source: postlfs/security/heimdal.xml@ 3f87e4a

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.2 6.2.0 6.2.0-rc1 6.2.0-rc2 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 3f87e4a was 3f87e4a, checked in by Randy McMurchy <randy@…>, 18 years ago

Removed the Berkeley DB dependency from packages utilizing it as BDB is now built in LFS

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@5536 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 41.5 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.4//EN"
3 "http://www.oasis-open.org/docbook/xml/4.4/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "70504c824cb0437e6fae2b866f9d2ed4">
10 <!ENTITY heimdal-size "4.5 MB">
11 <!ENTITY heimdal-buildsize "96.9 MB">
12 <!ENTITY heimdal-time "2.7 SBU">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 <keywordset>
22 <keyword role="package">heimdal-&heimdal-version;.tar</keyword>
23 <keyword role="ftpdir">heimdal</keyword>
24 </keywordset>
25 </sect1info>
26
27 <title>Heimdal-&heimdal-version;</title>
28
29 <indexterm zone="heimdal">
30 <primary sortas="a-Heimdal">Heimdal</primary>
31 </indexterm>
32
33 <sect2 role="package">
34 <title>Introduction to Heimdal</title>
35
36 <para><application>Heimdal</application> is a free implementation
37 of Kerberos 5 that aims to be compatible with MIT krb5 and is
38 backward compatible with krb4. Kerberos is a network authentication
39 protocol. Basically it preserves the integrity of passwords in any
40 untrusted network (like the Internet). Kerberized applications work
41 hand-in-hand with sites that support Kerberos to ensure that passwords
42 cannot be stolen or compromised. A Kerberos installation will make changes
43 to the authentication mechanisms on your network and will overwrite several
44 programs and daemons from the <application>Coreutils</application>,
45 <application>Inetutils</application>, <application>Qpopper</application>
46 and <application>Shadow</application> packages.</para>
47
48 <bridgehead renderas="sect3">Package Information</bridgehead>
49 <itemizedlist spacing="compact">
50 <listitem>
51 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
52 </listitem>
53 <listitem>
54 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
55 </listitem>
56 <listitem>
57 <para>Download MD5 sum: &heimdal-md5sum;</para>
58 </listitem>
59 <listitem>
60 <para>Download size: &heimdal-size;</para>
61 </listitem>
62 <listitem>
63 <para>Estimated disk space required: &heimdal-buildsize;</para>
64 </listitem>
65 <listitem>
66 <para>Estimated build time: &heimdal-time;</para>
67 </listitem>
68 </itemizedlist>
69
70 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
71 <itemizedlist spacing='compact'>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem>
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required">
86 <!-- <xref linkend="db"/> -->
87 <xref linkend="db"/> is recommended (installed in LFS)
88 or <xref linkend="gdbm"/></para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended"><xref linkend="openssl"/></para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional"><xref linkend="linux-pam"/>,
95 <xref linkend="openldap"/>,
96 X (<xref linkend="xorg"/> or <xref linkend="xfree86"/>),
97 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename>
98 patch), and
99 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
100
101 <note>
102 <para>Some sort of time synchronization facility on your system
103 (like <xref linkend="ntp"/>) is required since Kerberos won't
104 authenticate if the time differential between a kerberized client
105 and the KDC server is more than 5 minutes.</para>
106 </note>
107
108 </sect2>
109
110 <sect2 role="installation">
111 <title>Installation of Heimdal</title>
112
113 <!-- This doesn't appear to be needed any longer as testing has
114 shown that the ftp client now works without issues
115
116 <para>Before installing the package, you may want to preserve the
117 <command>ftp</command> program from the <application>Inetutils</application>
118 package. This is because using the <application>Heimdal</application>
119 <command>ftp</command> program to connect to non-kerberized ftp servers may
120 not work properly. It will allow you to connect (letting you know that
121 transmission of the password is clear text) but will have problems doing
122 puts and gets. Issue the following command as the
123 <systemitem class="username">root</systemitem> user.</para>
124
125<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
126
127 -->
128
129 <warning>
130 <para>Ensure you really need a Kerberos installation before you decide
131 to install this package. Failure to install and configure the package
132 in accordance with the instructions below can render your system
133 unusable.</para>
134 </warning>
135
136 <para>If you wish the <application>Heimdal</application> package to
