source: postlfs/security/heimdal.xml@ 371ff30

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 371ff30 was 371ff30, checked in by DJ Lucas <dj@…>, 18 years ago

several cleanups-Xorg7 related

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5700 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 41.6 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "70504c824cb0437e6fae2b866f9d2ed4">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "96.9 MB">
12 <!ENTITY heimdal-time "2.7 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">heimdal-&heimdal-version;.tar</keyword>
23 <keyword role="ftpdir">heimdal</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Heimdal-&heimdal-version;</title>
28
29 <indexterm zone="heimdal">
30 <primary sortas="a-Heimdal">Heimdal</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Heimdal</title>
35
36 <para><application>Heimdal</application> is a free implementation
37 of Kerberos 5 that aims to be compatible with MIT krb5 and is
38 backward compatible with krb4. Kerberos is a network authentication
39 protocol. Basically it preserves the integrity of passwords in any
40 untrusted network (like the Internet). Kerberized applications work
41 hand-in-hand with sites that support Kerberos to ensure that passwords
42 cannot be stolen or compromised. A Kerberos installation will make changes
43 to the authentication mechanisms on your network and will overwrite several
44 programs and daemons from the <application>Coreutils</application>,
45 <application>Inetutils</application>, <application>Qpopper</application>
46 and <application>Shadow</application> packages.</para>
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &heimdal-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &heimdal-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &heimdal-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &heimdal-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing='compact'>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required">
86 <!-- <xref linkend="db"/> -->
87 <xref linkend="db"/> is recommended (installed in LFS)
88 or <xref linkend="gdbm"/></para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended"><xref linkend="openssl"/></para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional"><xref linkend="linux-pam"/>,
95 <xref linkend="openldap"/>,
96 X (<xref linkend="xorg"/>, <xref linkend="xfree86"/>,
97 or <xref linkend="xorg7"/>),
98 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
99 patch), and
100 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
101
102 <note>
103 <para>Some sort of time synchronization facility on your system
104 (like <xref linkend="ntp"/>) is required since Kerberos won't
105 authenticate if the time differential between a kerberized client
106 and the KDC server is more than 5 minutes.</para>
107 </note>
108
109 </sect2>
110
111 <sect2 role="installation">
112 <title>Installation of Heimdal</title>
113
114 <!-- This doesn't appear to be needed any longer as testing has
115 shown that the ftp client now works without issues
116
117 <para>Before installing the package, you may want to preserve the
118 <command>ftp</command> program from the <application>Inetutils</application>
119 package. This is because using the <application>Heimdal</application>
120 <command>ftp</command> program to connect to non-kerberized ftp servers may
121 not work properly. It will allow you to connect (letting you know that
122 transmission of the password is clear text) but will have problems doing
123 puts and gets. Issue the following command as the
124 <systemitem class="username">root</systemitem> user.</para>
125
126<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
127
128 -->
129
130 <warning>
131 <para>Ensure you really need a Kerberos installation before you decide
132 to install this package. Failure to install and configure the package
133 in accordance with the instructions below can render your system
134 unusable.</para>
135 </warning>
136
137 <para>If you wish the <application>Heimdal</application> package to
138 link against the <application>CrackLib</application> library to provide
139 enforcement of strong passwords (requires <xref linkend="cracklib"/>
140 installed with the <filename>heimdal</filename> patch), you must apply a
141 patch:</para>
142
143<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
144
145 <para>Install <application>Heimdal</application> by running the following
146 commands:</para>
147
148<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
149./configure --prefix=/usr \
150 --sysconfdir=/etc/heimdal \
151 --libexecdir=/usr/sbin \
152 --datadir=/var/lib/heimdal \
153 --localstatedir=/var/lib/heimdal \
154 --enable-shared \
155 --with-readline=/usr &amp;&amp;
156make</userinput></screen>
157
158 <para>If you wish to create HTML documentation, issue the following
159 command:</para>
160
161<screen><userinput>make -C doc heimdal.html</userinput></screen>
162
163 <para>If you wish to create a text-based version of the documentation,
164 issue the following commands:</para>
165
166<screen><userinput>cd doc &amp;&amp;
167makeinfo --plaintext -o heimdal.txt heimdal.texi &amp;&amp;
168cd ..</userinput></screen>
169
170 <para>To test the results, issue: <command>make check</command>.</para>
171
172 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
173
174<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
175mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
176mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
177mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
178mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
179make install &amp;&amp;
180mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
181mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
182mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
183mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
184install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
