source: postlfs/security/heimdal.xml@ 60db080

10.0 10.1 11.0 11.1 11.2 11.3 12.0 12.1 6.3 6.3-rc1 6.3-rc2 6.3-rc3 7.10 7.4 7.5 7.6 7.6-blfs 7.6-systemd 7.7 7.8 7.9 8.0 8.1 8.2 8.3 8.4 9.0 9.1 basic bdubbs/svn elogind gnome kde5-13430 kde5-14269 kde5-14686 kea ken/TL2024 ken/inkscape-core-mods ken/tuningfonts krejzi/svn lazarus lxqt nosym perl-modules plabs/newcss plabs/python-mods python3.11 qt5new rahul/power-profiles-daemon renodr/vulkan-addition systemd-11177 systemd-13485 trunk upgradedb xry111/intltool xry111/llvm18 xry111/soup3 xry111/test-20220226 xry111/xf86-video-removal
Last change on this file since 60db080 was bc24e52a, checked in by Randy McMurchy <randy@…>, 17 years ago

Updated to Heimdal-0.8.1

git-svn-id: svn://svn.linuxfromscratch.org/BLFS/trunk/BOOK@7120 af4574ff-66df-0310-9fd7-8a98e5e911e0
  • Property mode set to 100644
File size: 42.4 KB
Line 
1<?xml version="1.0" encoding="ISO-8859-1"?>
2<!DOCTYPE sect1 PUBLIC "-//OASIS//DTD DocBook XML V4.5//EN"
3 "http://www.oasis-open.org/docbook/xml/4.5/docbookx.dtd" [
4 <!ENTITY % general-entities SYSTEM "../../general.ent">
5 %general-entities;
6
7 <!ENTITY heimdal-download-http "http://ftp.vc-graz.ac.at/mirror/crypto/kerberos/heimdal/heimdal-&heimdal-version;.tar.gz">
8 <!ENTITY heimdal-download-ftp "ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-&heimdal-version;.tar.gz">
9 <!ENTITY heimdal-md5sum "7ff8c4850bce9702d9d3cf9eff05abaa">
10 <!ENTITY heimdal-size "3.1 MB">
11 <!ENTITY heimdal-buildsize "127 MB">
12 <!ENTITY heimdal-time "3.7 SBU (additional 1.5 SBU to run the test suite)">
13]>
14
15<sect1 id="heimdal" xreflabel="Heimdal-&heimdal-version;">
16 <?dbhtml filename="heimdal.html"?>
17
18 <sect1info>
19 <othername>$LastChangedBy$</othername>
20 <date>$Date$</date>
21 </sect1info>
22
23 <title>Heimdal-&heimdal-version;</title>
24
25 <indexterm zone="heimdal">
26 <primary sortas="a-Heimdal">Heimdal</primary>
27 </indexterm>
28
29 <sect2 role="package">
30 <title>Introduction to Heimdal</title>
31
32 <para><application>Heimdal</application> is a free implementation
33 of Kerberos 5 that aims to be compatible with MIT krb5 and is
34 backward compatible with krb4. Kerberos is a network authentication
35 protocol. Basically it preserves the integrity of passwords in any
36 untrusted network (like the Internet). Kerberized applications work
37 hand-in-hand with sites that support Kerberos to ensure that passwords
38 cannot be stolen or compromised. A Kerberos installation will make changes
39 to the authentication mechanisms on your network and will overwrite several
40 programs and daemons from the <application>Coreutils</application>,
41 <application>Inetutils</application>, <application>Qpopper</application>
42 and <application>Shadow</application> packages.</para>
43
44 <bridgehead renderas="sect3">Package Information</bridgehead>
45 <itemizedlist spacing="compact">
46 <listitem>
47 <para>Download (HTTP): <ulink url="&heimdal-download-http;"/></para>
48 </listitem>
49 <listitem>
50 <para>Download (FTP): <ulink url="&heimdal-download-ftp;"/></para>
51 </listitem>
52 <listitem>
53 <para>Download MD5 sum: &heimdal-md5sum;</para>
54 </listitem>
55 <listitem>
56 <para>Download size: &heimdal-size;</para>
57 </listitem>
58 <listitem>
59 <para>Estimated disk space required: &heimdal-buildsize;</para>
60 </listitem>
61 <listitem>
62 <para>Estimated build time: &heimdal-time;</para>
63 </listitem>
64 </itemizedlist>
65
66 <bridgehead renderas="sect3">Additional Downloads</bridgehead>
67 <itemizedlist spacing='compact'>
68 <!-- <listitem>
69 <para>Required Patch: <ulink
70 url="ftp://ftp.pdc.kth.se/pub/heimdal/src/heimdal-0.7.2-setuid-patch.txt"/></para>
71 </listitem>
72 <listitem>
73 <para>Required Patch: <ulink
74 url="&patch-root;/heimdal-&heimdal-version;-fhs_compliance-1.patch"/></para>
75 </listitem> -->
76 <listitem>
77 <para>Required patch for <application>CrackLib</application> support: <ulink
78 url="&patch-root;/heimdal-&heimdal-version;-cracklib-1.patch"/></para>
79 </listitem>
80 </itemizedlist>
81
82 <bridgehead renderas="sect3">Heimdal Dependencies</bridgehead>
83
84 <bridgehead renderas="sect4">Required to Build the Server-Side Tools</bridgehead>
85 <para role="required">
86 <!-- <xref linkend="db"/> -->
87 <xref linkend="db"/> is recommended (installed in LFS)
88 or <xref linkend="gdbm"/></para>
89
90 <bridgehead renderas="sect4">Recommended</bridgehead>
91 <para role="recommended"><xref linkend="openssl"/></para>
92
93 <bridgehead renderas="sect4">Optional</bridgehead>
94 <para role="optional"><xref linkend="linux-pam"/>,
95 <xref linkend="openldap"/>,
96 <xref linkend="x-window-system"/>,
97 <xref linkend="cracklib"/> (compiled with the <filename>heimdal</filename> patch),
98 <ulink url="http://packages.debian.org/stable/source/libcap">libcap</ulink>, and
99 <ulink url="http://www.pdc.kth.se/kth-krb/">krb4</ulink></para>
100
101 <note>
102 <para>Some sort of time synchronization facility on your system
103 (like <xref linkend="ntp"/>) is required since Kerberos won't
104 authenticate if the time differential between a kerberized client
105 and the KDC server is more than 5 minutes.</para>
106 </note>
107
108 <para condition="html" role="usernotes">User Notes:
109 <ulink url="&blfs-wiki;/heimdal"/></para>
110
111 </sect2>
112
113 <sect2 role="installation">
114 <title>Installation of Heimdal</title>
115
116 <!-- This doesn't appear to be needed any longer as testing has
117 shown that the ftp client now works without issues
118
119 <para>Before installing the package, you may want to preserve the
120 <command>ftp</command> program from the <application>Inetutils</application>
121 package. This is because using the <application>Heimdal</application>
122 <command>ftp</command> program to connect to non-kerberized ftp servers may
123 not work properly. It will allow you to connect (letting you know that
124 transmission of the password is clear text) but will have problems doing
125 puts and gets. Issue the following command as the
126 <systemitem class="username">root</systemitem> user.</para>
127
128<screen role="root"><userinput>mv -v /usr/bin/ftp /usr/bin/ftpn</userinput></screen>
129 -->
130
131 <warning>
132 <para>Ensure you really need a Kerberos installation before you decide
133 to install this package. Failure to install and configure the package
134 correctly can alter your system so that users cannot log in.</para>
135 </warning>
136
137 <para>If you wish the <application>Heimdal</application> package to
138 link against the <application>CrackLib</application> library to provide
139 enforcement of strong passwords (requires <xref linkend="cracklib"/>
140 installed with the <filename>heimdal</filename> patch), you must apply a
141 patch:</para>
142
143<screen><userinput>patch -Np1 -i ../heimdal-&heimdal-version;-cracklib-1.patch</userinput></screen>
144
145 <para>Install <application>Heimdal</application> by running the following
146 commands:</para>
147
148<screen><userinput>sed -i 's|/var/heimdal|/var/lib/heimdal|' $(grep -lr /var/heimdal *) &amp;&amp;
149./configure --prefix=/usr \
150 --sysconfdir=/etc/heimdal \
151 --libexecdir=/usr/sbin \
152 --datadir=/var/lib/heimdal \
153 --localstatedir=/var/lib/heimdal \
154 --with-readline=/usr \
155 --enable-kcm &amp;&amp;
156make</userinput></screen>
157
158 <!-- Docs building is broken - when fixec, insert hyphens in the makeinfo commands
159 <para>If you have <xref linkend="tetex"/> installed and wish to create
160 alternate forms of the documentation, issue any or all of the following
161 commands:</para>
162
163<screen><userinput>make -C doc html &amp;&amp;
164mv doc/heimdal.html doc/html &amp;&amp;
165make -C doc pdf &amp;&amp;
166make -C doc ps &amp;&amp;
167makeinfo -html -no-split -o doc/heimdal.html doc/heimdal.texi &amp;&amp;
168makeinfo -plaintext -o doc/heimdal.txt doc/heimdal.texi</userinput></screen>
169 -->
170
171 <para>To test the results, issue: <command>make check</command>.</para>
172
173 <para>Now, as the <systemitem class="username">root</systemitem> user:</para>
174
175<screen role="root"><?dbfo keep-together="auto"?><userinput>mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.e2fsprogs &amp;&amp;
176mv -v /usr/lib/libss.a /usr/lib/libss.a.e2fsprogs &amp;&amp;
177mv -v /usr/lib/libss.so /usr/lib/libss.so.e2fsprogs &amp;&amp;
178
179make install &amp;&amp;
180
181mv -v /usr/include/ss/ss.h /usr/include/ss/ss.h.heimdal &amp;&amp;
182mv -v /usr/include/ss/ss.h.e2fsprogs /usr/include/ss/ss.h &amp;&amp;
183mv -v /usr/lib/libss.a /usr/lib/libss.a.heimdal &amp;&amp;
184mv -v /usr/lib/libss.a.e2fsprogs /usr/lib/libss.a &amp;&amp;
185mv -v /usr/lib/libss.so /usr/lib/libss.so.heimdal &amp;&amp;
186mv -v /usr/lib/libss.so.e2fsprogs /usr/lib/libss.so &amp;&amp;
187mv -v /usr/lib/libss.la /usr/lib/libss.la.heimdal &amp;&amp;
188
189mv -v /bin/login /bin/login.shadow &amp;&amp;
190mv -v /bin/su /bin/su.shadow &amp;&amp;
191mv -v /usr/bin/{login,su} /bin &amp;&amp;
192ln -v -sf ../../bin/login /usr/bin &amp;&amp;
193
194for LINK in lib{otp,kafs,krb5,hx509,asn1,roken,crypto}; do
195 mv -v /usr/lib/${LINK}.so.* /lib &amp;&amp;
196 ln -v -sf ../../lib/$(readlink /usr/lib/${LINK}.so) \
197 /usr/lib/${LINK}.so
198done &amp;&amp;
199
200mv -v /usr/lib/$(readlink /usr/lib/libdb.so) \
201 /usr/lib/libdb-?.so \
202 /lib &amp;&amp;
203ln -v -sf ../../lib/$(readlink /usr/lib/libdb.so) \
204 /usr/lib/libdb.so &amp;&amp;
205
206ldconfig</userinput></screen>
207
208 <!-- <para>If you built any of the alternate forms of documentation, install it
209 using the following commands as the
210 <systemitem class="username">root</systemitem> user:</para>
211
212<screen role="root"><userinput>install -v -m755 -d /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
213install -v -m644 doc/html/* \
214 /usr/share/doc/heimdal-&heimdal-version;/html &amp;&amp;
215install -v -m644 doc/heimdal.{dvi,ps,pdf,html,txt} \
216 /usr/share/doc/heimdal-&heimdal-version;</userinput></screen> -->
217
218 </sect2>
219
220 <sect2 role="commands">
221 <title>Command Explanations</title>
222
223 <para><command>sed -i '...' $(grep -lr /var/heimdal *)</command>:
224 This command is used to change all occurances of hard-coded
225 <filename class='directory'>/var/heimdal</filename> to
226 <filename class='directory'>/var/lib/heimdal</filename> so the
227 installation will be FHS compliant.</para>
228
229 <para><command>mv -v /usr/include/...</command> and
