1*7f2fe78bSCy Schubert<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN"> 2*7f2fe78bSCy Schubert<html><head> 3*7f2fe78bSCy Schubert<meta name="GENERATOR" content="Microsoft� HTML Help Workshop 4.1"> 4*7f2fe78bSCy Schubert<link rel="stylesheet" type="text/css" href="Leash.css"> 5*7f2fe78bSCy Schubert 6*7f2fe78bSCy Schubert<title>KINIT</title></head> 7*7f2fe78bSCy Schubert 8*7f2fe78bSCy Schubert<body> 9*7f2fe78bSCy Schubert<h1>KINIT Command</h1> 10*7f2fe78bSCy Schubert<table> 11*7f2fe78bSCy Schubert<tbody><tr><th id="th2"> The following information reproduces the information from UNIX man page for the KINIT command.</th> 12*7f2fe78bSCy Schubert</tr> 13*7f2fe78bSCy Schubert</tbody></table> 14*7f2fe78bSCy Schubert 15*7f2fe78bSCy Schubert 16*7f2fe78bSCy Schubert 17*7f2fe78bSCy Schubert 18*7f2fe78bSCy Schubert<h2>SYNOPSIS</h2><table> 19*7f2fe78bSCy Schubert<tbody><tr> 20*7f2fe78bSCy Schubert<th id="th2">kinit</th> 21*7f2fe78bSCy Schubert<td> 22*7f2fe78bSCy Schubert<span class="command"> [<b>-V</b>] </span> 23*7f2fe78bSCy Schubert<span class="command">[<b>-l</b> <i>lifetime</i>]</span> 24*7f2fe78bSCy Schubert<span class="command"> [<b>-s</b> <i>start</i><b>_</b><i>time</i>] </span> 25*7f2fe78bSCy Schubert<span class="command"> [<b>-r</b> <i>renewable</i><b>_</b><i>life</i>] </span> 26*7f2fe78bSCy Schubert<span class="command"> [<b>-p</b> | <b>-P</b>]</span> 27*7f2fe78bSCy Schubert<span class="command"> [<b>-f</b> | <b>-F</b>]</span> 28*7f2fe78bSCy Schubert<span class="command"> [<b>-a</b>]</span> 29*7f2fe78bSCy Schubert<span class="command"> [<b>-A</b>] </span> 30*7f2fe78bSCy Schubert<span class="command"> [<b>-C</b>] </span> 31*7f2fe78bSCy Schubert<span class="command"> [<b>-E</b>] </span> 32*7f2fe78bSCy Schubert<span class="command"> [<b>-v</b>]</span> 33*7f2fe78bSCy Schubert<span class="command"> [<b>-R</b>] </span> 34*7f2fe78bSCy Schubert<span class="command">[<b>-k</b> [<b>-t</b> <i>keytab</i><b>_</b><i>file</i>]] </span> 35*7f2fe78bSCy Schubert<span class="command"> [<b>-c</b> <i>cache</i><b>_</b><i>name</i>] </span> 36*7f2fe78bSCy Schubert<span class="command"> [<b>-n</b>]</span> 37*7f2fe78bSCy Schubert<span class="command"> [<b>-S</b> <i>service</i><b>_</b><i>name</i>]</span> 38*7f2fe78bSCy Schubert<span class="command"> [<b>-T</b> <i>armor</i><b>_</b><i>ccache</i>] </span> 39*7f2fe78bSCy Schubert<span class="command"> [<b>-X</b> <i>attribute</i>[=<i>value</i>]] </span> 40*7f2fe78bSCy Schubert<span class="command"> [<i>principal</i>] </span> 41*7f2fe78bSCy Schubert</td> 42*7f2fe78bSCy Schubert</tr> 43*7f2fe78bSCy Schubert</tbody></table> 44*7f2fe78bSCy Schubert<h2>DESCRIPTION</h2> 45*7f2fe78bSCy Schubert<p> 46*7f2fe78bSCy Schubert <i>kinit</i> obtains and caches an initial ticket-granting ticket for <i>principal</i>. 47*7f2fe78bSCy Schubert</p> 48*7f2fe78bSCy Schubert 49*7f2fe78bSCy Schubert 50*7f2fe78bSCy Schubert<h2>OPTIONS</h2> 51*7f2fe78bSCy Schubert<table> 52*7f2fe78bSCy Schubert<tbody><tr> 53*7f2fe78bSCy Schubert<th id="th2"> <span class="command">-V</span></th> 54*7f2fe78bSCy Schubert<td>display verbose output.