185install -v -m644 doc/{init-creds,layman.asc} \
186 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
187install -v -m644 doc/standardisation/* \
188 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
189mv -v /bin/login /bin/login.shadow &amp;&amp;
190mv -v /bin/su /bin/su.shadow &amp;&amp;
191mv -v /usr/bin/{login,su} /bin &amp;&amp;
192ln -v -sf ../../bin/login /usr/bin &amp;&amp;
193mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
194 /usr/lib/libdb-4.4.so /lib &amp;&amp;
195ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb.so &amp;&amp;
196ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb-4.so &amp;&amp;
197for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
198 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.7
199do
200 ln -v -sf ../../lib/lib$SYMLINK \
201 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
202done
203ldconfig</userinput></screen>
204
205 <para>If you built the HTML or text-based documentation, install it using
206 the following commands as the
207 <systemitem class="username">root</systemitem> user:</para>
208
209<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
210install -v -m644 doc/heimdal.html/* \
211 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
212install -v -m644 doc/heimdal.txt /usr/share/doc/heimdal-&heimdal-version;</userinput></screen>
213
214 </sect2>
215
216 <sect2 role="commands">
217 <title>Command Explanations</title>
218
219 <para><command>mv -v /usr/include/...</command> and
220 <command>mv -v /usr/lib/libss.*</command>: The
221 <application>Heimdal</application> installation will overwrite two
222 interface headers from the <application>Glibc</application> package and an
223 interface header, static library and library symbolic link from the
224 <application>E2fsprogs</application> package. These commands move the
225 original files out of the way before the installation, and then restore
226 the original <application>Glibc</application> headers after the
227 installation. The two <application>Heimdal</application> headers are renamed
228 and preserved on the system. Testing has shown that the system is stable
229 using the <application>Heimdal</application> version of the
230 <filename>libss</filename> library and interface header.</para>
231
232 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
233 puts the daemon programs into
234 <filename class="directory">/usr/sbin</filename>.</para>
235
236 <tip>
237 <para>If you want to preserve all your existing
238 <application>Inetutils</application> package daemons, install the
239 <application>Heimdal</application> daemons into
240 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
241 you want). Since these programs will be called from
242 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
243 really doesn't matter where they are installed, as long as they are
244 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
245 and <filename>rc</filename> scripts. If you choose something other than
246 <filename class="directory">/usr/sbin</filename>, you may want to move
247 some of the user programs (such as <command>kadmin</command>) to
248 <filename class="directory">/usr/sbin</filename> manually so they'll be
249 in the privileged user's default <envar>PATH</envar>.</para>
250 </tip>
251
252 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
253 The <command>login</command> and <command>su</command> programs installed by
254 <application>Heimdal</application> belong in the
255 <filename class="directory">/bin</filename> directory. The
256 <command>login</command> program is symlinked because
257 <application>Heimdal</application> is expecting to find it in
258 <filename class="directory">/usr/bin</filename>. The old executables are
259 preserved before the move so that they can be restored if you experience
260 problems logging into the system after the
261 <application>Heimdal</application> package is installed and
262 configured.</para>
263
264 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
265 The <command>login</command> and <command>su</command> programs installed
266 by <application>Heimdal</application> link against
267 <application>Heimdal</application> libraries as well as libraries provided
268 by the <application>OpenSSL</application> and
269 <application>Berkeley DB</application> packages. These
270 libraries are moved to <filename class="directory">/lib</filename> to be
271 FHS compliant and also in case
272 <filename class="directory">/usr</filename> is located on a separate
273 partition which may not always be mounted.</para>
274
275 </sect2>
276
277 <sect2 role="configuration">
278 <title>Configuring Heimdal</title>
279
280 <sect3 id="heimdal-config">
281 <title>Config Files</title>
282
283 <para><filename>/etc/heimdal/*</filename></para>
284
285 <indexterm zone="heimdal heimdal-config">
286 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
287 </indexterm>
288
289 </sect3>
290
291 <sect3>
292 <title>Configuration Information</title>
293
294 <note>
295 <para>All the configuration steps shown below must be accomplished
296 by the <systemitem class='username'>root</systemitem> user unless
297 otherwise noted.</para>
298 </note>
299
300 <sect4>
301 <title>Master KDC Server Configuration</title>
302
303 <para>Create the Kerberos configuration file with the
304 following commands:</para>
305
306<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
307cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
308<literal># Begin /etc/heimdal/krb5.conf
309
310[libdefaults]
311 default_realm = <replaceable>[EXAMPLE.COM]</replaceable>
312 encrypt = true
313
314[realms]
315 <replaceable>[EXAMPLE.COM]</replaceable> = {
316 kdc = <replaceable>[hostname.example.com]</replaceable>
317 admin_server = <replaceable>[hostname.example.com]</replaceable>
318 kpasswd_server = <replaceable>[hostname.example.com]</replaceable>
319 }
320
321[domain_realm]
