert    <script src="../_static/jquery.js"></script>
15*7f2fe78bSCy Schubert    <script src="../_static/underscore.js"></script>
16*7f2fe78bSCy Schubert    <script src="../_static/doctools.js"></script>
17*7f2fe78bSCy Schubert    <link rel="author" title="About these documents" href="../about.html" />
18*7f2fe78bSCy Schubert    <link rel="index" title="Index" href="../genindex.html" />
19*7f2fe78bSCy Schubert    <link rel="search" title="Search" href="../search.html" />
20*7f2fe78bSCy Schubert    <link rel="copyright" title="Copyright" href="../copyright.html" />
21*7f2fe78bSCy Schubert    <link rel="next" title="OTP Preauthentication" href="otp.html" />
22*7f2fe78bSCy Schubert    <link rel="prev" title="Backups of secure hosts" href="backup_host.html" />
23*7f2fe78bSCy Schubert  </head><body>
24*7f2fe78bSCy Schubert    <div class="header-wrapper">
25*7f2fe78bSCy Schubert        <div class="header">
26*7f2fe78bSCy Schubert
27*7f2fe78bSCy Schubert
28*7f2fe78bSCy Schubert            <h1><a href="../index.html">MIT Kerberos Documentation</a></h1>
29*7f2fe78bSCy Schubert
30*7f2fe78bSCy Schubert            <div class="rel">
31*7f2fe78bSCy Schubert
32*7f2fe78bSCy Schubert        <a href="../index.html" title="Full Table of Contents"
33*7f2fe78bSCy Schubert            accesskey="C">Contents</a> |
34*7f2fe78bSCy Schubert        <a href="backup_host.html" title="Backups of secure hosts"
35*7f2fe78bSCy Schubert            accesskey="P">previous</a> |
36*7f2fe78bSCy Schubert        <a href="otp.html" title="OTP Preauthentication"
37*7f2fe78bSCy Schubert            accesskey="N">next</a> |
38*7f2fe78bSCy Schubert        <a href="../genindex.html" title="General Index"
39*7f2fe78bSCy Schubert            accesskey="I">index</a> |
40*7f2fe78bSCy Schubert        <a href="../search.html" title="Enter search criteria"
41*7f2fe78bSCy Schubert            accesskey="S">Search</a> |
42*7f2fe78bSCy Schubert    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__PKINIT configuration">feedback</a>
43*7f2fe78bSCy Schubert            </div>
44*7f2fe78bSCy Schubert        </div>
45*7f2fe78bSCy Schubert    </div>
46*7f2fe78bSCy Schubert
47*7f2fe78bSCy Schubert    <div class="content-wrapper">
48*7f2fe78bSCy Schubert      <div class="content">
49*7f2fe78bSCy Schubert        <div class="document">
50*7f2fe78bSCy Schubert
51*7f2fe78bSCy Schubert      <div class="documentwrapper">
52*7f2fe78bSCy Schubert        <div class="bodywrapper">
53*7f2fe78bSCy Schubert          <div class="body" role="main">
54*7f2fe78bSCy Schubert
55*7f2fe78bSCy Schubert  <section id="pkinit-configuration">
56*7f2fe78bSCy Schubert<span id="pkinit"></span><h1>PKINIT configuration<a class="headerlink" href="#pkinit-configuration" title="Permalink to this headline">¶</a></h1>
57*7f2fe78bSCy Schubert<p>PKINIT is a preauthentication mechanism for Kerberos 5 which uses
58*7f2fe78bSCy SchubertX.509 certificates to authenticate the KDC to clients and vice versa.
59*7f2fe78bSCy SchubertPKINIT can also be used to enable anonymity support, allowing clients
60*7f2fe78bSCy Schubertto communicate securely with the KDC or with application servers
61*7f2fe78bSCy Schubertwithout authenticating as a particular client principal.</p>
62*7f2fe78bSCy Schubert<section id="creating-certificates">
63*7f2fe78bSCy Schubert<h2>Creating certificates<a class="headerlink" href="#creating-certificates" title="Permalink to this headline">¶</a></h2>
64*7f2fe78bSCy Schubert<p>PKINIT requires an X.509 certificate for the KDC and one for each
65*7f2fe78bSCy Schubertclient principal which will authenticate using PKINIT.  For anonymous
66*7f2fe78bSCy SchubertPKINIT, a KDC certificate is required, but client certificates are
67*7f2fe78bSCy Schubertnot.  A commercially issued server certificate can be used for the KDC
68*7f2fe78bSCy Schubertcertificate, but generally cannot be used for client certificates.</p>
69*7f2fe78bSCy Schubert<p>The instruction in this section describe how to establish a
70*7f2fe78bSCy Schubertcertificate authority and create standard PKINIT certificates.  Skip
71*7f2fe78bSCy Schubertthis section if you are using a commercially issued server certificate
72*7f2fe78bSCy Schubertas the KDC certificate for anonymous PKINIT, or if you are configuring
73*7f2fe78bSCy Schuberta client to use an Active Directory KDC.</p>
74*7f2fe78bSCy Schubert<section id="generating-a-certificate-authority-certificate">
75*7f2fe78bSCy Schubert<h3>Generating a certificate authority certificate<a class="headerlink" href="#generating-a-certificate-authority-certificate" title="Permalink to this headline">¶</a></h3>
76*7f2fe78bSCy Schubert<p>You can establish a new certificate authority (CA) for use with a
77*7f2fe78bSCy SchubertPKINIT deployment with the commands:</p>
78*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span>
79*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">key</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">x509</span> <span class="o">-</span><span class="n">out</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">days</span> <span class="mi">3650</span>
80*7f2fe78bSCy Schubert</pre></div>
81*7f2fe78bSCy Schubert</div>