137 link against the <application>CrackLib</application> library to provide
138 enforcement of strong passwords (requires <xref linkend="cracklib"/>
139 installed with the <filename>heimdal</filename> patch), you must apply a
140 patch:</para>
141
142<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
143
144 <para>Install <application>Heimdal</application> by running the following
145 commands:</para>
146
147<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-fhs_compliance-1.patch &amp;&amp;
148./configure --prefix=/usr \
149 --sysconfdir=/etc/heimdal \
150 --libexecdir=/usr/sbin \
151 --datadir=/var/lib/heimdal \
152 --localstatedir=/var/lib/heimdal \
153 --enable-shared \
154 --with-readline=/usr &amp;&amp;
155make</userinput></screen>
156
157 <para>If you wish to create HTML documentation, issue the following
158 command:</para>
159
160<screen><userinput>make -C doc heimdal.html</userinput></screen>
161
162 <para>If you wish to create a text-based version of the documentation,
163 issue the following commands:</para>
164
165<screen><userinput>cd doc &amp;&amp;
166makeinfo --plaintext -o heimdal.txt heimdal.texi &amp;&amp;
167cd ..</userinput></screen>
168
169 <para>To test the results, issue: <command>make check</command>.</para>
170
171 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
172
173<screen role="root"><userinput>mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.glibc &amp;&amp;
174mv -v /usr/include/glob.h /usr/include/glob.h.glibc &amp;&amp;
175mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
176mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
177mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
178make install &amp;&amp;
179mv -v /usr/include/fnmatch.h /usr/include/fnmatch.h.heimdal &amp;&amp;
180mv -v /usr/include/fnmatch.h.glibc /usr/include/fnmatch.h &amp;&amp;
181mv -v /usr/include/glob.h /usr/include/glob.h.heimdal &amp;&amp;
182mv -v /usr/include/glob.h.glibc /usr/include/glob.h &amp;&amp;
183install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
184install -v -m644 doc/{init-creds,layman.asc} \
185 /usr/share/doc/heimdal-&heimdal-version; &amp;&amp;
186install -v -m644 doc/standardisation/* \
187 /usr/share/doc/heimdal-&heimdal-version;/standardisation &amp;&amp;
188mv -v /bin/login /bin/login.shadow &amp;&amp;
189mv -v /bin/su /bin/su.shadow &amp;&amp;
190mv -v /usr/bin/{login,su} /bin &amp;&amp;
191ln -v -sf ../../bin/login /usr/bin &amp;&amp;
192mv -v /usr/lib/lib{otp,kafs,krb5,asn1,roken,crypto}.so.* \
193 /usr/lib/libdb-4.4.so /lib &amp;&amp;
194ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb.so &amp;&amp;
195ln -v -sf ../../lib/libdb-4.4.so /usr/lib/libdb-4.so &amp;&amp;
196for SYMLINK in otp.so.0.1.3 kafs.so.0.4.1 krb5.so.17.4.0 \
197 asn1.so.6.1.0 roken.so.16.1.0 crypto.so.0.9.7
198do
199 ln -v -sf ../../lib/lib$SYMLINK \
200 /usr/lib/lib`echo $SYMLINK | cut -d. -f1`.so
201done
202ldconfig</userinput></screen>
203
204 <para>If you built the HTML or text-based documentation, install it using
205 the following commands as the
206 <systemitem class="username">root</systemitem> user:</para>
207
208<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
209install -v -m644 doc/heimdal.html/* \
210 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
211install -v -m644 doc/heimdal.txt /usr/share/doc/heimdal-&heimdal-version;</userinput></screen>
212
213 </sect2>
214
215 <sect2 role="commands">
216 <title>Command Explanations</title>
217
218 <para><command>mv -v /usr/include/...</command> and
219 <command>mv -v /usr/lib/libss.*</command>: The
220 <application>Heimdal</application> installation will overwrite two
221 interface headers from the <application>Glibc</application> package and an
222 interface header, static library and library symbolic link from the
223 <application>E2fsprogs</application> package. These commands move the
224 original files out of the way before the installation, and then restore
225 the original <application>Glibc</application> headers after the
226 installation. The two <application>Heimdal</application> headers are renamed
227 and preserved on the system. Testing has shown that the system is stable
228 using the <application>Heimdal</application> version of the
229 <filename>libss</filename> library and interface header.</para>
230
231 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch
232 puts the daemon programs into
233 <filename class="directory">/usr/sbin</filename>.</para>
234
235 <tip>
236 <para>If you want to preserve all your existing
237 <application>Inetutils</application> package daemons, install the
238 <application>Heimdal</application> daemons into
239 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
240 you want). Since these programs will be called from
241 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
242 really doesn't matter where they are installed, as long as they are