322 .<replaceable>[example.com]</replaceable> = <replaceable>[EXAMPLE.COM]</replaceable>
323
324[logging]
325 kdc = FILE:/var/log/kdc.log
326 admin_server = FILE:/var/log/kadmin.log
327 default = FILE:/var/log/krb.log
328
329# End /etc/heimdal/krb5.conf</literal>
330EOF
331chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
332
333 <para>You will need to substitute your domain and proper hostname
334 for the occurrences of the <replaceable>[hostname]</replaceable>
335 and <replaceable>[EXAMPLE.COM]</replaceable> names.</para>
336
337 <para><option>default_realm</option> should be the name of your
338 domain changed to ALL CAPS. This isn't required, but both
339 <application>Heimdal</application> and <application>MIT
340 krb5</application> recommend it.</para>
341
342 <para><option>encrypt = true</option> provides encryption of all
343 traffic between kerberized clients and servers. It's not necessary
344 and can be left off. If you leave it off, you can encrypt all traffic
345 from the client to the server using a switch on the client program
346 instead.</para>
347
348 <para>The <option>[realms]</option> parameters tell the client
349 programs where to look for the KDC authentication services.</para>
350
351 <para>The <option>[domain_realm]</option> section maps a domain
352 to a realm.</para>
353
354 <para>Store the master password in a key file using the following
355 commands:</para>
356
357<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
358kstash</userinput></screen>
359
360 <para>Create the KDC database:</para>
361
362<screen role="root"><userinput>kadmin -l</userinput></screen>
363
364 <para>The commands below will prompt you for information about the
365 principles. Choose the defaults for now unless you know what you are
366 doing and need to specify different values. You can go in later and
367 change the defaults, should you feel the need. You may use the up and
368 down arrow keys to use the history feature of <command>kadmin</command>
369 in a similar manner as the <command>bash</command> history
370 feature.</para>
371
372 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
373 statement:</para>
374
375<screen role="root"><userinput>init <replaceable>[EXAMPLE.COM]</replaceable></userinput></screen>
376
377 <para>The database must now be populated with at least one principle
378 (user). For now, just use your regular login name or root. You may
379 create as few, or as many principles as you wish using the following
380 statement:</para>
381
382<screen role="root"><userinput>add <replaceable>[loginname]</replaceable></userinput></screen>
383
384 <para>The KDC server and any machine running kerberized
385 server daemons must have a host key installed:</para>
386
387<screen role="root"><userinput>add --random-key host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
388
389 <para>After choosing the defaults when prompted, you will have to
390 export the data to a keytab file:</para>
391
392<screen role="root"><userinput>ext host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
393
394 <para>This should have created two files in
395 <filename class="directory">/etc/heimdal</filename>:
396 <filename>krb5.keytab</filename> (Kerberos 5) and
397 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
398 (root rw only) permissions. Keeping the keytab files from public access
399 is crucial to the overall security of the Kerberos installation.</para>
400
401 <para>Eventually, you'll want to add server daemon principles to the
402 database and extract them to the keytab file. You do this in the same
403 way you created the host principles. Below is an example:</para>
404
405<screen role="root"><userinput>add --random-key ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
406
407 <para>(choose the defaults)</para>
408
409<screen role="root"><userinput>ext ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
410
411 <para>Exit the <command>kadmin</command> program (use
412 <command>quit</command> or <command>exit</command>) and return back
413 to the shell prompt. Start the KDC daemon manually, just to test out
414 the installation:</para>
415
416<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
417
418 <para>Attempt to get a TGT (ticket granting ticket) with
419 the following command:</para>
420
421<screen><userinput>kinit <replaceable>[loginname]</replaceable></userinput></screen>
422
423 <para>You will be prompted for the password you created. After you get
424 your ticket, you should list it with the following command:</para>
425
426<screen><userinput>klist</userinput></screen>
427
428 <para>Information about the ticket should be displayed on
429 the screen.</para>
430
431 <para>To test the functionality of the <filename>keytab</filename> file,
432 issue the following command:</para>
433
434<screen><userinput>ktutil list</userinput></screen>
435
436 <para>This should dump a list of the host principals, along with the
437 encryption methods used to access the principals.</para>
438
439 <para>At this point, if everything has been successful so far, you
440 can feel fairly confident in the installation, setup and configuration
441 of your new <application>Heimdal</application> Kerberos 5
442 installation.</para>
443
444 <para id="heimdal-init">Install the
445 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
446 in the <xref linkend="bootscripts"/> package:</para>
447
448 <indexterm zone="heimdal heimdal-init">
449 <primary sortas="f-heimdal">heimdal</primary>
450 </indexterm>
451
452<screen role="root"><userinput>make install-heimdal</userinput></screen>
453
454 </sect4>
455
456 <sect4>
457 <title>Using Kerberized Client Programs</title>
458
459 <para>To use the kerberized client programs (<command>telnet</command>,
460 <command>ftp</command>, <command>rsh</command>,
461 <command>rxterm</command>, <command>rxtelnet</command>,
462 <command>rcp</command>, <command>xnlock</command>), you first must get
463 a TGT. Use the <command>kinit</command> program to get the ticket.