82*7f2fe78bSCy Schubert<p>The second command will ask for the values of several certificate
83*7f2fe78bSCy Schubertfields.  These fields can be set to any values.  You can adjust the
84*7f2fe78bSCy Schubertexpiration time of the CA certificate by changing the number after
85*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">-days</span></code>.  Since the CA certificate must be deployed to client
86*7f2fe78bSCy Schubertmachines each time it changes, it should normally have an expiration
87*7f2fe78bSCy Schuberttime far in the future; however, expiration times after 2037 may cause
88*7f2fe78bSCy Schubertinteroperability issues in rare circumstances.</p>
89*7f2fe78bSCy Schubert<p>The result of these commands will be two files, cakey.pem and
90*7f2fe78bSCy Schubertcacert.pem.  cakey.pem will contain a 2048-bit RSA private key, which
91*7f2fe78bSCy Schubertmust be carefully protected.  cacert.pem will contain the CA
92*7f2fe78bSCy Schubertcertificate, which must be placed in the filesystems of the KDC and
93*7f2fe78bSCy Schuberteach client host.  cakey.pem will be required to create KDC and client
94*7f2fe78bSCy Schubertcertificates.</p>
95*7f2fe78bSCy Schubert</section>
96*7f2fe78bSCy Schubert<section id="generating-a-kdc-certificate">
97*7f2fe78bSCy Schubert<h3>Generating a KDC certificate<a class="headerlink" href="#generating-a-kdc-certificate" title="Permalink to this headline">¶</a></h3>
98*7f2fe78bSCy Schubert<p>A KDC certificate for use with PKINIT is required to have some unusual
99*7f2fe78bSCy Schubertfields, which makes generating them with OpenSSL somewhat complicated.
100*7f2fe78bSCy SchubertFirst, you will need a file containing the following:</p>
101*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[kdc_cert]
102*7f2fe78bSCy SchubertbasicConstraints=CA:FALSE
103*7f2fe78bSCy SchubertkeyUsage=nonRepudiation,digitalSignature,keyEncipherment,keyAgreement
104*7f2fe78bSCy SchubertextendedKeyUsage=1.3.6.1.5.2.3.5
105*7f2fe78bSCy SchubertsubjectKeyIdentifier=hash
106*7f2fe78bSCy SchubertauthorityKeyIdentifier=keyid,issuer
107*7f2fe78bSCy SchubertissuerAltName=issuer:copy
108*7f2fe78bSCy SchubertsubjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:kdc_princ_name
109*7f2fe78bSCy Schubert
110*7f2fe78bSCy Schubert[kdc_princ_name]
111*7f2fe78bSCy Schubertrealm=EXP:0,GeneralString:${ENV::REALM}
112*7f2fe78bSCy Schubertprincipal_name=EXP:1,SEQUENCE:kdc_principal_seq
113*7f2fe78bSCy Schubert
114*7f2fe78bSCy Schubert[kdc_principal_seq]
115*7f2fe78bSCy Schubertname_type=EXP:0,INTEGER:2
116*7f2fe78bSCy Schubertname_string=EXP:1,SEQUENCE:kdc_principals
117*7f2fe78bSCy Schubert
118*7f2fe78bSCy Schubert[kdc_principals]
119*7f2fe78bSCy Schubertprinc1=GeneralString:krbtgt
120*7f2fe78bSCy Schubertprinc2=GeneralString:${ENV::REALM}
121*7f2fe78bSCy Schubert</pre></div>
122*7f2fe78bSCy Schubert</div>
123*7f2fe78bSCy Schubert<p>If the above contents are placed in extensions.kdc, you can generate
124*7f2fe78bSCy Schubertand sign a KDC certificate with the following commands:</p>
125*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span>
126*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span> <span class="o">-</span><span class="n">key</span> <span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span>
127*7f2fe78bSCy Schubert<span class="n">env</span> <span class="n">REALM</span><span class="o">=</span><span class="n">YOUR_REALMNAME</span> <span class="n">openssl</span> <span class="n">x509</span> <span class="o">-</span><span class="n">req</span> <span class="o">-</span><span class="ow">in</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span> \
128*7f2fe78bSCy Schubert    <span class="o">-</span><span class="n">CAkey</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">CA</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">out</span> <span class="n">kdc</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">days</span> <span class="mi">365</span> \
129*7f2fe78bSCy Schubert    <span class="o">-</span><span class="n">extfile</span> <span class="n">extensions</span><span class="o">.</span><span class="n">kdc</span> <span class="o">-</span><span class="n">extensions</span> <span class="n">kdc_cert</span> <span class="o">-</span><span class="n">CAcreateserial</span>
130*7f2fe78bSCy Schubert<span class="n">rm</span> <span class="n">kdc</span><span class="o">.</span><span class="n">req</span>
131*7f2fe78bSCy Schubert</pre></div>
132*7f2fe78bSCy Schubert</div>
133*7f2fe78bSCy Schubert<p>The second command will ask for the values of certificate fields,
134*7f2fe78bSCy Schubertwhich can be set to any values.  In the third command, substitute your
135*7f2fe78bSCy SchubertKDC’s realm name for YOUR_REALMNAME.  You can adjust the certificate’s
136*7f2fe78bSCy Schubertexpiration date by changing the number after <code class="docutils literal notranslate"><span class="pre">-days</span></code>.  Remember to
137*7f2fe78bSCy Schubertcreate a new KDC certificate before the old one expires.</p>
138*7f2fe78bSCy Schubert<p>The result of this operation will be in two files, kdckey.pem and
139*7f2fe78bSCy Schubertkdc.pem.  Both files must be placed in the KDC’s filesystem.