243 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
244 and <filename>rc</filename> scripts. If you choose something other than
245 <filename class="directory">/usr/sbin</filename>, you may want to move
246 some of the user programs (such as <command>kadmin</command>) to
247 <filename class="directory">/usr/sbin</filename> manually so they'll be
248 in the privileged user's default <envar>PATH</envar>.</para>
249 </tip>
250
251 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
252 The <command>login</command> and <command>su</command> programs installed by
253 <application>Heimdal</application> belong in the
254 <filename class="directory">/bin</filename> directory. The
255 <command>login</command> program is symlinked because
256 <application>Heimdal</application> is expecting to find it in
257 <filename class="directory">/usr/bin</filename>. The old executables are
258 preserved before the move so that they can be restored if you experience
259 problems logging into the system after the
260 <application>Heimdal</application> package is installed and
261 configured.</para>
262
263 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
264 The <command>login</command> and <command>su</command> programs installed
265 by <application>Heimdal</application> link against
266 <application>Heimdal</application> libraries as well as libraries provided
267 by the <application>OpenSSL</application> and
268 <application>Berkeley DB</application> packages. These
269 libraries are moved to <filename class="directory">/lib</filename> to be
270 FHS compliant and also in case
271 <filename class="directory">/usr</filename> is located on a separate
272 partition which may not always be mounted.</para>
273
274 </sect2>
275
276 <sect2 role="configuration">
277 <title>Configuring Heimdal</title>
278
279 <sect3 id="heimdal-config">
280 <title>Config Files</title>
281
282 <para><filename>/etc/heimdal/*</filename></para>
283
284 <indexterm zone="heimdal heimdal-config">
285 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
286 </indexterm>
287
288 </sect3>
289
290 <sect3>
291 <title>Configuration Information</title>
292
293 <note>
294 <para>All the configuration steps shown below must be accomplished
295 by the <systemitem class='username'>root</systemitem> user unless
296 otherwise noted.</para>
297 </note>
298
299 <sect4>
300 <title>Master KDC Server Configuration</title>
301
302 <para>Create the Kerberos configuration file with the
303 following commands:</para>
304
305<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
306cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
307<literal># Begin /etc/heimdal/krb5.conf
308
309[libdefaults]
310 default_realm = <replaceable>[EXAMPLE.COM]</replaceable>
311 encrypt = true
312
313[realms]
314 <replaceable>[EXAMPLE.COM]</replaceable> = {
315 kdc = <replaceable>[hostname.example.com]</replaceable>
316 admin_server = <replaceable>[hostname.example.com]</replaceable>
317 kpasswd_server = <replaceable>[hostname.example.com]</replaceable>
318 }
319
320[domain_realm]
321 .<replaceable>[example.com]</replaceable> = <replaceable>[EXAMPLE.COM]</replaceable>
322
323[logging]
324 kdc = FILE:/var/log/kdc.log
325 admin_server = FILE:/var/log/kadmin.log
326 default = FILE:/var/log/krb.log
327
328# End /etc/heimdal/krb5.conf</literal>
329EOF
330chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
331
332 <para>You will need to substitute your domain and proper hostname
333 for the occurrences of the <replaceable>[hostname]</replaceable>
334 and <replaceable>[EXAMPLE.COM]</replaceable> names.</para>
335
336 <para><option>default_realm</option> should be the name of your
337 domain changed to ALL CAPS. This isn't required, but both
338 <application>Heimdal</application> and <application>MIT
339 krb5</application> recommend it.</para>
340
341 <para><option>encrypt = true</option> provides encryption of all
342 traffic between kerberized clients and servers. It's not necessary
343 and can be left off. If you leave it off, you can encrypt all traffic
344 from the client to the server using a switch on the client program
345 instead.</para>
346
347 <para>The <option>[realms]</option> parameters tell the client
348 programs where to look for the KDC authentication services.</para>
349
350 <para>The <option>[domain_realm]</option> section maps a domain
351 to a realm.</para>
352
353 <para>Store the master password in a key file using the following
354 commands:</para>
355
356<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
357kstash</userinput></screen>
358
359 <para>Create the KDC database:</para>
360
361<screen role="root"><userinput>kadmin -l</userinput></screen>
362
363 <para>The commands below will prompt you for information about the
364 principles. Choose the defaults for now unless you know what you are
365 doing and need to specify different values. You can go in later and
