source: postlfs/security/heimdal.xml@ 09febce

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 09febce was 09febce, checked in by Randy McMurchy <randy@…>, 18 years ago

Updated to Heimdal-0.7.1

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5401 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 41.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "70504c824cb0437e6fae2b866f9d2ed4">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "96.9 MB">
12 <!ENTITY heimdal-time "2.7 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">heimdal-&heimdal-version;.tar</keyword>
23 <keyword role="ftpdir">heimdal</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Heimdal-&heimdal-version;</title>
28
29 <indexterm zone="heimdal">
30 <primary sortas="a-Heimdal">Heimdal</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Heimdal</title>
35
36 <para><application>Heimdal</application> is a free implementation
37 of Kerberos 5 that aims to be compatible with MIT krb5 and is
38 backward compatible with krb4. Kerberos is a network authentication
39 protocol. Basically it preserves the integrity of passwords in any
40 untrusted network (like the Internet). Kerberized applications work
41 hand-in-hand with sites that support Kerberos to ensure that passwords
42 cannot be stolen or compromised. A Kerberos installation will make changes
43 to the authentication mechanisms on your network and will overwrite several
44 programs and daemons from the <application>Coreutils</application>,
45 <application>Inetutils</application>, <application>Qpopper</application>
46 and <application>Shadow</application> packages.</para>
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &heimdal-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &heimdal-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &heimdal-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &heimdal-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing='compact'>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required"><xref linkend="db"/> (recommended) or
86 <xref linkend="gdbm"/></para>
87
88 <bridgehead renderas="sect4">Recommended</bridgehead>
89 <para role="recommended"><xref linkend="openssl"/></para>
90
91 <bridgehead renderas="sect4">Optional</bridgehead>
92 <para role="optional"><xref linkend="linux-pam"/>,
93 <xref linkend="openldap"/>,
94 X (<xref linkend="xorg"/> or <xref linkend="xfree86"/>),
95 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
96 patch) and
97 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
98
99 <note>
100 <para>Some sort of time synchronization facility on your system
101 (like <xref linkend="ntp"/>) is required since Kerberos won't
102 authenticate if the time differential between a kerberized client
103 and the KDC server is more than 5 minutes.</para>
104 </note>
105
106 </sect2>
107
108 <sect2 role="installation">
109 <title>Installation of Heimdal</title>
110
111 <!-- This doesn't appear to be needed any longer as testing has
112 shown that the ftp client now works without issues
113
114 <para>Before installing the package, you may want to preserve the
115 <command>ftp</command> program from the <application>Inetutils</application>
116 package. This is because using the <application>Heimdal</application>
117 <command>ftp</command> program to connect to non-kerberized ftp servers may
118 not work properly. It will allow you to connect (letting you know that
119 transmission of the password is clear text) but will have problems doing
120 puts and gets. Issue the following command as the
121 <systemitem class="username">root</systemitem> user.</para>
122
123<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
124
125 -->
126
127 <warning>
128 <para>Ensure you really need a Kerberos installation before you decide
129 to install this package. Failure to install and configure the package
130 in accordance with the instructions below can render your system
131 unusable.</para>
132 </warning>
133
134 <para>If you wish the <application>Heimdal</application> package to
135 link against the <application>CrackLib</application> library to provide
136 enforcement of strong passwords (requires <xref linkend="cracklib"/>
137 installed with the <filename>heimdal</filename> patch), you must apply a
138 patch:</para>
139
140<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
141
142 <para>Install <application>Heimdal</application> by running the following
143 commands:</para>
144
145<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
146./configure --prefix=/usr \
147 --sysconfdir=/etc/heimdal \
148 --libexecdir=/usr/sbin \
149 --datadir=/var/lib/heimdal \
150 --localstatedir=/var/lib/heimdal \
151 --enable-shared \
152 --with-readline=/usr &amp;&amp;
153make</userinput></screen>
154
155 <para>If you wish to create HTML documentation, issue the following
156 command:</para>
157
158<screen><userinput>make -C doc heimdal.html</userinput></screen>
159
160 <para>If you wish to create a text-based version of the documentation,
161 issue the following commands:</para>
162
163<screen><userinput>cd doc &amp;&amp;
164makeinfo --plaintext -o heimdal.txt heimdal.texi &amp;&amp;
165cd ..</userinput></screen>
166
167 <para>To test the results, issue: <command>make check</command>.</para>
168
169 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
170
171<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
172mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
173mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
174mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
175mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
176make install &amp;&amp;
177mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
178mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
179mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
180mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
181install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