140*7f2fe78bSCy Schubertkdckey.pem, which contains the KDC’s private key, must be carefully
141*7f2fe78bSCy Schubertprotected.</p>
142*7f2fe78bSCy Schubert<p>If you examine the KDC certificate with <code class="docutils literal notranslate"><span class="pre">openssl</span> <span class="pre">x509</span> <span class="pre">-in</span> <span class="pre">kdc.pem</span>
143*7f2fe78bSCy Schubert<span class="pre">-text</span> <span class="pre">-noout</span></code>, OpenSSL will not know how to display the KDC principal
144*7f2fe78bSCy Schubertname in the Subject Alternative Name extension, so it will appear as
145*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">othername:&lt;unsupported&gt;</span></code>.  This is normal and does not mean
146*7f2fe78bSCy Schubertanything is wrong with the KDC certificate.</p>
147*7f2fe78bSCy Schubert</section>
148*7f2fe78bSCy Schubert<section id="generating-client-certificates">
149*7f2fe78bSCy Schubert<h3>Generating client certificates<a class="headerlink" href="#generating-client-certificates" title="Permalink to this headline">¶</a></h3>
150*7f2fe78bSCy Schubert<p>PKINIT client certificates also must have some unusual certificate
151*7f2fe78bSCy Schubertfields.  To generate a client certificate with OpenSSL for a
152*7f2fe78bSCy Schubertsingle-component principal name, you will need an extensions file
153*7f2fe78bSCy Schubert(different from the KDC extensions file above) containing:</p>
154*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[client_cert]
155*7f2fe78bSCy SchubertbasicConstraints=CA:FALSE
156*7f2fe78bSCy SchubertkeyUsage=digitalSignature,keyEncipherment,keyAgreement
157*7f2fe78bSCy SchubertextendedKeyUsage=1.3.6.1.5.2.3.4
158*7f2fe78bSCy SchubertsubjectKeyIdentifier=hash
159*7f2fe78bSCy SchubertauthorityKeyIdentifier=keyid,issuer
160*7f2fe78bSCy SchubertissuerAltName=issuer:copy
161*7f2fe78bSCy SchubertsubjectAltName=otherName:1.3.6.1.5.2.2;SEQUENCE:princ_name
162*7f2fe78bSCy Schubert
163*7f2fe78bSCy Schubert[princ_name]
164*7f2fe78bSCy Schubertrealm=EXP:0,GeneralString:${ENV::REALM}
165*7f2fe78bSCy Schubertprincipal_name=EXP:1,SEQUENCE:principal_seq
166*7f2fe78bSCy Schubert
167*7f2fe78bSCy Schubert[principal_seq]
168*7f2fe78bSCy Schubertname_type=EXP:0,INTEGER:1
169*7f2fe78bSCy Schubertname_string=EXP:1,SEQUENCE:principals
170*7f2fe78bSCy Schubert
171*7f2fe78bSCy Schubert[principals]
172*7f2fe78bSCy Schubertprinc1=GeneralString:${ENV::CLIENT}
173*7f2fe78bSCy Schubert</pre></div>
174*7f2fe78bSCy Schubert</div>
175*7f2fe78bSCy Schubert<p>If the above contents are placed in extensions.client, you can
176*7f2fe78bSCy Schubertgenerate and sign a client certificate with the following commands:</p>
177*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">openssl</span> <span class="n">genrsa</span> <span class="o">-</span><span class="n">out</span> <span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span> <span class="mi">2048</span>
178*7f2fe78bSCy Schubert<span class="n">openssl</span> <span class="n">req</span> <span class="o">-</span><span class="n">new</span> <span class="o">-</span><span class="n">key</span> <span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">out</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span>
179*7f2fe78bSCy Schubert<span class="n">env</span> <span class="n">REALM</span><span class="o">=</span><span class="n">YOUR_REALMNAME</span> <span class="n">CLIENT</span><span class="o">=</span><span class="n">YOUR_PRINCNAME</span> <span class="n">openssl</span> <span class="n">x509</span> \
180*7f2fe78bSCy Schubert    <span class="o">-</span><span class="n">CAkey</span> <span class="n">cakey</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">CA</span> <span class="n">cacert</span><span class="o">.</span><span class="n">pem</span> <span class="o">-</span><span class="n">req</span> <span class="o">-</span><span class="ow">in</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span> \
181*7f2fe78bSCy Schubert    <span class="o">-</span><span class="n">extensions</span> <span class="n">client_cert</span> <span class="o">-</span><span class="n">extfile</span> <span class="n">extensions</span><span class="o">.</span><span class="n">client</span> \
182*7f2fe78bSCy Schubert    <span class="o">-</span><span class="n">days</span> <span class="mi">365</span> <span class="o">-</span><span class="n">out</span> <span class="n">client</span><span class="o">.</span><span class="n">pem</span>
183*7f2fe78bSCy Schubert<span class="n">rm</span> <span class="n">client</span><span class="o">.</span><span class="n">req</span>
184*7f2fe78bSCy Schubert</pre></div>
185*7f2fe78bSCy Schubert</div>
186*7f2fe78bSCy Schubert<p>Normally, the first two commands should be run on the client host, and
187*7f2fe78bSCy Schubertthe resulting client.req file transferred to the certificate authority
188*7f2fe78bSCy Schuberthost for the third command.  As in the previous steps, the second
189*7f2fe78bSCy Schubertcommand will ask for the values of certificate fields, which can be
190*7f2fe78bSCy Schubertset to any values.  In the third command, substitute your realm’s name
191*7f2fe78bSCy Schubertfor YOUR_REALMNAME and the client’s principal name (without realm) for
192*7f2fe78bSCy SchubertYOUR_PRINCNAME.  You can adjust the certificate’s expiration date by
193*7f2fe78bSCy Schubertchanging the number after <code class="docutils literal notranslate"><span class="pre">-days</span></code>.</p>