366 change the defaults, should you feel the need. You may use the up and
367 down arrow keys to use the history feature of <command>kadmin</command>
368 in a similar manner as the <command>bash</command> history
369 feature.</para>
370
371 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
372 statement:</para>
373
374<screen role="root"><userinput>init <replaceable>[EXAMPLE.COM]</replaceable></userinput></screen>
375
376 <para>The database must now be populated with at least one principle
377 (user). For now, just use your regular login name or root. You may
378 create as few, or as many principles as you wish using the following
379 statement:</para>
380
381<screen role="root"><userinput>add <replaceable>[loginname]</replaceable></userinput></screen>
382
383 <para>The KDC server and any machine running kerberized
384 server daemons must have a host key installed:</para>
385
386<screen role="root"><userinput>add --random-key host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
387
388 <para>After choosing the defaults when prompted, you will have to
389 export the data to a keytab file:</para>
390
391<screen role="root"><userinput>ext host/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
392
393 <para>This should have created two files in
394 <filename class="directory">/etc/heimdal</filename>:
395 <filename>krb5.keytab</filename> (Kerberos 5) and
396 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
397 (root rw only) permissions. Keeping the keytab files from public access
398 is crucial to the overall security of the Kerberos installation.</para>
399
400 <para>Eventually, you'll want to add server daemon principles to the
401 database and extract them to the keytab file. You do this in the same
402 way you created the host principles. Below is an example:</para>
403
404<screen role="root"><userinput>add --random-key ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
405
406 <para>(choose the defaults)</para>
407
408<screen role="root"><userinput>ext ftp/<replaceable>[hostname.example.com]</replaceable></userinput></screen>
409
410 <para>Exit the <command>kadmin</command> program (use
411 <command>quit</command> or <command>exit</command>) and return back
412 to the shell prompt. Start the KDC daemon manually, just to test out
413 the installation:</para>
414
415<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
416
417 <para>Attempt to get a TGT (ticket granting ticket) with
418 the following command:</para>
419
420<screen><userinput>kinit <replaceable>[loginname]</replaceable></userinput></screen>
421
422 <para>You will be prompted for the password you created. After you get
423 your ticket, you should list it with the following command:</para>
424
425<screen><userinput>klist</userinput></screen>
426
427 <para>Information about the ticket should be displayed on
428 the screen.</para>
429
430 <para>To test the functionality of the <filename>keytab</filename> file,
431 issue the following command:</para>
432
433<screen><userinput>ktutil list</userinput></screen>
434
435 <para>This should dump a list of the host principals, along with the
436 encryption methods used to access the principals.</para>
437
438 <para>At this point, if everything has been successful so far, you
439 can feel fairly confident in the installation, setup and configuration
440 of your new <application>Heimdal</application> Kerberos 5
441 installation.</para>
442
443 <para id="heimdal-init">Install the
444 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
445 in the <xref linkend="bootscripts"/> package:</para>
446
447 <indexterm zone="heimdal heimdal-init">
448 <primary sortas="f-heimdal">heimdal</primary>
449 </indexterm>
450
451<screen role="root"><userinput>make install-heimdal</userinput></screen>
452
453 </sect4>
454
455 <sect4>
456 <title>Using Kerberized Client Programs</title>
457
458 <para>To use the kerberized client programs (<command>telnet</command>,
459 <command>ftp</command>, <command>rsh</command>,
460 <command>rxterm</command>, <command>rxtelnet</command>,
461 <command>rcp</command>, <command>xnlock</command>), you first must get
462 a TGT. Use the <command>kinit</command> program to get the ticket.
463 After you've acquired the ticket, you can use the kerberized programs
464 to connect to any kerberized server on the network. You will not be
465 prompted for authentication until your ticket expires (default is one
466 day), unless you specify a different user as a command line argument
467 to the program.</para>
468
469 <para>The kerberized programs will connect to non-kerberized daemons,
470 warning you that authentication is not encrypted.</para>
471
472 <para>In order to use the <application>Heimdal</application>
473 <application>X</application> programs, you'll need to add a service
474 port entry to the <filename>/etc/services</filename> file for the