464 After you've acquired the ticket, you can use the kerberized programs
465 to connect to any kerberized server on the network. You will not be
466 prompted for authentication until your ticket expires (default is one
467 day), unless you specify a different user as a command line argument
468 to the program.</para>
469
470 <para>The kerberized programs will connect to non-kerberized daemons,
471 warning you that authentication is not encrypted.</para>
472
473 <para>In order to use the <application>Heimdal</application>
474 <application>X</application> programs, you'll need to add a service
475 port entry to the <filename>/etc/services</filename> file for the
476 <command>kxd</command> server. There is no 'standardized port number'
477 for the 'kx' service in the IANA database, so you'll have to pick an
478 unused port number. Add an entry to the <filename>services</filename>
479 file similar to the entry below (substitute your chosen port number
480 for <replaceable>[49150]</replaceable>):</para>
481
482<screen><literal>kx <replaceable>[49150]</replaceable>/tcp # Heimdal kerberos X
483kx <replaceable>[49150]</replaceable>/udp # Heimdal kerberos X</literal></screen>
484
485 <para>For additional information consult <ulink
486 url="&hints-root;/downloads/files/heimdal.txt">the
487 Heimdal hint</ulink> on which the above instructions are based.</para>
488
489 </sect4>
490
491 </sect3>
492
493 </sect2>
494
495 <sect2 role="content">
496 <title>Contents</title>
497
498 <segmentedlist>
499 <segtitle>Installed Programs</segtitle>
500 <segtitle>Installed Libraries</segtitle>
501 <segtitle>Installed Directories</segtitle>
502
503 <seglistitem>
504 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
505 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
506 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
507 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
508 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
509 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
510 and xnlock</seg>
511 <seg>libasn1.[so,a], libeditline.[so,a], libgssapi.[so,a],
512 libhdb.[so,a], libkadm5clnt.[so,a], libkadm5srv.[so,a], libkafs.[so,a],
513 libkrb5.[so,a], libotp.[so,a], libroken.[so,a], libsl.[so,a]
514 and libss.[so,a]</seg>
515 <seg>/etc/heimdal, /usr/include/kadm5,
516 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
517 </seglistitem>
518 </segmentedlist>
519
520 <variablelist>
521 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
522 <?dbfo list-presentation="list"?>
523 <?dbhtml list-presentation="table"?>
524
525 <varlistentry id="afslog">
526 <term><command>afslog</command></term>
527 <listitem>
528 <para>obtains AFS tokens for a number of cells.</para>
529 <indexterm zone="heimdal afslog">
530 <primary sortas="b-afslog">afslog</primary>
531 </indexterm>
532 </listitem>
533 </varlistentry>
534
535 <varlistentry id="ftp">
536 <term><command>ftp</command></term>
537 <listitem>
538 <para>is a kerberized FTP client.</para>
539 <indexterm zone="heimdal ftp">
540 <primary sortas="b-ftp">ftp</primary>
541 </indexterm>
542 </listitem>
543 </varlistentry>
544
545 <varlistentry id="ftpd">
546 <term><command>ftpd</command></term>
547 <listitem>
548 <para>is a kerberized FTP daemon.</para>
549 <indexterm zone="heimdal ftpd">
550 <primary sortas="b-ftpd">ftpd</primary>
551 </indexterm>
552 </listitem>
553 </varlistentry>
554
555 <varlistentry id="hprop">
556 <term><command>hprop</command></term>
557 <listitem>
558 <para> takes a principal database in a specified format and converts
559 it into a stream of <application>Heimdal</application> database
560 records.</para>
561 <indexterm zone="heimdal hprop">
562 <primary sortas="b-hprop">hprop</primary>
563 </indexterm>
564 </listitem>
565 </varlistentry>
566
567 <varlistentry id="hpropd">
568 <term><command>hpropd</command></term>
569 <listitem>
570 <para>is a server that receives a database sent by
571 <command>hprop</command> and writes it as a local database.</para>
572 <indexterm zone="heimdal hpropd">