182install -v -m644 doc/{init-creds,layman.asc} \
183 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
184install -v -m644 doc/standardisation/* \
185 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
186mv -v /bin/login /bin/login.shadow &amp;&amp;
187mv -v /bin/su /bin/su.shadow &amp;&amp;
188mv -v /usr/bin/{login,su} /bin &amp;&amp;
189ln -v -sf ../../bin/login /usr/bin &amp;&amp;
190mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
191 /usr/lib/libdb-4.3.so /lib &amp;&amp;
192ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb.so &amp;&amp;
193ln -v -sf ../../lib/libdb-4.3.so /usr/lib/libdb-4.so &amp;&amp;
194for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
195 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.7
196do
197 ln -v -sf ../../lib/lib$SYMLINK \
198 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
199done
200ldconfig</userinput></screen>
201
202 <para>If you built the HTML or text-based documentation, install it using
203 the following commands as the
204 <systemitem class="username">root</systemitem> user:</para>
205
206<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
207install -v -m644 doc/heimdal.html/* \
208 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
209install -v -m644 doc/heimdal.txt /usr/share/doc/heimdal-&heimdal-version;</userinput></screen>
210
211 </sect2>
212
213 <sect2 role="commands">
214 <title>Command Explanations</title>
215
216 <para><command>mv -v /usr/include/...</command> and
217 <command>mv -v /usr/lib/libss.*</command>: The
218 <application>Heimdal</application> installation will overwrite two
219 interface headers from the <application>Glibc</application> package and an
220 interface header, static library and library symbolic link from the
221 <application>E2fsprogs</application> package. These commands move the
222 original files out of the way before the installation, and then restore
223 the original <application>Glibc</application> headers after the
224 installation. The two <application>Heimdal</application> headers are renamed
225 and preserved on the system. Testing has shown that the system is stable
226 using the <application>Heimdal</application> version of the
227 <filename>libss</filename> library and interface header.</para>
228
229 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
230 puts the daemon programs into
231 <filename class="directory">/usr/sbin</filename>.</para>
232
233 <tip>
234 <para>If you want to preserve all your existing
235 <application>Inetutils</application> package daemons, install the
236 <application>Heimdal</application> daemons into
237 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
238 you want). Since these programs will be called from
239 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
240 really doesn't matter where they are installed, as long as they are
241 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
242 and <filename>rc</filename> scripts. If you choose something other than
243 <filename class="directory">/usr/sbin</filename>, you may want to move
244 some of the user programs (such as <command>kadmin</command>) to
245 <filename class="directory">/usr/sbin</filename> manually so they'll be
246 in the privileged user's default <envar>PATH</envar>.</para>
247 </tip>
248
249 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
250 The <command>login</command> and <command>su</command> programs installed by
251 <application>Heimdal</application> belong in the
252 <filename class="directory">/bin</filename> directory. The
253 <command>login</command> program is symlinked because
254 <application>Heimdal</application> is expecting to find it in
255 <filename class="directory">/usr/bin</filename>. The old executables are
256 preserved before the move so that they can be restored if you experience
257 problems logging into the system after the
258 <application>Heimdal</application> package is installed and
259 configured.</para>
260
261 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
262 The <command>login</command> and <command>su</command> programs installed
263 by <application>Heimdal</application> link against
264 <application>Heimdal</application> libraries as well as libraries provided
265 by the <application>OpenSSL</application> and
266 <application>Berkeley DB</application> packages. These
267 libraries are moved to <filename class="directory">/lib</filename> to be
268 FHS compliant and also in case
269 <filename class="directory">/usr</filename> is located on a separate
270 partition which may not always be mounted.</para>
271
272 </sect2>
273
274 <sect2 role="configuration">
275 <title>Configuring Heimdal</title>
276
277 <sect3 id="heimdal-config">
278 <title>Config Files</title>
279
280 <para><filename>/etc/heimdal/*</filename></para>
281
282 <indexterm zone="heimdal heimdal-config">
283 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
284 </indexterm>
285
286 </sect3>
287
288 <sect3>
289 <title>Configuration Information</title>
290
291 <note>
292 <para>All the configuration steps shown below must be accomplished
293 by the <systemitem class='username'>root</systemitem> user unless
294 otherwise noted.</para>
295 </note>
296
297 <sect4>
298 <title>Master KDC Server Configuration</title>
299
300 <para>Create the Kerberos configuration file with the
301 following commands:</para>
302
303<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
304cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
305<literal># Begin /etc/heimdal/krb5.conf
306
307[libdefaults]
308 default_realm = <replaceable>[EXAMPLE.COM]</replaceable>
309 encrypt = true
310
311[realms]
312 <replaceable>[EXAMPLE.COM]</replaceable> = {
313 kdc = <replaceable>[hostname.example.com]</replaceable>
314 admin_server = <replaceable>[hostname.example.com]</replaceable>
315 kpasswd_server = <replaceable>[hostname.example.com]</replaceable>
316 }
317
318[domain_realm]
319 .<replaceable>[example.com]</replaceable> = <replaceable>[EXAMPLE.COM]</replaceable>