475 <command>kxd</command> server. There is no 'standardized port number'
476 for the 'kx' service in the IANA database, so you'll have to pick an
477 unused port number. Add an entry to the <filename>services</filename>
478 file similar to the entry below (substitute your chosen port number
479 for <replaceable>[49150]</replaceable>):</para>
480
481<screen><literal>kx <replaceable>[49150]</replaceable>/tcp # Heimdal kerberos X
482kx <replaceable>[49150]</replaceable>/udp # Heimdal kerberos X</literal></screen>
483
484 <para>For additional information consult <ulink
485 url="&hints-root;/downloads/files/heimdal.txt">the
486 Heimdal hint</ulink> on which the above instructions are based.</para>
487
488 </sect4>
489
490 </sect3>
491
492 </sect2>
493
494 <sect2 role="content">
495 <title>Contents</title>
496
497 <segmentedlist>
498 <segtitle>Installed Programs</segtitle>
499 <segtitle>Installed Libraries</segtitle>
500 <segtitle>Installed Directories</segtitle>
501
502 <seglistitem>
503 <seg>afslog, dump_log, ftp, ftpd, hprop, hpropd, ipropd-master,
504 ipropd-slave, kadmin, kadmind, kauth, kcm, kdc, kdestroy, kf, kfd,
505 kgetcred, kinit, klist, kpasswd, kpasswdd, krb5-config, kstash,
506 ktutil, kx, kxd, login, mk_cmds, otp, otpprint, pagsh, pfrom, popper,
507 push, rcp, replay_log, rsh, rshd, rxtelnet, rxterm, string2key, su,
508 telnet, telnetd, tenletxr, truncate-log, verify_krb5_conf
509 and xnlock</seg>
510 <seg>libasn1.[so,a], libeditline.[so,a], libgssapi.[so,a],
511 libhdb.[so,a], libkadm5clnt.[so,a], libkadm5srv.[so,a], libkafs.[so,a],
512 libkrb5.[so,a], libotp.[so,a], libroken.[so,a], libsl.[so,a]
513 and libss.[so,a]</seg>
514 <seg>/etc/heimdal, /usr/include/kadm5,
515 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
516 </seglistitem>
517 </segmentedlist>
518
519 <variablelist>
520 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
521 <?dbfo list-presentation="list"?>
522 <?dbhtml list-presentation="table"?>
523
524 <varlistentry id="afslog">
525 <term><command>afslog</command></term>
526 <listitem>
527 <para>obtains AFS tokens for a number of cells.</para>
528 <indexterm zone="heimdal afslog">
529 <primary sortas="b-afslog">afslog</primary>
530 </indexterm>
531 </listitem>
532 </varlistentry>
533
534 <varlistentry id="ftp">
535 <term><command>ftp</command></term>
536 <listitem>
537 <para>is a kerberized FTP client.</para>
538 <indexterm zone="heimdal ftp">
539 <primary sortas="b-ftp">ftp</primary>
540 </indexterm>
541 </listitem>
542 </varlistentry>
543
544 <varlistentry id="ftpd">
545 <term><command>ftpd</command></term>
546 <listitem>
547 <para>is a kerberized FTP daemon.</para>
548 <indexterm zone="heimdal ftpd">
549 <primary sortas="b-ftpd">ftpd</primary>
550 </indexterm>
551 </listitem>
552 </varlistentry>
553
554 <varlistentry id="hprop">
555 <term><command>hprop</command></term>
556 <listitem>
557 <para> takes a principal database in a specified format and converts
558 it into a stream of <application>Heimdal</application> database
559 records.</para>
560 <indexterm zone="heimdal hprop">
561 <primary sortas="b-hprop">hprop</primary>
562 </indexterm>
563 </listitem>
564 </varlistentry>
565
566 <varlistentry id="hpropd">
567 <term><command>hpropd</command></term>
568 <listitem>
569 <para>is a server that receives a database sent by
570 <command>hprop</command> and writes it as a local database.</para>
571 <indexterm zone="heimdal hpropd">
572 <primary sortas="b-hpropd">hpropd</primary>
573 </indexterm>
574 </listitem>
575 </varlistentry>
576
577 <varlistentry id="ipropd-master">
578 <term><command>ipropd-master</command></term>
579 <listitem>
580 <para>is a daemon which runs on the master KDC
581 server which incrementally propagates changes to the KDC
582 database to the slave KDC servers.</para>
583 <indexterm zone="heimdal ipropd-master">
584 <primary sortas="b-ipropd-master">ipropd-master</primary>
585 </indexterm>
586 </listitem>
587 </varlistentry>
588
589 <varlistentry id="ipropd-slave">
590 <term><command>ipropd-slave</command></term>
591 <listitem>
592 <para>is a daemon which runs on the slave KDC
593 servers which incrementally propagates changes to the KDC
594 database from the master KDC server.</para>
595 <indexterm zone="heimdal ipropd-slave">
596 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
597 </indexterm>
598 </listitem>
599 </varlistentry>
600
601 <varlistentry id="kadmin">
602 <term><command>kadmin</command></term>
603 <listitem>
604 <para>is a utility used to make modifications to the Kerberos
605 database.</para>
606 <indexterm zone="heimdal kadmin">
607 <primary sortas="b-kadmin">kadmin</primary>
608 </indexterm>
609 </listitem>
610 </varlistentry>
611
612 <varlistentry id="kadmind">
613 <term><command>kadmind</command></term>
614 <listitem>
615 <para>is a server for administrative access to the Kerberos
616 database.</para>
617 <indexterm zone="heimdal kadmind">