573 <primary sortas="b-hpropd">hpropd</primary>
574 </indexterm>
575 </listitem>
576 </varlistentry>
577
578 <varlistentry id="ipropd-master">
579 <term><command>ipropd-master</command></term>
580 <listitem>
581 <para>is a daemon which runs on the master KDC
582 server which incrementally propagates changes to the KDC
583 database to the slave KDC servers.</para>
584 <indexterm zone="heimdal ipropd-master">
585 <primary sortas="b-ipropd-master">ipropd-master</primary>
586 </indexterm>
587 </listitem>
588 </varlistentry>
589
590 <varlistentry id="ipropd-slave">
591 <term><command>ipropd-slave</command></term>
592 <listitem>
593 <para>is a daemon which runs on the slave KDC
594 servers which incrementally propagates changes to the KDC
595 database from the master KDC server.</para>
596 <indexterm zone="heimdal ipropd-slave">
597 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
598 </indexterm>
599 </listitem>
600 </varlistentry>
601
602 <varlistentry id="kadmin">
603 <term><command>kadmin</command></term>
604 <listitem>
605 <para>is a utility used to make modifications to the Kerberos
606 database.</para>
607 <indexterm zone="heimdal kadmin">
608 <primary sortas="b-kadmin">kadmin</primary>
609 </indexterm>
610 </listitem>
611 </varlistentry>
612
613 <varlistentry id="kadmind">
614 <term><command>kadmind</command></term>
615 <listitem>
616 <para>is a server for administrative access to the Kerberos
617 database.</para>
618 <indexterm zone="heimdal kadmind">
619 <primary sortas="b-kadmind">kadmind</primary>
620 </indexterm>
621 </listitem>
622 </varlistentry>
623
624 <varlistentry id="kauth">
625 <term><command>kauth</command></term>
626 <listitem>
627 <para>is a symbolic link to the <command>kinit</command>
628 program.</para>
629 <indexterm zone="heimdal kauth">
630 <primary sortas="g-kauth">kauth</primary>
631 </indexterm>
632 </listitem>
633 </varlistentry>
634
635 <varlistentry id="kcm">
636 <term><command>kcm</command></term>
637 <listitem>
638 <para>is a process based credential cache for Kerberos
639 tickets.</para>
640 <indexterm zone="heimdal kcm">
641 <primary sortas="b-kcm">kcm</primary>
642 </indexterm>
643 </listitem>
644 </varlistentry>
645
646 <varlistentry id="kdc">
647 <term><command>kdc</command></term>
648 <listitem>
649 <para>is a Kerberos 5 server.</para>
650 <indexterm zone="heimdal kdc">
651 <primary sortas="b-kdc">kdc</primary>
652 </indexterm>
653 </listitem>
654 </varlistentry>
655
656 <varlistentry id="kdestroy">
657 <term><command>kdestroy</command></term>
658 <listitem>
659 <para>removes a principle's current set of tickets.</para>
660 <indexterm zone="heimdal kdestroy">
661 <primary sortas="b-kdestroy">kdestroy</primary>
662 </indexterm>
663 </listitem>
664 </varlistentry>
665
666 <varlistentry id="kf">
667 <term><command>kf</command></term>
668 <listitem>
669 <para>is a program which forwards tickets to a remote host through
670 an authenticated and encrypted stream.</para>
671 <indexterm zone="heimdal kf">
672 <primary sortas="b-kf">kf</primary>
673 </indexterm>
674 </listitem>
675 </varlistentry>
676
677 <varlistentry id="kfd">
678 <term><command>kfd</command></term>
679 <listitem>
680 <para>is a server used to receive forwarded tickets.</para>
681 <indexterm zone="heimdal kfd">
682 <primary sortas="b-kfd">kfd</primary>
683 </indexterm>
684 </listitem>
685 </varlistentry>
686
687 <varlistentry id="kgetcred">
688 <term><command>kgetcred</command></term>
689 <listitem>
690 <para>obtains a ticket for a service.</para>
691 <indexterm zone="heimdal kgetcred">
692 <primary sortas="b-kgetcred">kgetcred</primary>
693 </indexterm>
694 </listitem>
695 </varlistentry>
696
697 <varlistentry id="kinit">
698 <term><command>kinit</command></term>
699 <listitem>
700 <para>is used to authenticate to the Kerberos server as a principal
701 and acquire a ticket granting ticket that can later be used to obtain
702 tickets for other services.</para>
703 <indexterm zone="heimdal kinit">
704 <primary sortas="b-kinit">kinit</primary>
705 </indexterm>