194*7f2fe78bSCy Schubert<p>The result of this operation will be two files, clientkey.pem and
195*7f2fe78bSCy Schubertclient.pem.  Both files must be present on the client’s host;
196*7f2fe78bSCy Schubertclientkey.pem, which contains the client’s private key, must be
197*7f2fe78bSCy Schubertprotected from access by others.</p>
198*7f2fe78bSCy Schubert<p>As in the KDC certificate, OpenSSL will display the client principal
199*7f2fe78bSCy Schubertname as <code class="docutils literal notranslate"><span class="pre">othername:&lt;unsupported&gt;</span></code> in the Subject Alternative Name
200*7f2fe78bSCy Schubertextension of a PKINIT client certificate.</p>
201*7f2fe78bSCy Schubert<p>If the client principal name contains more than one component
202*7f2fe78bSCy Schubert(e.g. <code class="docutils literal notranslate"><span class="pre">host/example.com&#64;REALM</span></code>), the <code class="docutils literal notranslate"><span class="pre">[principals]</span></code> section of
203*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">extensions.client</span></code> must be altered to contain multiple entries.
204*7f2fe78bSCy Schubert(Simply setting <code class="docutils literal notranslate"><span class="pre">CLIENT</span></code> to <code class="docutils literal notranslate"><span class="pre">host/example.com</span></code> would generate a
205*7f2fe78bSCy Schubertcertificate for <code class="docutils literal notranslate"><span class="pre">host\/example.com&#64;REALM</span></code> which would not match the
206*7f2fe78bSCy Schubertmulti-component principal name.)  For a two-component principal, the
207*7f2fe78bSCy Schubertsection should read:</p>
208*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span>[principals]
209*7f2fe78bSCy Schubertprinc1=GeneralString:${ENV::CLIENT1}
210*7f2fe78bSCy Schubertprinc2=GeneralString:${ENV::CLIENT2}
211*7f2fe78bSCy Schubert</pre></div>
212*7f2fe78bSCy Schubert</div>
213*7f2fe78bSCy Schubert<p>The environment variables <code class="docutils literal notranslate"><span class="pre">CLIENT1</span></code> and <code class="docutils literal notranslate"><span class="pre">CLIENT2</span></code> must then be set
214*7f2fe78bSCy Schubertto the first and second components when running <code class="docutils literal notranslate"><span class="pre">openssl</span> <span class="pre">x509</span></code>.</p>
215*7f2fe78bSCy Schubert</section>
216*7f2fe78bSCy Schubert</section>
217*7f2fe78bSCy Schubert<section id="configuring-the-kdc">
218*7f2fe78bSCy Schubert<h2>Configuring the KDC<a class="headerlink" href="#configuring-the-kdc" title="Permalink to this headline">¶</a></h2>
219*7f2fe78bSCy Schubert<p>The KDC must have filesystem access to the KDC certificate (kdc.pem)
220*7f2fe78bSCy Schubertand the KDC private key (kdckey.pem).  Configure the following
221*7f2fe78bSCy Schubertrelation in the KDC’s <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file, either in the
222*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdcdefaults"><span class="std std-ref">[kdcdefaults]</span></a> section or in a <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection (with
223*7f2fe78bSCy Schubertappropriate pathnames):</p>
224*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_identity</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">kdc</span><span class="o">.</span><span class="n">pem</span><span class="p">,</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">kdckey</span><span class="o">.</span><span class="n">pem</span>
225*7f2fe78bSCy Schubert</pre></div>
226*7f2fe78bSCy Schubert</div>
227*7f2fe78bSCy Schubert<p>If any clients will authenticate using regular (as opposed to
228*7f2fe78bSCy Schubertanonymous) PKINIT, the KDC must also have filesystem access to the CA
229*7f2fe78bSCy Schubertcertificate (cacert.pem), and the following configuration (with the
230*7f2fe78bSCy Schubertappropriate pathname):</p>
231*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">var</span><span class="o">/</span><span class="n">lib</span><span class="o">/</span><span class="n">krb5kdc</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span>
232*7f2fe78bSCy Schubert</pre></div>
233*7f2fe78bSCy Schubert</div>
234*7f2fe78bSCy Schubert<p>Because of the larger size of requests and responses using PKINIT, you
235*7f2fe78bSCy Schubertmay also need to allow TCP access to the KDC:</p>
236*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kdc_tcp_listen</span> <span class="o">=</span> <span class="mi">88</span>
237*7f2fe78bSCy Schubert</pre></div>
238*7f2fe78bSCy Schubert</div>
239*7f2fe78bSCy Schubert<p>Restart the <a class="reference internal" href="admin_commands/krb5kdc.html#krb5kdc-8"><span class="std std-ref">krb5kdc</span></a> daemon to pick up the configuration
240*7f2fe78bSCy Schubertchanges.</p>
241*7f2fe78bSCy Schubert<p>The principal entry for each PKINIT-using client must be configured to
242*7f2fe78bSCy Schubertrequire preauthentication.  Ensure this with the command:</p>
243*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">&#39;modprinc +requires_preauth YOUR_PRINCNAME&#39;</span>
244*7f2fe78bSCy Schubert</pre></div>
245*7f2fe78bSCy Schubert</div>
246*7f2fe78bSCy Schubert<p>Starting with release 1.12, it is possible to remove the long-term
247*7f2fe78bSCy Schubertkeys of a principal entry, which can save some space in the database