618 <primary sortas="b-kadmind">kadmind</primary>
619 </indexterm>
620 </listitem>
621 </varlistentry>
622
623 <varlistentry id="kauth">
624 <term><command>kauth</command></term>
625 <listitem>
626 <para>is a symbolic link to the <command>kinit</command>
627 program.</para>
628 <indexterm zone="heimdal kauth">
629 <primary sortas="g-kauth">kauth</primary>
630 </indexterm>
631 </listitem>
632 </varlistentry>
633
634 <varlistentry id="kcm">
635 <term><command>kcm</command></term>
636 <listitem>
637 <para>is a process based credential cache for Kerberos
638 tickets.</para>
639 <indexterm zone="heimdal kcm">
640 <primary sortas="b-kcm">kcm</primary>
641 </indexterm>
642 </listitem>
643 </varlistentry>
644
645 <varlistentry id="kdc">
646 <term><command>kdc</command></term>
647 <listitem>
648 <para>is a Kerberos 5 server.</para>
649 <indexterm zone="heimdal kdc">
650 <primary sortas="b-kdc">kdc</primary>
651 </indexterm>
652 </listitem>
653 </varlistentry>
654
655 <varlistentry id="kdestroy">
656 <term><command>kdestroy</command></term>
657 <listitem>
658 <para>removes a principle's current set of tickets.</para>
659 <indexterm zone="heimdal kdestroy">
660 <primary sortas="b-kdestroy">kdestroy</primary>
661 </indexterm>
662 </listitem>
663 </varlistentry>
664
665 <varlistentry id="kf">
666 <term><command>kf</command></term>
667 <listitem>
668 <para>is a program which forwards tickets to a remote host through
669 an authenticated and encrypted stream.</para>
670 <indexterm zone="heimdal kf">
671 <primary sortas="b-kf">kf</primary>
672 </indexterm>
673 </listitem>
674 </varlistentry>
675
676 <varlistentry id="kfd">
677 <term><command>kfd</command></term>
678 <listitem>
679 <para>is a server used to receive forwarded tickets.</para>
680 <indexterm zone="heimdal kfd">
681 <primary sortas="b-kfd">kfd</primary>
682 </indexterm>
683 </listitem>
684 </varlistentry>
685
686 <varlistentry id="kgetcred">
687 <term><command>kgetcred</command></term>
688 <listitem>
689 <para>obtains a ticket for a service.</para>
690 <indexterm zone="heimdal kgetcred">
691 <primary sortas="b-kgetcred">kgetcred</primary>
692 </indexterm>
693 </listitem>
694 </varlistentry>
695
696 <varlistentry id="kinit">
697 <term><command>kinit</command></term>
698 <listitem>
699 <para>is used to authenticate to the Kerberos server as a principal
700 and acquire a ticket granting ticket that can later be used to obtain
701 tickets for other services.</para>
702 <indexterm zone="heimdal kinit">
703 <primary sortas="b-kinit">kinit</primary>
704 </indexterm>
705 </listitem>
706 </varlistentry>
707
708 <varlistentry id="klist">
709 <term><command>klist</command></term>
710 <listitem>
711 <para>reads and displays the current tickets in the credential
712 cache.</para>
713 <indexterm zone="heimdal klist">
714 <primary sortas="b-klist">klist</primary>
715 </indexterm>
716 </listitem>
717 </varlistentry>
718
719 <varlistentry id="kpasswd">
720 <term><command>kpasswd</command></term>
721 <listitem>
722 <para>is a program for changing Kerberos 5 passwords.</para>
723 <indexterm zone="heimdal kpasswd">
724 <primary sortas="b-kpasswd">kpasswd</primary>
725 </indexterm>
726 </listitem>
727 </varlistentry>
728
729 <varlistentry id="kpasswdd">
730 <term><command>kpasswdd</command></term>
731 <listitem>
732 <para>is a Kerberos 5 password changing server.</para>
733 <indexterm zone="heimdal kpasswdd">
734 <primary sortas="b-kpasswdd">kpasswdd</primary>
735 </indexterm>
736 </listitem>
737 </varlistentry>
738
739 <varlistentry id="krb5-config-prog">
740 <term><command>krb5-config</command></term>
741 <listitem>
742 <para>gives information on how to link programs against
743 <application>Heimdal</application> libraries.</para>
744 <indexterm zone="heimdal krb5-config-prog">
745 <primary sortas="b-krb5-config">krb5-config</primary>
746 </indexterm>
747 </listitem>
748 </varlistentry>
749
750 <varlistentry id="kstash">
751 <term><command>kstash</command></term>
752 <listitem>
753 <para>stores the KDC master password in a file.</para>
754 <indexterm zone="heimdal kstash">
755 <primary sortas="b-kstash">kstash</primary>
756 </indexterm>
757 </listitem>
758 </varlistentry>
759
760 <varlistentry id="ktutil">
761 <term><command>ktutil</command></term>
762 <listitem>
763 <para>is a program for managing Kerberos keytabs.</para>
764 <indexterm zone="heimdal ktutil">
765 <primary sortas="b-ktutil">ktutil</primary>
766 </indexterm>
767 </listitem>
768 </varlistentry>
769
770 <varlistentry id="kx">
771 <term><command>kx</command></term>
772 <listitem>
773 <para>is a program which securely forwards
774 <application>X</application> connections.</para>
775 <indexterm zone="heimdal kx">
776 <primary sortas="b-kx">kx</primary>
777 </indexterm>
778 </listitem>
779 </varlistentry>
780
781 <varlistentry id="kxd">
782 <term><command>kxd</command></term>
783 <listitem>