230 <command>mv -v /usr/lib/libss.*</command>: The
231 <application>Heimdal</application> installation will overwrite an
232 interface header, static library and library symbolic link from the
233 <application>E2fsprogs</application> package. These commands rename the
234 original files before the installation, and then restore them (after
235 renaming the new <application>Heimdal</application> files) after the
236 installation.</para>
237
238 <para><parameter>--libexecdir=/usr/sbin</parameter>: This switch causes
239 the daemon programs to be installed into
240 <filename class="directory">/usr/sbin</filename>.</para>
241
242 <tip>
243 <para>If you want to preserve all your existing
244 <application>Inetutils</application> package daemons, install the
245 <application>Heimdal</application> daemons into
246 <filename class="directory">/usr/sbin/heimdal</filename> (or wherever
247 you want). Since these programs will be called from
248 <command>(x)inetd</command> or <filename>rc</filename> scripts, it
249 really doesn't matter where they are installed, as long as they are
250 correctly specified in the <filename>/etc/(x)inetd.conf</filename> file
251 and <filename>rc</filename> scripts. If you choose something other than
252 <filename class="directory">/usr/sbin</filename>, you may want to move
253 some of the user programs (such as <command>kadmin</command>) to
254 <filename class="directory">/usr/sbin</filename> manually so they'll be
255 in the privileged user's default <envar>PATH</envar>.</para>
256 </tip>
257
258 <para><command>mv ... .shadow; mv ... /bin; ln -v -sf ../../bin...</command>:
259 The <command>login</command> and <command>su</command> programs installed by
260 <application>Heimdal</application> belong in the
261 <filename class="directory">/bin</filename> directory. The
262 <command>login</command> program is symlinked because
263 <application>Heimdal</application> is expecting to find it in
264 <filename class="directory">/usr/bin</filename>. The old executables are
265 preserved before the move so that they can be restored if you experience
266 problems logging into the system after the
267 <application>Heimdal</application> package is installed and
268 configured.</para>
269
270 <para><command>mv ... /lib; ln -v -sf ../../lib/lib... /usr/lib...</command>:
271 The <command>login</command> and <command>su</command> programs installed
272 by <application>Heimdal</application> link against
273 <application>Heimdal</application> libraries as well as libraries provided
274 by the <application>OpenSSL</application> and
275 <application>Berkeley DB</application> packages. These
276 libraries are moved to <filename class="directory">/lib</filename> to be
277 FHS compliant and also in case
278 <filename class="directory">/usr</filename> is located on a separate
279 partition which may not always be mounted.</para>
280
281 </sect2>
282
283 <sect2 role="configuration">
284 <title>Configuring Heimdal</title>
285
286 <sect3 id="heimdal-config">
287 <title>Config Files</title>
288
289 <para><filename>/etc/heimdal/*</filename></para>
290
291 <indexterm zone="heimdal heimdal-config">
292 <primary sortas="e-etc-heimdal">/etc/heimdal/*</primary>
293 </indexterm>
294
295 </sect3>
296
297 <sect3>
298 <title>Configuration Information</title>
299
300 <note>
301 <para>All the configuration steps shown below must be accomplished
302 by the <systemitem class='username'>root</systemitem> user unless
303 otherwise noted.</para>
304 </note>
305
306 <sect4>
307 <title>Master KDC Server Configuration</title>
308
309 <para>Create the Kerberos configuration file with the
310 following commands:</para>
311
312<screen role="root"><userinput>install -v -m755 -d /etc/heimdal &amp;&amp;
313cat &gt; /etc/heimdal/krb5.conf &lt;&lt; "EOF"
314<literal># Begin /etc/heimdal/krb5.conf
315
316[libdefaults]
317 default_realm = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
318 encrypt = true
319
320[realms]
321 <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> = {
322 kdc = <replaceable>&lt;hostname.example.com&gt;</replaceable>
323 admin_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
324 kpasswd_server = <replaceable>&lt;hostname.example.com&gt;</replaceable>
325 }
326
327[domain_realm]
328 .<replaceable>&lt;example.com&gt;</replaceable> = <replaceable>&lt;EXAMPLE.COM&gt;</replaceable>
329
330[logging]
331 kdc = FILE:/var/log/kdc.log
332 admin_server = FILE:/var/log/kadmin.log
333 default = FILE:/var/log/krb.log
334
335# End /etc/heimdal/krb5.conf</literal>
336EOF
337chmod -v 644 /etc/heimdal/krb5.conf</userinput></screen>
338
339 <para>You will need to substitute your domain and proper hostname
340 for the occurrences of the <replaceable>&lt;hostname&gt;</replaceable>
341 and <replaceable>&lt;EXAMPLE.COM&gt;</replaceable> names.</para>
342
343 <para><option>default_realm</option> should be the name of your
344 domain changed to ALL CAPS. This isn't required, but both
345 <application>Heimdal</application> and <application>MIT
346 krb5</application> recommend it.</para>
347
348 <para><option>encrypt = true</option> provides encryption of all
349 traffic between kerberized clients and servers. It's not necessary