248*7f2fe78bSCy Schubertand help to clarify some PKINIT-related error conditions by not asking
249*7f2fe78bSCy Schubertfor a password:</p>
250*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">&#39;purgekeys -all YOUR_PRINCNAME&#39;</span>
251*7f2fe78bSCy Schubert</pre></div>
252*7f2fe78bSCy Schubert</div>
253*7f2fe78bSCy Schubert<p>These principal options can also be specified at principal creation
254*7f2fe78bSCy Schuberttime as follows:</p>
255*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">&#39;add_principal +requires_preauth -nokey YOUR_PRINCNAME&#39;</span>
256*7f2fe78bSCy Schubert</pre></div>
257*7f2fe78bSCy Schubert</div>
258*7f2fe78bSCy Schubert<p>By default, the KDC requires PKINIT client certificates to have the
259*7f2fe78bSCy Schubertstandard Extended Key Usage and Subject Alternative Name attributes
260*7f2fe78bSCy Schubertfor PKINIT.  Starting in release 1.16, it is possible to authorize
261*7f2fe78bSCy Schubertclient certificates based on the subject or other criteria instead of
262*7f2fe78bSCy Schubertthe standard PKINIT Subject Alternative Name, by setting the
263*7f2fe78bSCy Schubert<strong>pkinit_cert_match</strong> string attribute on each client principal entry.
264*7f2fe78bSCy SchubertFor example:</p>
265*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="n">set_string</span> <span class="n">user</span><span class="nd">@REALM</span> <span class="n">pkinit_cert_match</span> <span class="s2">&quot;&lt;SUBJECT&gt;CN=user@REALM$&quot;</span>
266*7f2fe78bSCy Schubert</pre></div>
267*7f2fe78bSCy Schubert</div>
268*7f2fe78bSCy Schubert<p>The <strong>pkinit_cert_match</strong> string attribute follows the syntax used by
269*7f2fe78bSCy Schubertthe <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> <strong>pkinit_cert_match</strong> relation.  To allow the
270*7f2fe78bSCy Schubertuse of non-PKINIT client certificates, it will also be necessary to
271*7f2fe78bSCy Schubertdisable key usage checking using the <strong>pkinit_eku_checking</strong> relation;
272*7f2fe78bSCy Schubertfor example:</p>
273*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="p">[</span><span class="n">kdcdefaults</span><span class="p">]</span>
274*7f2fe78bSCy Schubert    <span class="n">pkinit_eku_checking</span> <span class="o">=</span> <span class="n">none</span>
275*7f2fe78bSCy Schubert</pre></div>
276*7f2fe78bSCy Schubert</div>
277*7f2fe78bSCy Schubert</section>
278*7f2fe78bSCy Schubert<section id="configuring-the-clients">
279*7f2fe78bSCy Schubert<h2>Configuring the clients<a class="headerlink" href="#configuring-the-clients" title="Permalink to this headline">¶</a></h2>
280*7f2fe78bSCy Schubert<p>Client hosts must be configured to trust the issuing authority for the
281*7f2fe78bSCy SchubertKDC certificate.  For a newly established certificate authority, the
282*7f2fe78bSCy Schubertclient host must have filesystem access to the CA certificate
283*7f2fe78bSCy Schubert(cacert.pem) and the following relation in <a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> in the
284*7f2fe78bSCy Schubertappropriate <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> subsection (with appropriate pathnames):</p>
285*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">cacert</span><span class="o">.</span><span class="n">pem</span>
286*7f2fe78bSCy Schubert</pre></div>
287*7f2fe78bSCy Schubert</div>
288*7f2fe78bSCy Schubert<p>If the KDC certificate is a commercially issued server certificate,
289*7f2fe78bSCy Schubertthe issuing certificate is most likely included in a system directory.
290*7f2fe78bSCy SchubertYou can specify it by filename as above, or specify the whole
291*7f2fe78bSCy Schubertdirectory like so:</p>
292*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_anchors</span> <span class="o">=</span> <span class="n">DIR</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">ssl</span><span class="o">/</span><span class="n">certs</span>
293*7f2fe78bSCy Schubert</pre></div>
294*7f2fe78bSCy Schubert</div>
295*7f2fe78bSCy Schubert<p>A commercially issued server certificate will usually not have the
296*7f2fe78bSCy Schubertstandard PKINIT principal name or Extended Key Usage extensions, so
297*7f2fe78bSCy Schubertthe following additional configuration is required:</p>
298*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_eku_checking</span> <span class="o">=</span> <span class="n">kpServerAuth</span>
299*7f2fe78bSCy Schubert<span class="n">pkinit_kdc_hostname</span> <span class="o">=</span> <span class="n">hostname</span><span class="o">.</span><span class="n">of</span><span class="o">.</span><span class="n">kdc</span><span class="o">.</span><span class="n">certificate</span>
300*7f2fe78bSCy Schubert</pre></div>
301*7f2fe78bSCy Schubert</div>
302*7f2fe78bSCy Schubert<p>Multiple <strong>pkinit_kdc_hostname</strong> relations can be configured to
303*7f2fe78bSCy Schubertrecognize multiple KDC certificates.  If the KDC is an Active
304*7f2fe78bSCy SchubertDirectory domain controller, setting <strong>pkinit_kdc_hostname</strong> is
305*7f2fe78bSCy Schubertnecessary, but it should not be necessary to set
306*7f2fe78bSCy Schubert<strong>pkinit_eku_checking</strong>.</p>
307*7f2fe78bSCy Schubert<p>To perform regular (as opposed to anonymous) PKINIT authentication, a
308*7f2fe78bSCy Schubertclient host must have filesystem access to a client certificate
309*7f2fe78bSCy Schubert(client.pem), and the corresponding private key (clientkey.pem).