</td></tr> 55*7f2fe78bSCy Schubert<tr> 56*7f2fe78bSCy Schubert<th id="th2"><span class="command">-l</span></th> 57*7f2fe78bSCy Schubert<td> <i>lifetime</i> 58*7f2fe78bSCy Schubert requests a ticket with the lifetime <i>lifetime</i>. The value for 59*7f2fe78bSCy Schubert <i>lifetime</i> must be followed immediately by one of the following 60*7f2fe78bSCy Schubert delimiters: 61*7f2fe78bSCy Schubert<ul id="helpul"> 62*7f2fe78bSCy Schubert<li> <b>s</b> seconds </li> 63*7f2fe78bSCy Schubert<li><b>m</b> minutes</li> 64*7f2fe78bSCy Schubert <li><b>h</b> hours</li> 65*7f2fe78bSCy Schubert<li><b>d</b> days</li> 66*7f2fe78bSCy Schubert</ul> 67*7f2fe78bSCy Schubert as in "kinit -l 90m". You cannot mix units; a value of `3h30m' 68*7f2fe78bSCy Schubert will result in an error. 69*7f2fe78bSCy Schubert 70*7f2fe78bSCy Schubert If the <b>-l</b> option is not specified, the default ticket lifetime 71*7f2fe78bSCy Schubert (configured by each site) is used. Specifying a ticket lifetime 72*7f2fe78bSCy Schubert longer than the maximum ticket lifetime (configured by each 73*7f2fe78bSCy Schubert site) results in a ticket with the maximum lifetime. 74*7f2fe78bSCy Schubert</td> 75*7f2fe78bSCy Schubert</tr> 76*7f2fe78bSCy Schubert<tr><th id="th2"> <span class="command">-s <i>start</i><b>_</b><i>time</i></span> </th> 77*7f2fe78bSCy Schubert<td> requests a postdated ticket, valid starting at <span class="command">-<i>start</i><b>_</b><i>time</i>.</span> Postdated tickets are issued with the <i>invalid</i> flag set, and need to be fed back to the kdc before use.</td></tr> 78*7f2fe78bSCy Schubert<tr> 79*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-r</b> <i>renewable</i><b>_</b><i>life</i></span></th> 80*7f2fe78bSCy Schubert<td> requests renewable tickets, with a total lifetime of <span class="command">-<i>renewable</i><b>_</b><i>life</i>.</span> The duration is in the same format as the <b>-l</b> option, with the same delimiters.</td></tr> 81*7f2fe78bSCy Schubert<tr> 82*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-f </b></span></th> 83*7f2fe78bSCy Schubert<td> request forwardable tickets.</td></tr> 84*7f2fe78bSCy Schubert<tr> 85*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-F</b></span></th> 86*7f2fe78bSCy Schubert<td> do not request forwardable tickets. </td></tr> 87*7f2fe78bSCy Schubert<tr> 88*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-p</b></span></th> 89*7f2fe78bSCy Schubert<td> request proxiable tickets. </td></tr> 90*7f2fe78bSCy Schubert<tr> 91*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-P </b></span></th> 92*7f2fe78bSCy Schubert<td> do not request proxiable tickets.</td></tr> 93*7f2fe78bSCy Schubert<tr> 94*7f2fe78bSCy Schubert<th id="th2"> <span class="command"><b>-a</b></span></th> 95*7f2fe78bSCy Schubert<td> request tickets with the local address[es].</td></tr> 96*7f2fe78bSCy Schubert<tr> 97*7f2fe78bSCy Schubert <th id="th2"> <span class="command"><b>-A</b></span></th> 98*7f2fe78bSCy Schubert<td> request address-less tickets.