350 and can be left off. If you leave it off, you can encrypt all traffic
351 from the client to the server using a switch on the client program
352 instead.</para>
353
354 <para>The <option>[realms]</option> parameters tell the client
355 programs where to look for the KDC authentication services.</para>
356
357 <para>The <option>[domain_realm]</option> section maps a domain
358 to a realm.</para>
359
360 <para>Store the master password in a key file using the following
361 commands:</para>
362
363<screen role="root"><userinput>install -v -m755 -d /var/lib/heimdal &amp;&amp;
364kstash</userinput></screen>
365
366 <para>Create the KDC database:</para>
367
368<screen role="root"><userinput>kadmin -l</userinput></screen>
369
370 <para>The commands below will prompt you for information about the
371 principles. Choose the defaults for now unless you know what you are
372 doing and need to specify different values. You can go in later and
373 change the defaults, should you feel the need. You may use the up and
374 down arrow keys to use the history feature of <command>kadmin</command>
375 in a similar manner as the <command>bash</command> history
376 feature.</para>
377
378 <para>At the <prompt>kadmin&gt;</prompt> prompt, issue the following
379 statement:</para>
380
381<screen role="root"><userinput>init <replaceable>&lt;EXAMPLE.COM&gt;</replaceable></userinput></screen>
382
383 <para>The database must now be populated with at least one principle
384 (user). For now, just use your regular login name or root. You may
385 create as few, or as many principles as you wish using the following
386 statement:</para>
387
388<screen role="root"><userinput>add <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
389
390 <para>The KDC server and any machine running kerberized
391 server daemons must have a host key installed:</para>
392
393<screen role="root"><userinput>add --random-key host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
394
395 <para>After choosing the defaults when prompted, you will have to
396 export the data to a keytab file:</para>
397
398<screen role="root"><userinput>ext host/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
399
400 <para>This should have created two files in
401 <filename class="directory">/etc/heimdal</filename>:
402 <filename>krb5.keytab</filename> (Kerberos 5) and
403 <filename>srvtab</filename> (Kerberos 4). Both files should have 600
404 (root rw only) permissions. Keeping the keytab files from public access
405 is crucial to the overall security of the Kerberos installation.</para>
406
407 <para>Eventually, you'll want to add server daemon principles to the
408 database and extract them to the keytab file. You do this in the same
409 way you created the host principles. Below is an example:</para>
410
411<screen role="root"><userinput>add --random-key ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
412
413 <para>(choose the defaults)</para>
414
415<screen role="root"><userinput>ext ftp/<replaceable>&lt;hostname.example.com&gt;</replaceable></userinput></screen>
416
417 <para>Exit the <command>kadmin</command> program (use
418 <command>quit</command> or <command>exit</command>) and return back
419 to the shell prompt. Start the KDC daemon manually, just to test out
420 the installation:</para>
421
422<screen role="root"><userinput>/usr/sbin/kdc &amp;</userinput></screen>
423
424 <para>Attempt to get a TGT (ticket granting ticket) with
425 the following command:</para>
426
427<screen><userinput>kinit <replaceable>&lt;loginname&gt;</replaceable></userinput></screen>
428
429 <para>You will be prompted for the password you created. After you get
430 your ticket, you should list it with the following command:</para>
431
432<screen><userinput>klist</userinput></screen>
433
434 <para>Information about the ticket should be displayed on
435 the screen.</para>
436
437 <para>To test the functionality of the <filename>keytab</filename> file,
438 issue the following command:</para>
439
440<screen><userinput>ktutil list</userinput></screen>
441
442 <para>This should dump a list of the host principals, along with the
443 encryption methods used to access the principals.</para>
444
445 <para>At this point, if everything has been successful so far, you
446 can feel fairly confident in the installation, setup and configuration
447 of your new <application>Heimdal</application> Kerberos 5
448 installation.</para>
449
450 <para id="heimdal-init">Install the
451 <filename>/etc/rc.d/init.d/heimdal</filename> init script included
452 in the <xref linkend="bootscripts"/> package:</para>
453
454 <indexterm zone="heimdal heimdal-init">
455 <primary sortas="f-heimdal">heimdal</primary>
456 </indexterm>
457
458<screen role="root"><userinput>make install-heimdal</userinput></screen>
459
460 </sect4>
461
462 <sect4>
463 <title>Using Kerberized Client Programs</title>
464
465 <para>To use the kerberized client programs (<command>telnet</command>,
466 <command>ftp</command>, <command>rsh</command>,
467 <command>rxterm</command>, <command>rxtelnet</command>,
468 <command>rcp</command>, <command>xnlock</command>), you first must get
469 a TGT. Use the <command>kinit</command> program to get the ticket.