784 <para>is the daemon for <command>kx</command>.</para>
785 <indexterm zone="heimdal kxd">
786 <primary sortas="b-kxd">kxd</primary>
787 </indexterm>
788 </listitem>
789 </varlistentry>
790
791 <varlistentry id="login">
792 <term><command>login</command></term>
793 <listitem>
794 <para>is a kerberized login program.</para>
795 <indexterm zone="heimdal login">
796 <primary sortas="b-login">login</primary>
797 </indexterm>
798 </listitem>
799 </varlistentry>
800
801 <varlistentry id="otp">
802 <term><command>otp</command></term>
803 <listitem>
804 <para>manages one-time passwords.</para>
805 <indexterm zone="heimdal otp">
806 <primary sortas="b-otp">otp</primary>
807 </indexterm>
808 </listitem>
809 </varlistentry>
810
811 <varlistentry id="otpprint">
812 <term><command>otpprint</command></term>
813 <listitem>
814 <para>prints lists of one-time passwords.</para>
815 <indexterm zone="heimdal otpprint">
816 <primary sortas="b-otpprint">otpprint</primary>
817 </indexterm>
818 </listitem>
819 </varlistentry>
820
821 <varlistentry id="pfrom">
822 <term><command>pfrom</command></term>
823 <listitem>
824 <para>is a script that runs <command>push --from</command>.</para>
825 <indexterm zone="heimdal pfrom">
826 <primary sortas="b-pfrom">pfrom</primary>
827 </indexterm>
828 </listitem>
829 </varlistentry>
830
831 <varlistentry id="popper">
832 <term><command>popper</command></term>
833 <listitem>
834 <para>is a kerberized POP-3 server.</para>
835 <indexterm zone="heimdal popper">
836 <primary sortas="b-popper">popper</primary>
837 </indexterm>
838 </listitem>
839 </varlistentry>
840
841 <varlistentry id="push">
842 <term><command>push</command></term>
843 <listitem>
844 <para>is a kerberized POP mail retrieval client.</para>
845 <indexterm zone="heimdal push">
846 <primary sortas="b-push">push</primary>
847 </indexterm>
848 </listitem>
849 </varlistentry>
850
851 <varlistentry id="rcp">
852 <term><command>rcp</command></term>
853 <listitem>
854 <para>is a kerberized rcp client program.</para>
855 <indexterm zone="heimdal rcp">
856 <primary sortas="b-rcp">rcp</primary>
857 </indexterm>
858 </listitem>
859 </varlistentry>
860
861 <varlistentry id="rsh">
862 <term><command>rsh</command></term>
863 <listitem>
864 <para>is a kerberized rsh client program.</para>
865 <indexterm zone="heimdal rsh">
866 <primary sortas="b-rsh">rsh</primary>
867 </indexterm>
868 </listitem>
869 </varlistentry>
870
871 <varlistentry id="rshd">
872 <term><command>rshd</command></term>
873 <listitem>
874 <para>is a kerberized rsh server.</para>
875 <indexterm zone="heimdal rshd">
876 <primary sortas="b-rshd">rshd</primary>
877 </indexterm>
878 </listitem>
879 </varlistentry>
880
881 <varlistentry id="rxtelnet">
882 <term><command>rxtelnet</command></term>
883 <listitem>
884 <para>starts a secure <command>xterm</command> window with a
885 <command>telnet</command> to a given host and forwards
886 <application>X</application> connections.</para>
887 <indexterm zone="heimdal rxtelnet">
888 <primary sortas="b-rxtelnet">rxtelnet</primary>
889 </indexterm>
890 </listitem>
891 </varlistentry>
892
893 <varlistentry id="rxterm">
894 <term><command>rxterm</command></term>
895 <listitem>
896 <para>starts a secure remote <command>xterm</command>.</para>
897 <indexterm zone="heimdal rxterm">
898 <primary sortas="b-rxterm">rxterm</primary>
899 </indexterm>
900 </listitem>
901 </varlistentry>
902
903 <varlistentry id="string2key">
904 <term><command>string2key</command></term>
905 <listitem>
906 <para>maps a password into a key.</para>
907 <indexterm zone="heimdal string2key">
908 <primary sortas="b-string2key">string2key</primary>
909 </indexterm>
910 </listitem>
911 </varlistentry>
912
913 <varlistentry id="su">
914 <term><command>su</command></term>
915 <listitem>
916 <para>is a kerberized su client program.</para>
917 <indexterm zone="heimdal su">
918 <primary sortas="b-su">su</primary>
919 </indexterm>
920 </listitem>
921 </varlistentry>
922
923 <varlistentry id="telnet">
924 <term><command>telnet</command></term>
925 <listitem>
926 <para>is a kerberized telnet client program.</para>
927 <indexterm zone="heimdal telnet">
928 <primary sortas="b-telnet">telnet</primary>
929 </indexterm>
930 </listitem>
931 </varlistentry>
932
933 <varlistentry id="telnetd">
934 <term><command>telnetd</command></term>
935 <listitem>
936 <para>is a kerberized telnet server.</para>
937 <indexterm zone="heimdal telnetd">
938 <primary sortas="b-telnetd">telnetd</primary>
939 </indexterm>
940 </listitem>
941 </varlistentry>
942
943 <varlistentry id="tenletxr">
944 <term><command>tenletxr</command></term>
945 <listitem>
946 <para>forwards <application>X</application> connections
947 backwards.</para>
948 <indexterm zone="heimdal tenletxr">
949 <primary sortas="b-tenletxr">tenletxr</primary>
950 </indexterm>
951 </listitem>
952 </varlistentry>
953
954 <varlistentry id="verify_krb5_conf">