706 </listitem>
707 </varlistentry>
708
709 <varlistentry id="klist">
710 <term><command>klist</command></term>
711 <listitem>
712 <para>reads and displays the current tickets in the credential
713 cache.</para>
714 <indexterm zone="heimdal klist">
715 <primary sortas="b-klist">klist</primary>
716 </indexterm>
717 </listitem>
718 </varlistentry>
719
720 <varlistentry id="kpasswd">
721 <term><command>kpasswd</command></term>
722 <listitem>
723 <para>is a program for changing Kerberos 5 passwords.</para>
724 <indexterm zone="heimdal kpasswd">
725 <primary sortas="b-kpasswd">kpasswd</primary>
726 </indexterm>
727 </listitem>
728 </varlistentry>
729
730 <varlistentry id="kpasswdd">
731 <term><command>kpasswdd</command></term>
732 <listitem>
733 <para>is a Kerberos 5 password changing server.</para>
734 <indexterm zone="heimdal kpasswdd">
735 <primary sortas="b-kpasswdd">kpasswdd</primary>
736 </indexterm>
737 </listitem>
738 </varlistentry>
739
740 <varlistentry id="krb5-config-prog">
741 <term><command>krb5-config</command></term>
742 <listitem>
743 <para>gives information on how to link programs against
744 <application>Heimdal</application> libraries.</para>
745 <indexterm zone="heimdal krb5-config-prog">
746 <primary sortas="b-krb5-config">krb5-config</primary>
747 </indexterm>
748 </listitem>
749 </varlistentry>
750
751 <varlistentry id="kstash">
752 <term><command>kstash</command></term>
753 <listitem>
754 <para>stores the KDC master password in a file.</para>
755 <indexterm zone="heimdal kstash">
756 <primary sortas="b-kstash">kstash</primary>
757 </indexterm>
758 </listitem>
759 </varlistentry>
760
761 <varlistentry id="ktutil">
762 <term><command>ktutil</command></term>
763 <listitem>
764 <para>is a program for managing Kerberos keytabs.</para>
765 <indexterm zone="heimdal ktutil">
766 <primary sortas="b-ktutil">ktutil</primary>
767 </indexterm>
768 </listitem>
769 </varlistentry>
770
771 <varlistentry id="kx">
772 <term><command>kx</command></term>
773 <listitem>
774 <para>is a program which securely forwards
775 <application>X</application> connections.</para>
776 <indexterm zone="heimdal kx">
777 <primary sortas="b-kx">kx</primary>
778 </indexterm>
779 </listitem>
780 </varlistentry>
781
782 <varlistentry id="kxd">
783 <term><command>kxd</command></term>
784 <listitem>
785 <para>is the daemon for <command>kx</command>.</para>
786 <indexterm zone="heimdal kxd">
787 <primary sortas="b-kxd">kxd</primary>
788 </indexterm>
789 </listitem>
790 </varlistentry>
791
792 <varlistentry id="login">
793 <term><command>login</command></term>
794 <listitem>
795 <para>is a kerberized login program.</para>
796 <indexterm zone="heimdal login">
797 <primary sortas="b-login">login</primary>
798 </indexterm>
799 </listitem>
800 </varlistentry>
801
802 <varlistentry id="otp">
803 <term><command>otp</command></term>
804 <listitem>
805 <para>manages one-time passwords.</para>
806 <indexterm zone="heimdal otp">
807 <primary sortas="b-otp">otp</primary>
808 </indexterm>
809 </listitem>
810 </varlistentry>
811
812 <varlistentry id="otpprint">
813 <term><command>otpprint</command></term>
814 <listitem>
815 <para>prints lists of one-time passwords.</para>
816 <indexterm zone="heimdal otpprint">
817 <primary sortas="b-otpprint">otpprint</primary>
818 </indexterm>
819 </listitem>
820 </varlistentry>
821
822 <varlistentry id="pfrom">
823 <term><command>pfrom</command></term>
824 <listitem>
825 <para>is a script that runs <command>push --from</command>.</para>
826 <indexterm zone="heimdal pfrom">
827 <primary sortas="b-pfrom">pfrom</primary>
828 </indexterm>
829 </listitem>
830 </varlistentry>
831
832 <varlistentry id="popper">
833 <term><command>popper</command></term>
834 <listitem>
835 <para>is a kerberized POP-3 server.</para>
836 <indexterm zone="heimdal popper">
837 <primary sortas="b-popper">popper</primary>
838 </indexterm>
839 </listitem>
840 </varlistentry>
841
842 <varlistentry id="push">
843 <term><command>push</command></term>
844 <listitem>
845 <para>is a kerberized POP mail retrieval client.</para>