</td></tr> 99*7f2fe78bSCy Schubert<tr> 100*7f2fe78bSCy Schubert<th id="th2"> <span class="command"> <b>-k</b> [<b>-t</b> <i>keytab</i><b>_</b><i>file</i>] </span></th> 101*7f2fe78bSCy Schubert<td> requests a ticket, obtained from a key in the local host's 102*7f2fe78bSCy Schubert <i>keytab</i> file. The name and location of the keytab file may be 103*7f2fe78bSCy Schubert specified with the <span class="command"> <b>-t</b> <i>keytab</i><b>_</b><i>file</i> </span> option; otherwise the default 104*7f2fe78bSCy Schubert name and location will be used. By default a host ticket is 105*7f2fe78bSCy Schubert requested but any principal may be specified. On a KDC, the special 106*7f2fe78bSCy Schubert keytab location <b>KDB:</b> can be used to indicate that kinit 107*7f2fe78bSCy Schubert should open the KDC database and look up the key directly. This 108*7f2fe78bSCy Schubert permits an administrator to obtain tickets as any principal that 109*7f2fe78bSCy Schubert supports password-based authentication.</td></tr> 110*7f2fe78bSCy Schubert<tr> 111*7f2fe78bSCy Schubert<th id="th2"> <span class="command"> <b>-n</b></span></th> 112*7f2fe78bSCy Schubert<td> Requests anonymous processing. Two types of anonymous principals 113*7f2fe78bSCy Schubertare supported. For fully anonymous Kerberos, configure pkinit on the 114*7f2fe78bSCy SchubertKDC and configure <span class="command"> <i>pkinit</i><b>_</b><i>anchors</i></span> in the client's 115*7f2fe78bSCy Schubert krb5.conf. Then use the <b>-n</b> option with a principal of the form 116*7f2fe78bSCy Schubert <i>@REALM</i> (an empty principal name followed by the at-sign and a 117*7f2fe78bSCy Schubert realm name). If permitted by the KDC, an anonymous ticket will 118*7f2fe78bSCy Schubert be returned. A second form of anonymous tickets is supported; 119*7f2fe78bSCy Schubert these realm-exposed tickets hide the identity of the client but 120*7f2fe78bSCy Schubert not the client's realm. For this mode, use <b>kinit</b> <b>-n</b> with a normal principal name. If supported by the KDC, the principal (but 121*7f2fe78bSCy Schubert not realm) will be replaced by the anonymous principal. As of 122*7f2fe78bSCy Schubert release 1.8, the MIT Kerberos KDC only supports fully anonymous 123*7f2fe78bSCy Schubert operation.</td></tr> 124*7f2fe78bSCy Schubert<tr> 125*7f2fe78bSCy Schubert <th id="th2"> <span class="command"><b>-T</b> <i>armor</i><b>_</b><i>ccache</i></span></th> 126*7f2fe78bSCy Schubert<td> Specifies the name of a credential cache that already contains a 127*7f2fe78bSCy Schubert ticket. If supported by the KDC, This ccache will be used to 128*7f2fe78bSCy Schubert armor the request so that an attacker would have to know both 129*7f2fe78bSCy Schubert the key of the armor ticket and the key of the principal used 130*7f2fe78bSCy Schubert for authentication in order to attack the request. Armoring also 131*7f2fe78bSCy Schubert makes sure that the response from the KDC is not modified in 132*7f2fe78bSCy Schubert transit.