320
321[logging]
322 kdc = FILE:/var/log/kdc.log
323 admin_server = FILE:/var/log/kadmin.log
324 default = FILE:/var/log/krb.log
325
326# End /etc/heimdal/krb5.conf</literal>
327EOF
328chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
329
330 <para>You will need to substitute your domain and proper hostname
331 for the occurrences of the <replaceable>[hostname]</replaceable>
332 and <replaceable>[EXAMPLE.COM]</replaceable> names.</para>
333
334 <para><option>default_realm</option> should be the name of your
335 domain changed to ALL CAPS. This isn't required, but both
336 <application>Heimdal</application> and <application>MIT
337 krb5</application> recommend it.</para>
338
339 <para><option>encrypt = true</option> provides encryption of all
340 traffic between kerberized clients and servers. It's not necessary
341 and can be left off. If you leave it off, you can encrypt all traffic
342 from the client to the server using a switch on the client program
343 instead.</para>
344
345 <para>The <option>[realms]</option> parameters tell the client
346 programs where to look for the KDC authentication services.</para>
347
348 <para>The <option>[domain_realm]</option> section maps a domain
349 to a realm.</para>
350
351 <para>Store the master password in a key file using the following
352 commands:</para>
353
354<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
355kstash</userinput></screen>
356
357 <para>Create the KDC database:</para>
358
359<screen role="root"><userinput>kadmin -l</userinput></screen>
360
361 <para>The commands below will prompt you for information about the
362 principles. Choose the defaults for now unless you know what you are
363 doing and need to specify different values. You can go in later and
364 change the defaults, should you feel the need. You may use the up and
365 down arrow keys to use the history feature of <command>kadmin</command>
366 in a similar manner as the <command>bash</command> history
367 feature.</para>
368
369 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
370 statement:</para>
371
372<screen role="root"><userinput>init <replaceable>[EXAMPLE.COM]</replaceable></userinput></screen>
373
374 <para>The database must now be populated with at least one principle
375 (user). For now, just use your regular login name or root. You may
376 create as few, or as many principles as you wish using the following
377 statement:</para>
378
379<screen role="root"><userinput>add <replaceable>[loginname]</replaceable></userinput></screen>
380
381 <para>The KDC server and any machine running kerberized
382 server daemons must have a host key installed:</para>
383
384<screen role="root"><userinput>add --random-key host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
385
386 <para>After choosing the defaults when prompted, you will have to
387 export the data to a keytab file:</para>
388
389<screen role="root"><userinput>ext host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
390
391 <para>This should have created two files in
392 <filename class="directory">/etc/heimdal</filename>:
393 <filename>krb5.keytab</filename> (Kerberos 5) and
394 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
395 (root rw only) permissions. Keeping the keytab files from public access
396 is crucial to the overall security of the Kerberos installation.</para>
397
398 <para>Eventually, you'll want to add server daemon principles to the
399 database and extract them to the keytab file. You do this in the same
400 way you created the host principles. Below is an example:</para>
401
402<screen role="root"><userinput>add --random-key ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
403
404 <para>(choose the defaults)</para>
405
406<screen role="root"><userinput>ext ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
407
408 <para>Exit the <command>kadmin</command> program (use
409 <command>quit</command> or <command>exit</command>) and return back
410 to the shell prompt. Start the KDC daemon manually, just to test out
411 the installation:</para>
412
413<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
414
415 <para>Attempt to get a TGT (ticket granting ticket) with
416 the following command:</para>
417
418<screen><userinput>kinit <replaceable>[loginname]</replaceable></userinput></screen>
419
420 <para>You will be prompted for the password you created. After you get
421 your ticket, you should list it with the following command:</para>
422
423<screen><userinput>klist</userinput></screen>
424
425 <para>Information about the ticket should be displayed on
426 the screen.</para>
427
428 <para>To test the functionality of the <filename>keytab</filename> file,
429 issue the following command:</para>
430
431<screen><userinput>ktutil list</userinput></screen>
432
433 <para>This should dump a list of the host principals, along with the
434 encryption methods used to access the principals.</para>
435
436 <para>At this point, if everything has been successful so far, you
437 can feel fairly confident in the installation, setup and configuration
438 of your new <application>Heimdal</application> Kerberos 5
439 installation.</para>
440
441 <para id="heimdal-init">Install the
442 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
443 in the <xref linkend="intro-important-bootscripts"/> package:</para>
444
445 <indexterm zone="heimdal heimdal-init">
446 <primary sortas="f-heimdal">heimdal</primary>
447 </indexterm>
448
449<screen role="root"><userinput>make install-heimdal</userinput></screen>
450
451 </sect4>
452
453 <sect4>
454 <title>Using Kerberized Client Programs</title>
455
456 <para>To use the kerberized client programs (<command>telnet</command>,
457 <command>ftp</command>, <command>rsh</command>,
458 <command>rxterm</command>, <command>rxtelnet</command>,
459 <command>rcp</command>, <command>xnlock</command>), you first must get
460 a TGT. Use the <command>kinit</command> program to get the ticket.