470 After you've acquired the ticket, you can use the kerberized programs
471 to connect to any kerberized server on the network. You will not be
472 prompted for authentication until your ticket expires (default is one
473 day), unless you specify a different user as a command line argument
474 to the program.</para>
475
476 <para>The kerberized programs will connect to non-kerberized daemons,
477 warning you that authentication is not encrypted.</para>
478
479 <para>In order to use the <application>Heimdal</application>
480 <application>X</application> programs, you'll need to add a service
481 port entry to the <filename>/etc/services</filename> file for the
482 <command>kxd</command> server. There is no 'standardized port number'
483 for the 'kx' service in the IANA database, so you'll have to pick an
484 unused port number. Add an entry to the <filename>services</filename>
485 file similar to the entry below (substitute your chosen port number
486 for <replaceable>&lt;49150&gt;</replaceable>):</para>
487
488<screen><literal>kx <replaceable>&lt;49150&gt;</replaceable>/tcp # Heimdal kerberos X
489kx <replaceable>&lt;49150&gt;</replaceable>/udp # Heimdal kerberos X</literal></screen>
490
491 <para>For additional information consult <ulink
492 url="&hints-root;/downloads/files/heimdal.txt">the
493 Heimdal hint</ulink> on which the above instructions are based.</para>
494
495 </sect4>
496
497 </sect3>
498
499 </sect2>
500
501 <sect2 role="content">
502 <title>Contents</title>
503
504 <segmentedlist>
505 <segtitle>Installed Programs</segtitle>
506 <segtitle>Installed Libraries</segtitle>
507 <segtitle>Installed Directories</segtitle>
508
509 <seglistitem>
510 <seg>afslog, ftp, ftpd, gss, hprop, hpropd, hxtool, iprop-log,
511 ipropd-master, ipropd-slave, kadmin, kadmind, kauth, kcm, kdc,
512 kdestroy, kdigest, kf, kfd, kgetcred, kimpersonate, kinit, klist,
513 kpasswd, kpasswdd, krb5-config, kstash, ktutil, kx, kxd, login,
514 mk_cmds, otp, otpprint, pagsh, pfrom, popper, push, rcp, rsh, rshd,
515 rxtelnet, rxterm, string2key, su, telnet, telnetd, tenletxr,
516 verify_krb5_conf and xnlock</seg>
517 <seg>libasn1.{so,a}, libeditline.{so,a}, libgssapi.{so,a},
518 libhdb.{so,a}, libheimntlm.{so,a}, libhx509.{so,a},
519 libkadm5clnt.{so,a}, libkadm5srv.{so,a}, libkafs.{so,a},
520 libkdc.{so,a}, libkrb5.{so,a}, libotp.{so,a}, libroken.{so,a},
521 libsl.{so,a}, libss.{so,a} and windc.{so,a}</seg>
522 <seg>/etc/heimdal, /usr/include/gssapi, /usr/include/kadm5,
523 /usr/include/krb5, /usr/include/roken, /usr/include/ss,
524 /usr/share/doc/heimdal-&heimdal-version; and /var/lib/heimdal</seg>
525 </seglistitem>
526 </segmentedlist>
527
528 <variablelist>
529 <bridgehead renderas="sect3">Short Descriptions</bridgehead>
530 <?dbfo list-presentation="list"?>
531 <?dbhtml list-presentation="table"?>
532
533 <varlistentry id="afslog">
534 <term><command>afslog</command></term>
535 <listitem>
536 <para>obtains AFS tokens for a number of cells.</para>
537 <indexterm zone="heimdal afslog">
538 <primary sortas="b-afslog">afslog</primary>
539 </indexterm>
540 </listitem>
541 </varlistentry>
542
543 <varlistentry id="ftp">
544 <term><command>ftp</command></term>
545 <listitem>
546 <para>is a kerberized FTP client.</para>
547 <indexterm zone="heimdal ftp">
548 <primary sortas="b-ftp">ftp</primary>
549 </indexterm>
550 </listitem>
551 </varlistentry>
552
553 <varlistentry id="ftpd">
554 <term><command>ftpd</command></term>
555 <listitem>
556 <para>is a kerberized FTP daemon.</para>
557 <indexterm zone="heimdal ftpd">
558 <primary sortas="b-ftpd">ftpd</primary>
559 </indexterm>
560 </listitem>
561 </varlistentry>
562
563 <varlistentry id="hprop">
564 <term><command>hprop</command></term>
565 <listitem>
566 <para> takes a principal database in a specified format and converts
567 it into a stream of <application>Heimdal</application> database
568 records.</para>
569 <indexterm zone="heimdal hprop">
570 <primary sortas="b-hprop">hprop</primary>
571 </indexterm>
572 </listitem>
573 </varlistentry>
574
575 <varlistentry id="hpropd">
576 <term><command>hpropd</command></term>
577 <listitem>
578 <para>is a server that receives a database sent by
579 <command>hprop</command> and writes it as a local database.</para>
580 <indexterm zone="heimdal hpropd">
581 <primary sortas="b-hpropd">hpropd</primary>
582 </indexterm>
583 </listitem>
584 </varlistentry>
585
586 <varlistentry id="iprop-log">
587 <term><command>iprop-log</command></term>
588 <listitem>
589 <para>is used to maintain the iprop log file.</para>
590 <indexterm zone="heimdal iprop-log">
591 <primary sortas="b-iprop-log">iprop-log</primary>
592 </indexterm>
593 </listitem>
594 </varlistentry>
595
596 <varlistentry id="ipropd-master">
597 <term><command>ipropd-master</command></term>
598 <listitem>
599 <para>is a daemon which runs on the master KDC
600 server which incrementally propagates changes to the KDC
601 database to the slave KDC servers.</para>
602 <indexterm zone="heimdal ipropd-master">
603 <primary sortas="b-ipropd-master">ipropd-master</primary>
604 </indexterm>
605 </listitem>
606 </varlistentry>
607
608 <varlistentry id="ipropd-slave">