</td></tr> 133*7f2fe78bSCy Schubert<tr> 134*7f2fe78bSCy Schubert <th id="th2"> <span class="command"> <b>-c</b> <i>cache</i><b>_</b><i>name</i> </span></th> 135*7f2fe78bSCy Schubert<td> use <span class="command"><i>cache</i><b>_</b><i>name</i></span> 136*7f2fe78bSCy Schubertas the Kerberos 5 credentials (ticket) cache name and location; if this 137*7f2fe78bSCy Schubertoption is not used, the default cache name and location are used. The 138*7f2fe78bSCy Schubertdefault credentials cache may vary between systems. If the <b>KRB5CCNAME</b> environment variable is set, its value is used to 139*7f2fe78bSCy Schubert name the default ticket cache. If a principal name is specified 140*7f2fe78bSCy Schubert and the type of the default credentials cache supports a collection 141*7f2fe78bSCy Schubert (such as the DIR type), an existing cache containing credentials 142*7f2fe78bSCy Schubert for the principal is selected or a new one is created 143*7f2fe78bSCy Schubert and becomes the new primary cache. Otherwise, any existing contents 144*7f2fe78bSCy Schubert of the default cache are destroyed by <i>kinit</i>.</td></tr> 145*7f2fe78bSCy Schubert<tr> 146*7f2fe78bSCy Schubert <th id="th2"> <span class="command"> <b>-S</b> <i>service</i><b>_</b><i>name</i></span></th> 147*7f2fe78bSCy Schubert<td> specify an alternate service name to use when getting initial 148*7f2fe78bSCy Schubert tickets.</td></tr> 149*7f2fe78bSCy Schubert</tbody></table> 150*7f2fe78bSCy Schubert 151*7f2fe78bSCy Schubert<h2>ENVIRONMENT</h2> 152*7f2fe78bSCy Schubert<p> 153*7f2fe78bSCy Schubert <b>Kinit</b> uses the following environment variables: 154*7f2fe78bSCy Schubert</p> 155*7f2fe78bSCy Schubert<table> 156*7f2fe78bSCy Schubert<tbody><tr> 157*7f2fe78bSCy Schubert <th id="th2"> KRB5CCNAME </th> 158*7f2fe78bSCy Schubert<td> Location of the default Kerberos 5 credentials (ticket) 159*7f2fe78bSCy Schubert cache, in the form<span class="command"> <i>type</i>:<i>residual</i>.</span> If no type prefix is 160*7f2fe78bSCy Schubert present, the <b>FILE</b> type is assumed. The type of the 161*7f2fe78bSCy Schubert default cache may determine the availability of a cache 162*7f2fe78bSCy Schubert collection; for instance, a default cache of type <b>DIR</b> 163*7f2fe78bSCy Schubert causes caches within the directory to be present in the 164*7f2fe78bSCy Schubert collection.</td> 165*7f2fe78bSCy Schubert</tr> 166*7f2fe78bSCy Schubert</tbody></table> 167*7f2fe78bSCy Schubert 168*7f2fe78bSCy Schubert<h2>FILES</h2> 169*7f2fe78bSCy Schubert<table> 170*7f2fe78bSCy Schubert<tbody><tr> 171*7f2fe78bSCy Schubert <th id="th2"> <span class="command"> /tmp/krb5cc_[uid] </span></th> 172*7f2fe78bSCy Schubert<td> default location of Kerberos 5 credentials cache ([uid] is the decimal UID of the user). </td></tr> 173*7f2fe78bSCy Schubert<tr> 174*7f2fe78bSCy Schubert <th id="th2"> <span class="command"> /etc/krb5.keytab </span></th> 175*7f2fe78bSCy Schubert<td> default location for the local host's <b>keytab</b> file.</td></tr> 176*7f2fe78bSCy Schubert</tbody></table> 177*7f2fe78bSCy Schubert 178*7f2fe78bSCy Schubert<h2>SEE ALSO</h2> 179*7f2fe78bSCy Schubert<ul id="helpul"> 180*7f2fe78bSCy Schubert<li><a href="HTML/KLIST.htm"><b>klist(1)</b></a></li> 181*7f2fe78bSCy Schubert<li> <a href="HTML/KDESTROY.htm"><b>kdestroy(1)</b></a></li> 182*7f2fe78bSCy Schubert<li><a href="HTML/KSWITCH.htm"><b>kswitch(1)</b></a></li> 183*7f2fe78bSCy Schubert 184*7f2fe78bSCy Schubert<li><b>kerberos(1)</b></li> 185*7f2fe78bSCy Schubert</ul> 186*7f2fe78bSCy Schubert 187*7f2fe78bSCy Schubert 188*7f2fe78bSCy Schubert 189*7f2fe78bSCy Schubert 190*7f2fe78bSCy Schubert</body></html> 191