461 After you've acquired the ticket, you can use the kerberized programs
462 to connect to any kerberized server on the network. You will not be
463 prompted for authentication until your ticket expires (default is one
464 day), unless you specify a different user as a command line argument
465 to the program.</para>
466
467 <para>The kerberized programs will connect to non-kerberized daemons,
468 warning you that authentication is not encrypted.</para>
469
470 <para>In order to use the <application>Heimdal</application>
471 <application>X</application> programs, you'll need to add a service
472 port entry to the <filename>/etc/services</filename> file for the
473 <command>kxd</command> server. There is no 'standardized port number'
474 for the 'kx' service in the IANA database, so you'll have to pick an
475 unused port number. Add an entry to the <filename>services</filename>
476 file similar to the entry below (substitute your chosen port number
477 for <replaceable>[49150]</replaceable>):</para>
478
479<screen><literal>kx <replaceable>[49150]</replaceable>/tcp # Heimdal kerberos X
480kx <replaceable>[49150]</replaceable>/udp # Heimdal kerberos X</literal></screen>
481
482 <para>For additional information consult <ulink
483 url="&hints-root;/downloads/files/heimdal.txt">the
484 Heimdal hint</ulink> on which the above instructions are based.</para>
485
486 </sect4>
487
488 </sect3>
489
490 </sect2>
491
492 <sect2 role="content">
493 <title>Contents</title>
494
495 <segmentedlist>
496 <segtitle>Installed Programs</segtitle>
497 <segtitle>Installed Libraries</segtitle>
498 <segtitle>Installed Directories</segtitle>
499
500 <seglistitem>
501 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
502 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
503 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
504 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
505 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
506 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
507 and xnlock</seg>
508 <seg>libasn1.[so,a], libeditline.[so,a], libgssapi.[so,a],
509 libhdb.[so,a], libkadm5clnt.[so,a], libkadm5srv.[so,a], libkafs.[so,a],
510 libkrb5.[so,a], libotp.[so,a], libroken.[so,a], libsl.[so,a]
511 and libss.[so,a]</seg>
512 <seg>/etc/heimdal, /usr/include/kadm5,
513 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
514 </seglistitem>
515 </segmentedlist>
516
517 <variablelist>
518 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
519 <?dbfo list-presentation="list"?>
520 <?dbhtml list-presentation="table"?>
521
522 <varlistentry id="afslog">
523 <term><command>afslog</command></term>
524 <listitem>
525 <para>obtains AFS tokens for a number of cells.</para>
526 <indexterm zone="heimdal afslog">
527 <primary sortas="b-afslog">afslog</primary>
528 </indexterm>
529 </listitem>
530 </varlistentry>
531
532 <varlistentry id="ftp">
533 <term><command>ftp</command></term>
534 <listitem>
535 <para>is a kerberized FTP client.</para>
536 <indexterm zone="heimdal ftp">
537 <primary sortas="b-ftp">ftp</primary>
538 </indexterm>
539 </listitem>
540 </varlistentry>
541
542 <varlistentry id="ftpd">
543 <term><command>ftpd</command></term>
544 <listitem>
545 <para>is a kerberized FTP daemon.</para>
546 <indexterm zone="heimdal ftpd">
547 <primary sortas="b-ftpd">ftpd</primary>
548 </indexterm>
549 </listitem>
550 </varlistentry>
551
552 <varlistentry id="hprop">
553 <term><command>hprop</command></term>
554 <listitem>
555 <para> takes a principal database in a specified format and converts
556 it into a stream of <application>Heimdal</application> database
557 records.</para>
558 <indexterm zone="heimdal hprop">
559 <primary sortas="b-hprop">hprop</primary>
560 </indexterm>
561 </listitem>
562 </varlistentry>
563
564 <varlistentry id="hpropd">
565 <term><command>hpropd</command></term>
566 <listitem>
567 <para>is a server that receives a database sent by
568 <command>hprop</command> and writes it as a local database.</para>
569 <indexterm zone="heimdal hpropd">