310*7f2fe78bSCy SchubertConfigure the following relations in the client host’s
311*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/krb5_conf.html#krb5-conf-5"><span class="std std-ref">krb5.conf</span></a> file in the appropriate <a class="reference internal" href="conf_files/krb5_conf.html#realms"><span class="std std-ref">[realms]</span></a> subsection
312*7f2fe78bSCy Schubert(with appropriate pathnames):</p>
313*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">pkinit_identities</span> <span class="o">=</span> <span class="n">FILE</span><span class="p">:</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">client</span><span class="o">.</span><span class="n">pem</span><span class="p">,</span><span class="o">/</span><span class="n">etc</span><span class="o">/</span><span class="n">krb5</span><span class="o">/</span><span class="n">clientkey</span><span class="o">.</span><span class="n">pem</span>
314*7f2fe78bSCy Schubert</pre></div>
315*7f2fe78bSCy Schubert</div>
316*7f2fe78bSCy Schubert<p>If the KDC and client are properly configured, it should now be
317*7f2fe78bSCy Schubertpossible to run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">username</span></code> without entering a password.</p>
318*7f2fe78bSCy Schubert</section>
319*7f2fe78bSCy Schubert<section id="anonymous-pkinit">
320*7f2fe78bSCy Schubert<span id="id1"></span><h2>Anonymous PKINIT<a class="headerlink" href="#anonymous-pkinit" title="Permalink to this headline">¶</a></h2>
321*7f2fe78bSCy Schubert<p>Anonymity support in Kerberos allows a client to obtain a ticket
322*7f2fe78bSCy Schubertwithout authenticating as any particular principal.  Such a ticket can
323*7f2fe78bSCy Schubertbe used as a FAST armor ticket, or to securely communicate with an
324*7f2fe78bSCy Schubertapplication server anonymously.</p>
325*7f2fe78bSCy Schubert<p>To configure anonymity support, you must generate or otherwise procure
326*7f2fe78bSCy Schuberta KDC certificate and configure the KDC host, but you do not need to
327*7f2fe78bSCy Schubertgenerate any client certificates.  On the KDC, you must set the
328*7f2fe78bSCy Schubert<strong>pkinit_identity</strong> variable to provide the KDC certificate, but do
329*7f2fe78bSCy Schubertnot need to set the <strong>pkinit_anchors</strong> variable or store the issuing
330*7f2fe78bSCy Schubertcertificate if you won’t have any client certificates to verify.  On
331*7f2fe78bSCy Schubertclient hosts, you must set the <strong>pkinit_anchors</strong> variable (and
332*7f2fe78bSCy Schubertpossibly <strong>pkinit_kdc_hostname</strong> and <strong>pkinit_eku_checking</strong>) in order
333*7f2fe78bSCy Schubertto trust the issuing authority for the KDC certificate, but do not
334*7f2fe78bSCy Schubertneed to set the <strong>pkinit_identities</strong> variable.</p>
335*7f2fe78bSCy Schubert<p>Anonymity support is not enabled by default.  To enable it, you must
336*7f2fe78bSCy Schubertcreate the principal <code class="docutils literal notranslate"><span class="pre">WELLKNOWN/ANONYMOUS</span></code> using the command:</p>
337*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">kadmin</span> <span class="o">-</span><span class="n">q</span> <span class="s1">&#39;addprinc -randkey WELLKNOWN/ANONYMOUS&#39;</span>
338*7f2fe78bSCy Schubert</pre></div>
339*7f2fe78bSCy Schubert</div>
340*7f2fe78bSCy Schubert<p>Some Kerberos deployments include application servers which lack
341*7f2fe78bSCy Schubertproper access control, and grant some level of access to any user who
342*7f2fe78bSCy Schubertcan authenticate.  In such an environment, enabling anonymity support
343*7f2fe78bSCy Schuberton the KDC would present a security issue.  If you need to enable
344*7f2fe78bSCy Schubertanonymity support for TGTs (for use as FAST armor tickets) without
345*7f2fe78bSCy Schubertenabling anonymous authentication to application servers, you can set
346*7f2fe78bSCy Schubertthe variable <strong>restrict_anonymous_to_tgt</strong> to <code class="docutils literal notranslate"><span class="pre">true</span></code> in the
347*7f2fe78bSCy Schubertappropriate <a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection of the KDC’s
348*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file.</p>
349*7f2fe78bSCy Schubert<p>To obtain anonymous credentials on a client, run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-n</span></code>, or
350*7f2fe78bSCy Schubert<code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-n</span> <span class="pre">&#64;REALMNAME</span></code> to specify a realm.  The resulting tickets
351*7f2fe78bSCy Schubertwill have the client name <code class="docutils literal notranslate"><span class="pre">WELLKNOWN/ANONYMOUS&#64;WELLKNOWN:ANONYMOUS</span></code>.</p>
352*7f2fe78bSCy Schubert</section>
353*7f2fe78bSCy Schubert<section id="freshness-tokens">
354*7f2fe78bSCy Schubert<h2>Freshness tokens<a class="headerlink" href="#freshness-tokens" title="Permalink to this headline">¶</a></h2>
355*7f2fe78bSCy Schubert<p>Freshness tokens can ensure that the client has recently had access to
356*7f2fe78bSCy Schubertits certificate private key.  If freshness tokens are not required by
357*7f2fe78bSCy Schubertthe KDC, a client program with temporary possession of the private key