609 <term><command>ipropd-slave</command></term>
610 <listitem>
611 <para>is a daemon which runs on the slave KDC
612 servers which incrementally propagates changes to the KDC
613 database from the master KDC server.</para>
614 <indexterm zone="heimdal ipropd-slave">
615 <primary sortas="b-ipropd-slave">ipropd-slave</primary>
616 </indexterm>
617 </listitem>
618 </varlistentry>
619
620 <varlistentry id="kadmin">
621 <term><command>kadmin</command></term>
622 <listitem>
623 <para>is a utility used to make modifications to the Kerberos
624 database.</para>
625 <indexterm zone="heimdal kadmin">
626 <primary sortas="b-kadmin">kadmin</primary>
627 </indexterm>
628 </listitem>
629 </varlistentry>
630
631 <varlistentry id="kadmind">
632 <term><command>kadmind</command></term>
633 <listitem>
634 <para>is a server for administrative access to the Kerberos
635 database.</para>
636 <indexterm zone="heimdal kadmind">
637 <primary sortas="b-kadmind">kadmind</primary>
638 </indexterm>
639 </listitem>
640 </varlistentry>
641
642 <varlistentry id="kauth">
643 <term><command>kauth</command></term>
644 <listitem>
645 <para>is a symbolic link to the <command>kinit</command>
646 program.</para>
647 <indexterm zone="heimdal kauth">
648 <primary sortas="g-kauth">kauth</primary>
649 </indexterm>
650 </listitem>
651 </varlistentry>
652
653 <varlistentry id="kcm">
654 <term><command>kcm</command></term>
655 <listitem>
656 <para>is a process based credential cache for Kerberos
657 tickets.</para>
658 <indexterm zone="heimdal kcm">
659 <primary sortas="b-kcm">kcm</primary>
660 </indexterm>
661 </listitem>
662 </varlistentry>
663
664 <varlistentry id="kdc">
665 <term><command>kdc</command></term>
666 <listitem>
667 <para>is a Kerberos 5 server.</para>
668 <indexterm zone="heimdal kdc">
669 <primary sortas="b-kdc">kdc</primary>
670 </indexterm>
671 </listitem>
672 </varlistentry>
673
674 <varlistentry id="kdestroy">
675 <term><command>kdestroy</command></term>
676 <listitem>
677 <para>removes a principle's current set of tickets.</para>
678 <indexterm zone="heimdal kdestroy">
679 <primary sortas="b-kdestroy">kdestroy</primary>
680 </indexterm>
681 </listitem>
682 </varlistentry>
683
684 <varlistentry id="kf">
685 <term><command>kf</command></term>
686 <listitem>
687 <para>is a program which forwards tickets to a remote host through
688 an authenticated and encrypted stream.</para>
689 <indexterm zone="heimdal kf">
690 <primary sortas="b-kf">kf</primary>
691 </indexterm>
692 </listitem>
693 </varlistentry>
694
695 <varlistentry id="kfd">
696 <term><command>kfd</command></term>
697 <listitem>
698 <para>is a server used to receive forwarded tickets.</para>
699 <indexterm zone="heimdal kfd">
700 <primary sortas="b-kfd">kfd</primary>
701 </indexterm>
702 </listitem>
703 </varlistentry>
704
705 <varlistentry id="kgetcred">
706 <term><command>kgetcred</command></term>
707 <listitem>
708 <para>obtains a ticket for a service.</para>
709 <indexterm zone="heimdal kgetcred">
710 <primary sortas="b-kgetcred">kgetcred</primary>
711 </indexterm>
712 </listitem>
713 </varlistentry>
714
715 <varlistentry id="kinit">
716 <term><command>kinit</command></term>
717 <listitem>
718 <para>is used to authenticate to the Kerberos server as a principal
719 and acquire a ticket granting ticket that can later be used to obtain
720 tickets for other services.</para>
721 <indexterm zone="heimdal kinit">
722 <primary sortas="b-kinit">kinit</primary>
723 </indexterm>
724 </listitem>
725 </varlistentry>
726
727 <varlistentry id="klist">
728 <term><command>klist</command></term>
729 <listitem>
730 <para>reads and displays the current tickets in the credential
731 cache.</para>
732 <indexterm zone="heimdal klist">
733 <primary sortas="b-klist">klist</primary>
734 </indexterm>
735 </listitem>
736 </varlistentry>
737
738 <varlistentry id="kpasswd">
739 <term><command>kpasswd</command></term>
740 <listitem>
741 <para>is a program for changing Kerberos 5 passwords.</para>
742 <indexterm zone="heimdal kpasswd">
743 <primary sortas="b-kpasswd">kpasswd</primary>
744 </indexterm>
745 </listitem>
746 </varlistentry>
747
748 <varlistentry id="kpasswdd">
749 <term><command>kpasswdd</command></term>
750 <listitem>
751 <para>is a Kerberos 5 password changing server.</para>
752 <indexterm zone="heimdal kpasswdd">
753 <primary sortas="b-kpasswdd">kpasswdd</primary>
754 </indexterm>
755 </listitem>
756 </varlistentry>
757
758 <varlistentry id="krb5-config-prog">
759 <term><command>krb5-config</command></term>
760 <listitem>
761 <para>gives information on how to link programs against
762 <application>Heimdal</application> libraries.</para>
763 <indexterm zone="heimdal krb5-config-prog">
764 <primary sortas="b-krb5-config">krb5-config</primary>
765 </indexterm>
766 </listitem>
767 </varlistentry>
768
769 <varlistentry id="kstash">
770 <term><command>kstash</command></term>
771 <listitem>
772 <para>stores the KDC master password in a file.</para>
773 <indexterm zone="heimdal kstash">
774 <primary sortas="b-kstash">kstash</primary>
775 </indexterm>
776 </listitem>
777 </varlistentry>
778
779 <varlistentry id="ktutil">
780 <term><command>ktutil</command></term>
781 <listitem>