570 <primary sortas="b-hpropd">hpropd</primary>
571 </indexterm>
572 </listitem>
573 </varlistentry>
574
575 <varlistentry id="ipropd-master">
576 <term><command>ipropd-master</command></term>
577 <listitem>
578 <para>is a daemon which runs on the master KDC
579 server which incrementally propagates changes to the KDC
580 database to the slave KDC servers.</para>
581 <indexterm zone="heimdal ipropd-master">
582 <primary sortas="b-ipropd-master">ipropd-master</primary>
583 </indexterm>
584 </listitem>
585 </varlistentry>
586
587 <varlistentry id="ipropd-slave">
588 <term><command>ipropd-slave</command></term>
589 <listitem>
590 <para>is a daemon which runs on the slave KDC
591 servers which incrementally propagates changes to the KDC
592 database from the master KDC server.</para>
593 <indexterm zone="heimdal ipropd-slave">
594 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
595 </indexterm>
596 </listitem>
597 </varlistentry>
598
599 <varlistentry id="kadmin">
600 <term><command>kadmin</command></term>
601 <listitem>
602 <para>is a utility used to make modifications to the Kerberos
603 database.</para>
604 <indexterm zone="heimdal kadmin">
605 <primary sortas="b-kadmin">kadmin</primary>
606 </indexterm>
607 </listitem>
608 </varlistentry>
609
610 <varlistentry id="kadmind">
611 <term><command>kadmind</command></term>
612 <listitem>
613 <para>is a server for administrative access to the Kerberos
614 database.</para>
615 <indexterm zone="heimdal kadmind">
616 <primary sortas="b-kadmind">kadmind</primary>
617 </indexterm>
618 </listitem>
619 </varlistentry>
620
621 <varlistentry id="kauth">
622 <term><command>kauth</command></term>
623 <listitem>
624 <para>is a symbolic link to the <command>kinit</command>
625 program.</para>
626 <indexterm zone="heimdal kauth">
627 <primary sortas="g-kauth">kauth</primary>
628 </indexterm>
629 </listitem>
630 </varlistentry>
631
632 <varlistentry id="kcm">
633 <term><command>kcm</command></term>
634 <listitem>
635 <para>is a process based credential cache for Kerberos
636 tickets.</para>
637 <indexterm zone="heimdal kcm">
638 <primary sortas="b-kcm">kcm</primary>
639 </indexterm>
640 </listitem>
641 </varlistentry>
642
643 <varlistentry id="kdc">
644 <term><command>kdc</command></term>
645 <listitem>
646 <para>is a Kerberos 5 server.</para>
647 <indexterm zone="heimdal kdc">
648 <primary sortas="b-kdc">kdc</primary>
649 </indexterm>
650 </listitem>
651 </varlistentry>
652
653 <varlistentry id="kdestroy">
654 <term><command>kdestroy</command></term>
655 <listitem>
656 <para>removes a principle's current set of tickets.</para>
657 <indexterm zone="heimdal kdestroy">
658 <primary sortas="b-kdestroy">kdestroy</primary>
659 </indexterm>
660 </listitem>
661 </varlistentry>
662
663 <varlistentry id="kf">
664 <term><command>kf</command></term>
665 <listitem>
666 <para>is a program which forwards tickets to a remote host through
667 an authenticated and encrypted stream.</para>
668 <indexterm zone="heimdal kf">
669 <primary sortas="b-kf">kf</primary>
670 </indexterm>
671 </listitem>
672 </varlistentry>
673
674 <varlistentry id="kfd">
675 <term><command>kfd</command></term>
676 <listitem>
677 <para>is a server used to receive forwarded tickets.</para>
678 <indexterm zone="heimdal kfd">
679 <primary sortas="b-kfd">kfd</primary>
680 </indexterm>
681 </listitem>
682 </varlistentry>
683
684 <varlistentry id="kgetcred">
685 <term><command>kgetcred</command></term>
686 <listitem>
687 <para>obtains a ticket for a service.</para>
688 <indexterm zone="heimdal kgetcred">
689 <primary sortas="b-kgetcred">kgetcred</primary>
690 </indexterm>
691 </listitem>
692 </varlistentry>
693
694 <varlistentry id="kinit">
695 <term><command>kinit</command></term>
696 <listitem>
697 <para>is used to authenticate to the Kerberos server as a principal
698 and acquire a ticket granting ticket that can later be used to obtain
699 tickets for other services.</para>
700 <indexterm zone="heimdal kinit">
701 <primary sortas="b-kinit">kinit</primary>
702 </indexterm>