846 <indexterm zone="heimdal push">
847 <primary sortas="b-push">push</primary>
848 </indexterm>
849 </listitem>
850 </varlistentry>
851
852 <varlistentry id="rcp">
853 <term><command>rcp</command></term>
854 <listitem>
855 <para>is a kerberized rcp client program.</para>
856 <indexterm zone="heimdal rcp">
857 <primary sortas="b-rcp">rcp</primary>
858 </indexterm>
859 </listitem>
860 </varlistentry>
861
862 <varlistentry id="rsh">
863 <term><command>rsh</command></term>
864 <listitem>
865 <para>is a kerberized rsh client program.</para>
866 <indexterm zone="heimdal rsh">
867 <primary sortas="b-rsh">rsh</primary>
868 </indexterm>
869 </listitem>
870 </varlistentry>
871
872 <varlistentry id="rshd">
873 <term><command>rshd</command></term>
874 <listitem>
875 <para>is a kerberized rsh server.</para>
876 <indexterm zone="heimdal rshd">
877 <primary sortas="b-rshd">rshd</primary>
878 </indexterm>
879 </listitem>
880 </varlistentry>
881
882 <varlistentry id="rxtelnet">
883 <term><command>rxtelnet</command></term>
884 <listitem>
885 <para>starts a secure <command>xterm</command> window with a
886 <command>telnet</command> to a given host and forwards
887 <application>X</application> connections.</para>
888 <indexterm zone="heimdal rxtelnet">
889 <primary sortas="b-rxtelnet">rxtelnet</primary>
890 </indexterm>
891 </listitem>
892 </varlistentry>
893
894 <varlistentry id="rxterm">
895 <term><command>rxterm</command></term>
896 <listitem>
897 <para>starts a secure remote <command>xterm</command>.</para>
898 <indexterm zone="heimdal rxterm">
899 <primary sortas="b-rxterm">rxterm</primary>
900 </indexterm>
901 </listitem>
902 </varlistentry>
903
904 <varlistentry id="string2key">
905 <term><command>string2key</command></term>
906 <listitem>
907 <para>maps a password into a key.</para>
908 <indexterm zone="heimdal string2key">
909 <primary sortas="b-string2key">string2key</primary>
910 </indexterm>
911 </listitem>
912 </varlistentry>
913
914 <varlistentry id="su">
915 <term><command>su</command></term>
916 <listitem>
917 <para>is a kerberized su client program.</para>
918 <indexterm zone="heimdal su">
919 <primary sortas="b-su">su</primary>
920 </indexterm>
921 </listitem>
922 </varlistentry>
923
924 <varlistentry id="telnet">
925 <term><command>telnet</command></term>
926 <listitem>
927 <para>is a kerberized telnet client program.</para>
928 <indexterm zone="heimdal telnet">
929 <primary sortas="b-telnet">telnet</primary>
930 </indexterm>
931 </listitem>
932 </varlistentry>
933
934 <varlistentry id="telnetd">
935 <term><command>telnetd</command></term>
936 <listitem>
937 <para>is a kerberized telnet server.</para>
938 <indexterm zone="heimdal telnetd">
939 <primary sortas="b-telnetd">telnetd</primary>
940 </indexterm>
941 </listitem>
942 </varlistentry>
943
944 <varlistentry id="tenletxr">
945 <term><command>tenletxr</command></term>
946 <listitem>
947 <para>forwards <application>X</application> connections
948 backwards.</para>
949 <indexterm zone="heimdal tenletxr">
950 <primary sortas="b-tenletxr">tenletxr</primary>
951 </indexterm>
952 </listitem>
953 </varlistentry>
954
955 <varlistentry id="verify_krb5_conf">
956 <term><command>verify_krb5_conf</command></term>
957 <listitem>
958 <para>checks <filename>krb5.conf</filename> file for obvious
959 errors.</para>
960 <indexterm zone="heimdal verify_krb5_conf">
961 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
962 </indexterm>
963 </listitem>
964 </varlistentry>
965
966 <varlistentry id="xnlock">
967 <term><command>xnlock</command></term>
968 <listitem>
969 <para>is a program that acts as a secure screen saver for
970 workstations running <application>X</application>.</para>
971 <indexterm zone="heimdal xnlock">
972 <primary sortas="b-xnlock">xnlock</primary>
973 </indexterm>
974 </listitem>
975 </varlistentry>
976
977 <varlistentry id="libasn1">
978 <term><filename class='libraryfile'>libasn1.[so,a]</filename></term>
979 <listitem>
980 <para>provides the ASN.1 and DER functions to encode and decode