782 <para>is a program for managing Kerberos keytabs.</para>
783 <indexterm zone="heimdal ktutil">
784 <primary sortas="b-ktutil">ktutil</primary>
785 </indexterm>
786 </listitem>
787 </varlistentry>
788
789 <varlistentry id="kx">
790 <term><command>kx</command></term>
791 <listitem>
792 <para>is a program which securely forwards
793 <application>X</application> connections.</para>
794 <indexterm zone="heimdal kx">
795 <primary sortas="b-kx">kx</primary>
796 </indexterm>
797 </listitem>
798 </varlistentry>
799
800 <varlistentry id="kxd">
801 <term><command>kxd</command></term>
802 <listitem>
803 <para>is the daemon for <command>kx</command>.</para>
804 <indexterm zone="heimdal kxd">
805 <primary sortas="b-kxd">kxd</primary>
806 </indexterm>
807 </listitem>
808 </varlistentry>
809
810 <varlistentry id="login">
811 <term><command>login</command></term>
812 <listitem>
813 <para>is a kerberized login program.</para>
814 <indexterm zone="heimdal login">
815 <primary sortas="b-login">login</primary>
816 </indexterm>
817 </listitem>
818 </varlistentry>
819
820 <varlistentry id="otp">
821 <term><command>otp</command></term>
822 <listitem>
823 <para>manages one-time passwords.</para>
824 <indexterm zone="heimdal otp">
825 <primary sortas="b-otp">otp</primary>
826 </indexterm>
827 </listitem>
828 </varlistentry>
829
830 <varlistentry id="otpprint">
831 <term><command>otpprint</command></term>
832 <listitem>
833 <para>prints lists of one-time passwords.</para>
834 <indexterm zone="heimdal otpprint">
835 <primary sortas="b-otpprint">otpprint</primary>
836 </indexterm>
837 </listitem>
838 </varlistentry>
839
840 <varlistentry id="pfrom">
841 <term><command>pfrom</command></term>
842 <listitem>
843 <para>is a script that runs <command>push --from</command>.</para>
844 <indexterm zone="heimdal pfrom">
845 <primary sortas="b-pfrom">pfrom</primary>
846 </indexterm>
847 </listitem>
848 </varlistentry>
849
850 <varlistentry id="popper">
851 <term><command>popper</command></term>
852 <listitem>
853 <para>is a kerberized POP-3 server.</para>
854 <indexterm zone="heimdal popper">
855 <primary sortas="b-popper">popper</primary>
856 </indexterm>
857 </listitem>
858 </varlistentry>
859
860 <varlistentry id="push">
861 <term><command>push</command></term>
862 <listitem>
863 <para>is a kerberized POP mail retrieval client.</para>
864 <indexterm zone="heimdal push">
865 <primary sortas="b-push">push</primary>
866 </indexterm>
867 </listitem>
868 </varlistentry>
869
870 <varlistentry id="rcp">
871 <term><command>rcp</command></term>
872 <listitem>
873 <para>is a kerberized rcp client program.</para>
874 <indexterm zone="heimdal rcp">
875 <primary sortas="b-rcp">rcp</primary>
876 </indexterm>
877 </listitem>
878 </varlistentry>
879
880 <varlistentry id="rsh">
881 <term><command>rsh</command></term>
882 <listitem>
883 <para>is a kerberized rsh client program.</para>
884 <indexterm zone="heimdal rsh">
885 <primary sortas="b-rsh">rsh</primary>
886 </indexterm>
887 </listitem>
888 </varlistentry>
889
890 <varlistentry id="rshd">
891 <term><command>rshd</command></term>
892 <listitem>
893 <para>is a kerberized rsh server.</para>
894 <indexterm zone="heimdal rshd">
895 <primary sortas="b-rshd">rshd</primary>
896 </indexterm>
897 </listitem>
898 </varlistentry>
899
900 <varlistentry id="rxtelnet">
901 <term><command>rxtelnet</command></term>
902 <listitem>
903 <para>starts a secure <command>xterm</command> window with a
904 <command>telnet</command> to a given host and forwards
905 <application>X</application> connections.</para>
906 <indexterm zone="heimdal rxtelnet">
907 <primary sortas="b-rxtelnet">rxtelnet</primary>
908 </indexterm>
909 </listitem>
910 </varlistentry>
911
912 <varlistentry id="rxterm">
913 <term><command>rxterm</command></term>
914 <listitem>
915 <para>starts a secure remote <command>xterm</command>.</para>
916 <indexterm zone="heimdal rxterm">
917 <primary sortas="b-rxterm">rxterm</primary>
918 </indexterm>
919 </listitem>
920 </varlistentry>
921
922 <varlistentry id="string2key">
923 <term><command>string2key</command></term>
924 <listitem>
925 <para>maps a password into a key.</para>
926 <indexterm zone="heimdal string2key">
927 <primary sortas="b-string2key">string2key</primary>
928 </indexterm>
929 </listitem>
930 </varlistentry>
931
932 <varlistentry id="su">
933 <term><command>su</command></term>
934 <listitem>
935 <para>is a kerberized su client program.</para>
936 <indexterm zone="heimdal su">
937 <primary sortas="b-su">su</primary>
938 </indexterm>
939 </listitem>
940 </varlistentry>
941
942 <varlistentry id="telnet">
943 <term><command>telnet</command></term>
944 <listitem>
945 <para>is a kerberized telnet client program.</para>
946 <indexterm zone="heimdal telnet">
947 <primary sortas="b-telnet">telnet</primary>
948 </indexterm>
949 </listitem>
950 </varlistentry>
951
952 <varlistentry id="telnetd">
953 <term><command>telnetd</command></term>
954 <listitem>
955 <para>is a kerberized telnet server.</para>
956 <indexterm zone="heimdal telnetd">
957 <primary sortas="b-telnetd">telnetd</primary>
958 </indexterm>
959 </listitem>
960 </varlistentry>
961
962 <varlistentry id="tenletxr">
963 <term><command>tenletxr</command></term>