703 </listitem>
704 </varlistentry>
705
706 <varlistentry id="klist">
707 <term><command>klist</command></term>
708 <listitem>
709 <para>reads and displays the current tickets in the credential
710 cache.</para>
711 <indexterm zone="heimdal klist">
712 <primary sortas="b-klist">klist</primary>
713 </indexterm>
714 </listitem>
715 </varlistentry>
716
717 <varlistentry id="kpasswd">
718 <term><command>kpasswd</command></term>
719 <listitem>
720 <para>is a program for changing Kerberos 5 passwords.</para>
721 <indexterm zone="heimdal kpasswd">
722 <primary sortas="b-kpasswd">kpasswd</primary>
723 </indexterm>
724 </listitem>
725 </varlistentry>
726
727 <varlistentry id="kpasswdd">
728 <term><command>kpasswdd</command></term>
729 <listitem>
730 <para>is a Kerberos 5 password changing server.</para>
731 <indexterm zone="heimdal kpasswdd">
732 <primary sortas="b-kpasswdd">kpasswdd</primary>
733 </indexterm>
734 </listitem>
735 </varlistentry>
736
737 <varlistentry id="krb5-config-prog">
738 <term><command>krb5-config</command></term>
739 <listitem>
740 <para>gives information on how to link programs against
741 <application>Heimdal</application> libraries.</para>
742 <indexterm zone="heimdal krb5-config-prog">
743 <primary sortas="b-krb5-config">krb5-config</primary>
744 </indexterm>
745 </listitem>
746 </varlistentry>
747
748 <varlistentry id="kstash">
749 <term><command>kstash</command></term>
750 <listitem>
751 <para>stores the KDC master password in a file.</para>
752 <indexterm zone="heimdal kstash">
753 <primary sortas="b-kstash">kstash</primary>
754 </indexterm>
755 </listitem>
756 </varlistentry>
757
758 <varlistentry id="ktutil">
759 <term><command>ktutil</command></term>
760 <listitem>
761 <para>is a program for managing Kerberos keytabs.</para>
762 <indexterm zone="heimdal ktutil">
763 <primary sortas="b-ktutil">ktutil</primary>
764 </indexterm>
765 </listitem>
766 </varlistentry>
767
768 <varlistentry id="kx">
769 <term><command>kx</command></term>
770 <listitem>
771 <para>is a program which securely forwards
772 <application>X</application> connections.</para>
773 <indexterm zone="heimdal kx">
774 <primary sortas="b-kx">kx</primary>
775 </indexterm>
776 </listitem>
777 </varlistentry>
778
779 <varlistentry id="kxd">
780 <term><command>kxd</command></term>
781 <listitem>
782 <para>is the daemon for <command>kx</command>.</para>
783 <indexterm zone="heimdal kxd">
784 <primary sortas="b-kxd">kxd</primary>
785 </indexterm>
786 </listitem>
787 </varlistentry>
788
789 <varlistentry id="login">
790 <term><command>login</command></term>
791 <listitem>
792 <para>is a kerberized login program.</para>
793 <indexterm zone="heimdal login">
794 <primary sortas="b-login">login</primary>
795 </indexterm>
796 </listitem>
797 </varlistentry>
798
799 <varlistentry id="otp">
800 <term><command>otp</command></term>
801 <listitem>
802 <para>manages one-time passwords.</para>
803 <indexterm zone="heimdal otp">
804 <primary sortas="b-otp">otp</primary>
805 </indexterm>
806 </listitem>
807 </varlistentry>
808
809 <varlistentry id="otpprint">
810 <term><command>otpprint</command></term>
811 <listitem>
812 <para>prints lists of one-time passwords.</para>
813 <indexterm zone="heimdal otpprint">
814 <primary sortas="b-otpprint">otpprint</primary>
815 </indexterm>
816 </listitem>
817 </varlistentry>
818
819 <varlistentry id="pfrom">
820 <term><command>pfrom</command></term>
821 <listitem>
822 <para>is a script that runs <command>push --from</command>.</para>
823 <indexterm zone="heimdal pfrom">
824 <primary sortas="b-pfrom">pfrom</primary>
825 </indexterm>
826 </listitem>
827 </varlistentry>
828
829 <varlistentry id="popper">
830 <term><command>popper</command></term>
831 <listitem>
832 <para>is a kerberized POP-3 server.</para>
833 <indexterm zone="heimdal popper">
834 <primary sortas="b-popper">popper</primary>
835 </indexterm>
836 </listitem>
837 </varlistentry>
838
839 <varlistentry id="push">
840 <term><command>push</command></term>
841 <listitem>