358*7f2fe78bSCy Schubertcan compose requests for future timestamps and use them later.</p>
359*7f2fe78bSCy Schubert<p>In release 1.17 and later, freshness tokens are supported by the
360*7f2fe78bSCy Schubertclient and are sent by the KDC when the client indicates support for
361*7f2fe78bSCy Schubertthem.  Because not all clients support freshness tokens yet, they are
362*7f2fe78bSCy Schubertnot required by default.  To check if freshness tokens are supported
363*7f2fe78bSCy Schubertby a realm’s clients, look in the KDC logs for the lines:</p>
364*7f2fe78bSCy Schubert<div class="highlight-default notranslate"><div class="highlight"><pre><span></span><span class="n">PKINIT</span><span class="p">:</span> <span class="n">freshness</span> <span class="n">token</span> <span class="n">received</span> <span class="kn">from</span> <span class="o">&lt;</span><span class="n">client</span> <span class="n">principal</span><span class="o">&gt;</span>
365*7f2fe78bSCy Schubert<span class="n">PKINIT</span><span class="p">:</span> <span class="n">no</span> <span class="n">freshness</span> <span class="n">token</span> <span class="n">received</span> <span class="kn">from</span> <span class="o">&lt;</span><span class="n">client</span> <span class="n">principal</span><span class="o">&gt;</span>
366*7f2fe78bSCy Schubert</pre></div>
367*7f2fe78bSCy Schubert</div>
368*7f2fe78bSCy Schubert<p>To require freshness tokens for all clients in a realm (except for
369*7f2fe78bSCy Schubertclients authenticating anonymously), set the
370*7f2fe78bSCy Schubert<strong>pkinit_require_freshness</strong> variable to <code class="docutils literal notranslate"><span class="pre">true</span></code> in the appropriate
371*7f2fe78bSCy Schubert<a class="reference internal" href="conf_files/kdc_conf.html#kdc-realms"><span class="std std-ref">[realms]</span></a> subsection of the KDC’s <a class="reference internal" href="conf_files/kdc_conf.html#kdc-conf-5"><span class="std std-ref">kdc.conf</span></a> file.  To
372*7f2fe78bSCy Schuberttest that this option is in effect, run <code class="docutils literal notranslate"><span class="pre">kinit</span> <span class="pre">-X</span> <span class="pre">disable_freshness</span></code>
373*7f2fe78bSCy Schubertand verify that authentication is unsuccessful.</p>
374*7f2fe78bSCy Schubert</section>
375*7f2fe78bSCy Schubert</section>
376*7f2fe78bSCy Schubert
377*7f2fe78bSCy Schubert
378*7f2fe78bSCy Schubert            <div class="clearer"></div>
379*7f2fe78bSCy Schubert          </div>
380*7f2fe78bSCy Schubert        </div>
381*7f2fe78bSCy Schubert      </div>
382*7f2fe78bSCy Schubert        </div>
383*7f2fe78bSCy Schubert        <div class="sidebar">
384*7f2fe78bSCy Schubert
385*7f2fe78bSCy Schubert    <h2>On this page</h2>
386*7f2fe78bSCy Schubert    <ul>
387*7f2fe78bSCy Schubert<li><a class="reference internal" href="#">PKINIT configuration</a><ul>
388*7f2fe78bSCy Schubert<li><a class="reference internal" href="#creating-certificates">Creating certificates</a><ul>
389*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-a-certificate-authority-certificate">Generating a certificate authority certificate</a></li>
390*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-a-kdc-certificate">Generating a KDC certificate</a></li>
391*7f2fe78bSCy Schubert<li><a class="reference internal" href="#generating-client-certificates">Generating client certificates</a></li>
392*7f2fe78bSCy Schubert</ul>
393*7f2fe78bSCy Schubert</li>
394*7f2fe78bSCy Schubert<li><a class="reference internal" href="#configuring-the-kdc">Configuring the KDC</a></li>
395*7f2fe78bSCy Schubert<li><a class="reference internal" href="#configuring-the-clients">Configuring the clients</a></li>
396*7f2fe78bSCy Schubert<li><a class="reference internal" href="#anonymous-pkinit">Anonymous PKINIT</a></li>
397*7f2fe78bSCy Schubert<li><a class="reference internal" href="#freshness-tokens">Freshness tokens</a></li>
398*7f2fe78bSCy Schubert</ul>
399*7f2fe78bSCy Schubert</li>
400*7f2fe78bSCy Schubert</ul>
401*7f2fe78bSCy Schubert
402*7f2fe78bSCy Schubert    <br/>
403*7f2fe78bSCy Schubert    <h2>Table of contents</h2>
404*7f2fe78bSCy Schubert    <ul class="current">
405*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../user/index.html">For users</a></li>
406*7f2fe78bSCy Schubert<li class="toctree-l1 current"><a class="reference internal" href="index.html">For administrators</a><ul class="current">
407*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="install.html">Installation guide</a></li>
408*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_files/index.html">Configuration Files</a></li>
409*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="realm_config.html">Realm configuration decisions</a></li>
410*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="database.html">Database administration</a></li>
411*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dbtypes.html">Database types</a></li>
412*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="lockout.html">Account lockout</a></li>
413*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="conf_ldap.html">Configuring Kerberos with OpenLDAP back-end</a></li>
414*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="appl_servers.html">Application servers</a></li>