964 <listitem>
965 <para>forwards <application>X</application> connections
966 backwards.</para>
967 <indexterm zone="heimdal tenletxr">
968 <primary sortas="b-tenletxr">tenletxr</primary>
969 </indexterm>
970 </listitem>
971 </varlistentry>
972
973 <varlistentry id="verify_krb5_conf">
974 <term><command>verify_krb5_conf</command></term>
975 <listitem>
976 <para>checks <filename>krb5.conf</filename> file for obvious
977 errors.</para>
978 <indexterm zone="heimdal verify_krb5_conf">
979 <primary sortas="b-verify_krb5_conf">verify_krb5_conf</primary>
980 </indexterm>
981 </listitem>
982 </varlistentry>
983
984 <varlistentry id="xnlock">
985 <term><command>xnlock</command></term>
986 <listitem>
987 <para>is a program that acts as a secure screen saver for
988 workstations running <application>X</application>.</para>
989 <indexterm zone="heimdal xnlock">
990 <primary sortas="b-xnlock">xnlock</primary>
991 </indexterm>
992 </listitem>
993 </varlistentry>
994
995 <varlistentry id="libasn1">
996 <term><filename class='libraryfile'>libasn1.{so,a}</filename></term>
997 <listitem>
998 <para>provides the ASN.1 and DER functions to encode and decode
999 the Kerberos TGTs.</para>
1000 <indexterm zone="heimdal libasn1">
1001 <primary sortas="c-libasn1">libasn1.{so,a}</primary>
1002 </indexterm>
1003 </listitem>
1004 </varlistentry>
1005
1006 <varlistentry id="libeditline">
1007 <term><filename class='libraryfile'>libeditline.a</filename></term>
1008 <listitem>
1009 <para>is a command-line editing library with history.</para>
1010 <indexterm zone="heimdal libeditline">
1011 <primary sortas="c-libeditline">libeditline.a</primary>
1012 </indexterm>
1013 </listitem>
1014 </varlistentry>
1015
1016 <varlistentry id="libgssapi">
1017 <term><filename class='libraryfile'>libgssapi.{so,a}</filename></term>
1018 <listitem>
1019 <para>contain the Generic Security Service Application Programming
1020 Interface (GSSAPI) functions which provides security
1021 services to callers in a generic fashion, supportable with a range of
1022 underlying mechanisms and technologies and hence allowing source-level
1023 portability of applications to different environments.</para>
1024 <indexterm zone="heimdal libgssapi">
1025 <primary sortas="c-libgssapi">libgssapi.{so,a}</primary>
1026 </indexterm>
1027 </listitem>
1028 </varlistentry>
1029
1030 <varlistentry id="libhdb">
1031 <term><filename class='libraryfile'>libhdb.{so,a}</filename></term>
1032 <listitem>
1033 <para>is a <application>Heimdal</application> Kerberos 5
1034 authentication/authorization database access library.</para>
1035 <indexterm zone="heimdal libhdb">
1036 <primary sortas="c-libhdb">libhdb.{so,a}</primary>
1037 </indexterm>
1038 </listitem>
1039 </varlistentry>
1040
1041 <varlistentry id="libkadm5clnt">
1042 <term><filename class='libraryfile'>libkadm5clnt.{so,a}</filename></term>
1043 <listitem>
1044 <para>contains the administrative authentication and password
1045 checking functions required by Kerberos 5 client-side programs.</para>
1046 <indexterm zone="heimdal libkadm5clnt">
1047 <primary sortas="c-libkadm5clnt">libkadm5clnt.{so,a}</primary>
1048 </indexterm>
1049 </listitem>
1050 </varlistentry>
1051
1052 <varlistentry id="libkadm5srv">
1053 <term><filename class='libraryfile'>libkadm5srv.{so,a}</filename></term>
1054 <listitem>
1055 <para>contain the administrative authentication and password
1056 checking functions required by Kerberos 5 servers.</para>
1057 <indexterm zone="heimdal libkadm5srv">
1058 <primary sortas="c-libkadm5srv">libkadm5srv.{so,a}</primary>
1059 </indexterm>
1060 </listitem>
1061 </varlistentry>
1062
1063 <varlistentry id="libkafs">
1064 <term><filename class='libraryfile'>libkafs.{so,a}</filename></term>
1065 <listitem>
1066 <para>contains the functions required to authenticated to AFS.</para>
1067 <indexterm zone="heimdal libkafs">
1068 <primary sortas="c-libkafs">libkafs.{so,a}</primary>
1069 </indexterm>
1070 </listitem>
1071 </varlistentry>
1072
1073 <varlistentry id="libkrb5">
1074 <term><filename class='libraryfile'>libkrb5.{so,a}</filename></term>
1075 <listitem>
1076 <para>is an all-purpose Kerberos 5 library.</para>
1077 <indexterm zone="heimdal libkrb5">
1078 <primary sortas="c-libkrb5">libkrb5.{so,a}</primary>
1079 </indexterm>
1080 </listitem>
1081 </varlistentry>
1082
1083 <varlistentry id="libotp">
1084 <term><filename class='libraryfile'>libotp.{so,a}</filename></term>
1085 <listitem>
1086 <para>contains the functions required to handle authenticating
1087 one time passwords.</para>
1088 <indexterm zone="heimdal libotp">
1089 <primary sortas="c-libotp">libotp.{so,a}</primary>
1090 </indexterm>
1091 </listitem>
1092 </varlistentry>
1093
1094 <varlistentry id="libroken">
1095 <term><filename class='libraryfile'>libroken.{so,a}</filename></term>
1096 <listitem>
1097 <para>is a library containing Kerberos 5 compatibility
1098 functions.</para>
1099 <indexterm zone="heimdal libroken">
1100 <primary sortas="c-libroken">libroken.{so,a}</primary>
1101 </indexterm>
1102 </listitem>
1103 </varlistentry>
1104
1105 </variablelist>
1106
1107 </sect2>
1108
1109</sect1>
Note: See TracBrowser for help on using the repository browser.