842 <para>is a kerberized POP mail retrieval client.</para>
843 <indexterm zone="heimdal push">
844 <primary sortas="b-push">push</primary>
845 </indexterm>
846 </listitem>
847 </varlistentry>
848
849 <varlistentry id="rcp">
850 <term><command>rcp</command></term>
851 <listitem>
852 <para>is a kerberized rcp client program.</para>
853 <indexterm zone="heimdal rcp">
854 <primary sortas="b-rcp">rcp</primary>
855 </indexterm>
856 </listitem>
857 </varlistentry>
858
859 <varlistentry id="rsh">
860 <term><command>rsh</command></term>
861 <listitem>
862 <para>is a kerberized rsh client program.</para>
863 <indexterm zone="heimdal rsh">
864 <primary sortas="b-rsh">rsh</primary>
865 </indexterm>
866 </listitem>
867 </varlistentry>
868
869 <varlistentry id="rshd">
870 <term><command>rshd</command></term>
871 <listitem>
872 <para>is a kerberized rsh server.</para>
873 <indexterm zone="heimdal rshd">
874 <primary sortas="b-rshd">rshd</primary>
875 </indexterm>
876 </listitem>
877 </varlistentry>
878
879 <varlistentry id="rxtelnet">
880 <term><command>rxtelnet</command></term>
881 <listitem>
882 <para>starts a secure <command>xterm</command> window with a
883 <command>telnet</command> to a given host and forwards
884 <application>X</application> connections.</para>
885 <indexterm zone="heimdal rxtelnet">
886 <primary sortas="b-rxtelnet">rxtelnet</primary>
887 </indexterm>
888 </listitem>
889 </varlistentry>
890
891 <varlistentry id="rxterm">
892 <term><command>rxterm</command></term>
893 <listitem>
894 <para>starts a secure remote <command>xterm</command>.</para>
895 <indexterm zone="heimdal rxterm">
896 <primary sortas="b-rxterm">rxterm</primary>
897 </indexterm>
898 </listitem>
899 </varlistentry>
900
901 <varlistentry id="string2key">
902 <term><command>string2key</command></term>
903 <listitem>
904 <para>maps a password into a key.</para>
905 <indexterm zone="heimdal string2key">
906 <primary sortas="b-string2key">string2key</primary>
907 </indexterm>
908 </listitem>
909 </varlistentry>
910
911 <varlistentry id="su">
912 <term><command>su</command></term>
913 <listitem>
914 <para>is a kerberized su client program.</para>
915 <indexterm zone="heimdal su">
916 <primary sortas="b-su">su</primary>
917 </indexterm>
918 </listitem>
919 </varlistentry>
920
921 <varlistentry id="telnet">
922 <term><command>telnet</command></term>
923 <listitem>
924 <para>is a kerberized telnet client program.</para>
925 <indexterm zone="heimdal telnet">
926 <primary sortas="b-telnet">telnet</primary>
927 </indexterm>
928 </listitem>
929 </varlistentry>
930
931 <varlistentry id="telnetd">
932 <term><command>telnetd</command></term>
933 <listitem>
934 <para>is a kerberized telnet server.</para>
935 <indexterm zone="heimdal telnetd">
936 <primary sortas="b-telnetd">telnetd</primary>
937 </indexterm>
938 </listitem>
939 </varlistentry>
940
941 <varlistentry id="tenletxr">
942 <term><command>tenletxr</command></term>
943 <listitem>
944 <para>forwards <application>X</application> connections
945 backwards.</para>
946 <indexterm zone="heimdal tenletxr">
947 <primary sortas="b-tenletxr">tenletxr</primary>
948 </indexterm>
949 </listitem>
950 </varlistentry>
951
952 <varlistentry id="verify_krb5_conf">
953 <term><command>verify_krb5_conf</command></term>
954 <listitem>
955 <para>checks <filename>krb5.conf</filename> file for obvious
956 errors.</para>
957 <indexterm zone="heimdal verify_krb5_conf">
958 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
959 </indexterm>
960 </listitem>
961 </varlistentry>
962
963 <varlistentry id="xnlock">
964 <term><command>xnlock</command></term>
965 <listitem>
966 <para>is a program that acts as a secure screen saver for
967 workstations running <application>X</application>.</para>
968 <indexterm zone="heimdal xnlock">
969 <primary sortas="b-xnlock">xnlock</primary>
970 </indexterm>
971 </listitem>
972 </varlistentry>
973
974 <varlistentry id="libasn1">
975 <term><filename class='libraryfile'>libasn1.[so,a]</filename></term>
976 <listitem>
977 <para>provides the ASN.1 and DER functions to encode and decode