415*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="host_config.html">Host configuration</a></li>
416*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="backup_host.html">Backups of secure hosts</a></li>
417*7f2fe78bSCy Schubert<li class="toctree-l2 current"><a class="current reference internal" href="#">PKINIT configuration</a></li>
418*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="otp.html">OTP Preauthentication</a></li>
419*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="spake.html">SPAKE Preauthentication</a></li>
420*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="dictionary.html">Addressing dictionary attack risks</a></li>
421*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="princ_dns.html">Principal names and DNS</a></li>
422*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="enctypes.html">Encryption types</a></li>
423*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="https.html">HTTPS proxy configuration</a></li>
424*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="auth_indicator.html">Authentication indicators</a></li>
425*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="admin_commands/index.html">Administration  programs</a></li>
426*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="../mitK5defaults.html">MIT Kerberos defaults</a></li>
427*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="env_variables.html">Environment variables</a></li>
428*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="troubleshoot.html">Troubleshooting</a></li>
429*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="advanced/index.html">Advanced topics</a></li>
430*7f2fe78bSCy Schubert<li class="toctree-l2"><a class="reference internal" href="various_envs.html">Various links</a></li>
431*7f2fe78bSCy Schubert</ul>
432*7f2fe78bSCy Schubert</li>
433*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../appdev/index.html">For application developers</a></li>
434*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../plugindev/index.html">For plugin module developers</a></li>
435*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build/index.html">Building Kerberos V5</a></li>
436*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../basic/index.html">Kerberos V5 concepts</a></li>
437*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../formats/index.html">Protocols and file formats</a></li>
438*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../mitK5features.html">MIT Kerberos features</a></li>
439*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../build_this.html">How to build this documentation from the source</a></li>
440*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../about.html">Contributing to the MIT Kerberos Documentation</a></li>
441*7f2fe78bSCy Schubert<li class="toctree-l1"><a class="reference internal" href="../resources.html">Resources</a></li>
442*7f2fe78bSCy Schubert</ul>
443*7f2fe78bSCy Schubert
444*7f2fe78bSCy Schubert    <br/>
445*7f2fe78bSCy Schubert    <h4><a href="../index.html">Full Table of Contents</a></h4>
446*7f2fe78bSCy Schubert    <h4>Search</h4>
447*7f2fe78bSCy Schubert    <form class="search" action="../search.html" method="get">
448*7f2fe78bSCy Schubert      <input type="text" name="q" size="18" />
449*7f2fe78bSCy Schubert      <input type="submit" value="Go" />
450*7f2fe78bSCy Schubert      <input type="hidden" name="check_keywords" value="yes" />
451*7f2fe78bSCy Schubert      <input type="hidden" name="area" value="default" />
452*7f2fe78bSCy Schubert    </form>
453*7f2fe78bSCy Schubert
454*7f2fe78bSCy Schubert        </div>
455*7f2fe78bSCy Schubert        <div class="clearer"></div>
456*7f2fe78bSCy Schubert      </div>
457*7f2fe78bSCy Schubert    </div>
458*7f2fe78bSCy Schubert
459*7f2fe78bSCy Schubert    <div class="footer-wrapper">
460*7f2fe78bSCy Schubert        <div class="footer" >
461*7f2fe78bSCy Schubert            <div class="right" ><i>Release: 1.21.3</i><br />
462*7f2fe78bSCy Schubert                &copy; <a href="../copyright.html">Copyright</a> 1985-2024, MIT.
463*7f2fe78bSCy Schubert            </div>
464*7f2fe78bSCy Schubert            <div class="left">
465*7f2fe78bSCy Schubert
466*7f2fe78bSCy Schubert        <a href="../index.html" title="Full Table of Contents"
467*7f2fe78bSCy Schubert            >Contents</a> |
468*7f2fe78bSCy Schubert        <a href="backup_host.html" title="Backups of secure hosts"
469*7f2fe78bSCy Schubert            >previous</a> |
470*7f2fe78bSCy Schubert        <a href="otp.html" title="OTP Preauthentication"
471*7f2fe78bSCy Schubert            >next</a> |
472*7f2fe78bSCy Schubert        <a href="../genindex.html" title="General Index"
473*7f2fe78bSCy Schubert            >index</a> |
474*7f2fe78bSCy Schubert        <a href="../search.html" title="Enter search criteria"
475*7f2fe78bSCy Schubert            >Search</a> |
476*7f2fe78bSCy Schubert    <a href="mailto:krb5-bugs@mit.edu?subject=Documentation__PKINIT configuration">feedback</a>
477*7f2fe78bSCy Schubert            </div>
478*7f2fe78bSCy Schubert        </div>
479*7f2fe78bSCy Schubert    </div>
480*7f2fe78bSCy Schubert
481*7f2fe78bSCy Schubert  </body>
482*7f2fe78bSCy Schubert</html>