955 <term><command>verify_krb5_conf</command></term>
956 <listitem>
957 <para>checks <filename>krb5.conf</filename> file for obvious
958 errors.</para>
959 <indexterm zone="heimdal verify_krb5_conf">
960 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
961 </indexterm>
962 </listitem>
963 </varlistentry>
964
965 <varlistentry id="xnlock">
966 <term><command>xnlock</command></term>
967 <listitem>
968 <para>is a program that acts as a secure screen saver for
969 workstations running <application>X</application>.</para>
970 <indexterm zone="heimdal xnlock">
971 <primary sortas="b-xnlock">xnlock</primary>
972 </indexterm>
973 </listitem>
974 </varlistentry>
975
976 <varlistentry id="libasn1">
977 <term><filename class='libraryfile'>libasn1.[so,a]</filename></term>
978 <listitem>
979 <para>provides the ASN.1 and DER functions to encode and decode
980 the Kerberos TGTs.</para>
981 <indexterm zone="heimdal libasn1">
982 <primary sortas="c-libasn1">libasn1.[so,a]</primary>
983 </indexterm>
984 </listitem>
985 </varlistentry>
986
987 <varlistentry id="libeditline">
988 <term><filename class='libraryfile'>libeditline.a</filename></term>
989 <listitem>
990 <para>is a command-line editing library with history.</para>
991 <indexterm zone="heimdal libeditline">
992 <primary sortas="c-libeditline">libeditline.a</primary>
993 </indexterm>
994 </listitem>
995 </varlistentry>
996
997 <varlistentry id="libgssapi">
998 <term><filename class='libraryfile'>libgssapi.[so,a]</filename></term>
999 <listitem>
1000 <para>contain the Generic Security Service Application Programming
1001 Interface (GSSAPI) functions which provides security
1002 services to callers in a generic fashion, supportable with a range of
1003 underlying mechanisms and technologies and hence allowing source-level
1004 portability of applications to different environments.</para>
1005 <indexterm zone="heimdal libgssapi">
1006 <primary sortas="c-libgssapi">libgssapi.[so,a]</primary>
1007 </indexterm>
1008 </listitem>
1009 </varlistentry>
1010
1011 <varlistentry id="libhdb">
1012 <term><filename class='libraryfile'>libhdb.[so,a]</filename></term>
1013 <listitem>
1014 <para>is a <application>Heimdal</application> Kerberos 5
1015 authentication/authorization database access library.</para>
1016 <indexterm zone="heimdal libhdb">
1017 <primary sortas="c-libhdb">libhdb.[so,a]</primary>
1018 </indexterm>
1019 </listitem>
1020 </varlistentry>
1021
1022 <varlistentry id="libkadm5clnt">
1023 <term><filename class='libraryfile'>libkadm5clnt.[so,a]</filename></term>
1024 <listitem>
1025 <para>contains the administrative authentication and password
1026 checking functions required by Kerberos 5 client-side programs.</para>
1027 <indexterm zone="heimdal libkadm5clnt">
1028 <primary sortas="c-libkadm5clnt">libkadm5clnt.[so,a]</primary>
1029 </indexterm>
1030 </listitem>
1031 </varlistentry>
1032
1033 <varlistentry id="libkadm5srv">
1034 <term><filename class='libraryfile'>libkadm5srv.[so,a]</filename></term>
1035 <listitem>
1036 <para>contain the administrative authentication and password
1037 checking functions required by Kerberos 5 servers.</para>
1038 <indexterm zone="heimdal libkadm5srv">
1039 <primary sortas="c-libkadm5srv">libkadm5srv.[so,a]</primary>
1040 </indexterm>
1041 </listitem>
1042 </varlistentry>
1043
1044 <varlistentry id="libkafs">
1045 <term><filename class='libraryfile'>libkafs.[so,a]</filename></term>
1046 <listitem>
1047 <para>contains the functions required to authenticated to AFS.</para>
1048 <indexterm zone="heimdal libkafs">
1049 <primary sortas="c-libkafs">libkafs.[so,a]</primary>
1050 </indexterm>
1051 </listitem>
1052 </varlistentry>
1053
1054 <varlistentry id="libkrb5">
1055 <term><filename class='libraryfile'>libkrb5.[so,a]</filename></term>
1056 <listitem>
1057 <para>is an all-purpose Kerberos 5 library.</para>
1058 <indexterm zone="heimdal libkrb5">
1059 <primary sortas="c-libkrb5">libkrb5.[so,a]</primary>
1060 </indexterm>
1061 </listitem>
1062 </varlistentry>
1063
1064 <varlistentry id="libotp">
1065 <term><filename class='libraryfile'>libotp.[so,a]</filename></term>
1066 <listitem>
1067 <para>contains the functions required to handle authenticating
1068 one time passwords.</para>
1069 <indexterm zone="heimdal libotp">
1070 <primary sortas="c-libotp">libotp.[so,a]</primary>
1071 </indexterm>
1072 </listitem>
1073 </varlistentry>
1074
1075 <varlistentry id="libroken">
1076 <term><filename class='libraryfile'>libroken.[so,a]</filename></term>
1077 <listitem>
1078 <para>is a library containing Kerberos 5 compatibility
1079 functions.</para>
1080 <indexterm zone="heimdal libroken">
1081 <primary sortas="c-libroken">libroken.[so,a]</primary>
1082 </indexterm>
1083 </listitem>
1084 </varlistentry>
1085
1086 </variablelist>
1087
1088 </sect2>
1089
1090</sect1>
Note: See TracBrowser for help on using the repository browser.