978 the Kerberos TGTs.</para>
979 <indexterm zone="heimdal libasn1">
980 <primary sortas="c-libasn1">libasn1.[so,a]</primary>
981 </indexterm>
982 </listitem>
983 </varlistentry>
984
985 <varlistentry id="libeditline">
986 <term><filename class='libraryfile'>libeditline.a</filename></term>
987 <listitem>
988 <para>is a command-line editing library with history.</para>
989 <indexterm zone="heimdal libeditline">
990 <primary sortas="c-libeditline">libeditline.a</primary>
991 </indexterm>
992 </listitem>
993 </varlistentry>
994
995 <varlistentry id="libgssapi">
996 <term><filename class='libraryfile'>libgssapi.[so,a]</filename></term>
997 <listitem>
998 <para>contain the Generic Security Service Application Programming
999 Interface (GSSAPI) functions which provides security
1000 services to callers in a generic fashion, supportable with a range of
1001 underlying mechanisms and technologies and hence allowing source-level
1002 portability of applications to different environments.</para>
1003 <indexterm zone="heimdal libgssapi">
1004 <primary sortas="c-libgssapi">libgssapi.[so,a]</primary>
1005 </indexterm>
1006 </listitem>
1007 </varlistentry>
1008
1009 <varlistentry id="libhdb">
1010 <term><filename class='libraryfile'>libhdb.[so,a]</filename></term>
1011 <listitem>
1012 <para>is a <application>Heimdal</application> Kerberos 5
1013 authentication/authorization database access library.</para>
1014 <indexterm zone="heimdal libhdb">
1015 <primary sortas="c-libhdb">libhdb.[so,a]</primary>
1016 </indexterm>
1017 </listitem>
1018 </varlistentry>
1019
1020 <varlistentry id="libkadm5clnt">
1021 <term><filename class='libraryfile'>libkadm5clnt.[so,a]</filename></term>
1022 <listitem>
1023 <para>contains the administrative authentication and password
1024 checking functions required by Kerberos 5 client-side programs.</para>
1025 <indexterm zone="heimdal libkadm5clnt">
1026 <primary sortas="c-libkadm5clnt">libkadm5clnt.[so,a]</primary>
1027 </indexterm>
1028 </listitem>
1029 </varlistentry>
1030
1031 <varlistentry id="libkadm5srv">
1032 <term><filename class='libraryfile'>libkadm5srv.[so,a]</filename></term>
1033 <listitem>
1034 <para>contain the administrative authentication and password
1035 checking functions required by Kerberos 5 servers.</para>
1036 <indexterm zone="heimdal libkadm5srv">
1037 <primary sortas="c-libkadm5srv">libkadm5srv.[so,a]</primary>
1038 </indexterm>
1039 </listitem>
1040 </varlistentry>
1041
1042 <varlistentry id="libkafs">
1043 <term><filename class='libraryfile'>libkafs.[so,a]</filename></term>
1044 <listitem>
1045 <para>contains the functions required to authenticated to AFS.</para>
1046 <indexterm zone="heimdal libkafs">
1047 <primary sortas="c-libkafs">libkafs.[so,a]</primary>
1048 </indexterm>
1049 </listitem>
1050 </varlistentry>
1051
1052 <varlistentry id="libkrb5">
1053 <term><filename class='libraryfile'>libkrb5.[so,a]</filename></term>
1054 <listitem>
1055 <para>is an all-purpose Kerberos 5 library.</para>
1056 <indexterm zone="heimdal libkrb5">
1057 <primary sortas="c-libkrb5">libkrb5.[so,a]</primary>
1058 </indexterm>
1059 </listitem>
1060 </varlistentry>
1061
1062 <varlistentry id="libotp">
1063 <term><filename class='libraryfile'>libotp.[so,a]</filename></term>
1064 <listitem>
1065 <para>contains the functions required to handle authenticating
1066 one time passwords.</para>
1067 <indexterm zone="heimdal libotp">
1068 <primary sortas="c-libotp">libotp.[so,a]</primary>
1069 </indexterm>
1070 </listitem>
1071 </varlistentry>
1072
1073 <varlistentry id="libroken">
1074 <term><filename class='libraryfile'>libroken.[so,a]</filename></term>
1075 <listitem>
1076 <para>is a library containing Kerberos 5 compatibility
1077 functions.</para>
1078 <indexterm zone="heimdal libroken">
1079 <primary sortas="c-libroken">libroken.[so,a]</primary>
1080 </indexterm>
1081 </listitem>
1082 </varlistentry>
1083
1084 </variablelist>
1085
1086 </sect2>
1087
1088</sect1>
Note: See TracBrowser for help on using the repository browser.