981 the Kerberos TGTs.</para>
982 <indexterm zone="heimdal libasn1">
983 <primary sortas="c-libasn1">libasn1.[so,a]</primary>
984 </indexterm>
985 </listitem>
986 </varlistentry>
987
988 <varlistentry id="libeditline">
989 <term><filename class='libraryfile'>libeditline.a</filename></term>
990 <listitem>
991 <para>is a command-line editing library with history.</para>
992 <indexterm zone="heimdal libeditline">
993 <primary sortas="c-libeditline">libeditline.a</primary>
994 </indexterm>
995 </listitem>
996 </varlistentry>
997
998 <varlistentry id="libgssapi">
999 <term><filename class='libraryfile'>libgssapi.[so,a]</filename></term>
1000 <listitem>
1001 <para>contain the Generic Security Service Application Programming
1002 Interface (GSSAPI) functions which provides security
1003 services to callers in a generic fashion, supportable with a range of
1004 underlying mechanisms and technologies and hence allowing source-level
1005 portability of applications to different environments.</para>
1006 <indexterm zone="heimdal libgssapi">
1007 <primary sortas="c-libgssapi">libgssapi.[so,a]</primary>
1008 </indexterm>
1009 </listitem>
1010 </varlistentry>
1011
1012 <varlistentry id="libhdb">
1013 <term><filename class='libraryfile'>libhdb.[so,a]</filename></term>
1014 <listitem>
1015 <para>is a <application>Heimdal</application> Kerberos 5
1016 authentication/authorization database access library.</para>
1017 <indexterm zone="heimdal libhdb">
1018 <primary sortas="c-libhdb">libhdb.[so,a]</primary>
1019 </indexterm>
1020 </listitem>
1021 </varlistentry>
1022
1023 <varlistentry id="libkadm5clnt">
1024 <term><filename class='libraryfile'>libkadm5clnt.[so,a]</filename></term>
1025 <listitem>
1026 <para>contains the administrative authentication and password
1027 checking functions required by Kerberos 5 client-side programs.</para>
1028 <indexterm zone="heimdal libkadm5clnt">
1029 <primary sortas="c-libkadm5clnt">libkadm5clnt.[so,a]</primary>
1030 </indexterm>
1031 </listitem>
1032 </varlistentry>
1033
1034 <varlistentry id="libkadm5srv">
1035 <term><filename class='libraryfile'>libkadm5srv.[so,a]</filename></term>
1036 <listitem>
1037 <para>contain the administrative authentication and password
1038 checking functions required by Kerberos 5 servers.</para>
1039 <indexterm zone="heimdal libkadm5srv">
1040 <primary sortas="c-libkadm5srv">libkadm5srv.[so,a]</primary>
1041 </indexterm>
1042 </listitem>
1043 </varlistentry>
1044
1045 <varlistentry id="libkafs">
1046 <term><filename class='libraryfile'>libkafs.[so,a]</filename></term>
1047 <listitem>
1048 <para>contains the functions required to authenticated to AFS.</para>
1049 <indexterm zone="heimdal libkafs">
1050 <primary sortas="c-libkafs">libkafs.[so,a]</primary>
1051 </indexterm>
1052 </listitem>
1053 </varlistentry>
1054
1055 <varlistentry id="libkrb5">
1056 <term><filename class='libraryfile'>libkrb5.[so,a]</filename></term>
1057 <listitem>
1058 <para>is an all-purpose Kerberos 5 library.</para>
1059 <indexterm zone="heimdal libkrb5">
1060 <primary sortas="c-libkrb5">libkrb5.[so,a]</primary>
1061 </indexterm>
1062 </listitem>
1063 </varlistentry>
1064
1065 <varlistentry id="libotp">
1066 <term><filename class='libraryfile'>libotp.[so,a]</filename></term>
1067 <listitem>
1068 <para>contains the functions required to handle authenticating
1069 one time passwords.</para>
1070 <indexterm zone="heimdal libotp">
1071 <primary sortas="c-libotp">libotp.[so,a]</primary>
1072 </indexterm>
1073 </listitem>
1074 </varlistentry>
1075
1076 <varlistentry id="libroken">
1077 <term><filename class='libraryfile'>libroken.[so,a]</filename></term>
1078 <listitem>
1079 <para>is a library containing Kerberos 5 compatibility
1080 functions.</para>
1081 <indexterm zone="heimdal libroken">
1082 <primary sortas="c-libroken">libroken.[so,a]</primary>
1083 </indexterm>
1084 </listitem>
1085 </varlistentry>
1086
1087 </variablelist>
1088
1089 </sect2>
1090
1091</sect1>
Note: See TracBrowser for help on using the repository browser.